u.trust LAN Crypt Admin API · English
Required Rights and Permissions
HerstellerquelleImportierter Dokumentationsstand – bitte Produktversion beachten.
For API functions
The following table lists the permissions and rights required for all functions. Target as in the last column can be a group or a security officer depending on the context. Some functions can only be called by a MSO. Permissions in brackets are only required in certain situations or certain parameter values.
Note
- a function also returns LCAPIERR_INSUFFICIENT_RIGHTS if additional authorization is configured for the corresponding action.
| Function | Permissions | Rights on Target |
|---|---|---|
| AddKeyToGroup | Create Keys, Copy Keys | Create Keys (on target group), Copy Keys (on group to which the key belongs) |
| AddSO | Create SO, Assign Certificates, Change ACLs, Change Permissions + permissions to set | |
| AddSubGroup | Administer Groups | Add Group |
| AddUserToGroup | Administer Groups, Administer Users | Add User, Copy User (current parent group), Change Properties (current parent group if parent group is changed) |
| ArchiveLogEntries | Manage Logging | |
| AssignCertificateToUser | Assign Certificates or Assign Certificates to all Members | Assign Certificates (on parent group) or Assign Certificates to all Members in at least one users group |
| AssignCertificatesToUsersOfGroup | Assign Certificates (Assign Certificates to all Members) | Assign Certificates (Assign Certificates to all Members) |
| CheckDBIntegrity | ||
| CheckLogIntegrity | ||
| CreateCertificate | ||
| CreateCertificatesForUsersOfGroup | Assign Certificates, Create Certificates (Assign Certificates to all Members) | Assign Certificates (Assign Certificates to all Members) |
| CreateDBTables | ||
| CreateFirstMSO | ||
| CreateGroup(Ex) | Administer Groups | Add Group |
| CreateUser(Ex) | Administer Users, (Use specific Keys) | |
| DeleteGroup | Administer Groups, Administer Users | Change Properties, Delete Group, Delete Subgroups, Delete Users |
| DeleteKey | Only MSO | |
| DeleteLogEntries | Manage Logging | |
| DeleteProfile | Create Profiles or Create Profiles for all Members | Create Profiles (on users parent group) or Create Profiles for all Members in at least one user group |
| DeleteRule | Create Rules | Create Rules |
| DeleteUser | Administer Users | Delete User (on group to which the user belongs) |
| DetachUserKey | Administer Users, Administer Groups, Use specific Keys | Change Properties (on parent group) |
| DropDBT ables | ||
| EnableKey | Create Keys, (Use specific Keys) | Create Keys |
| EnumCertificatesOfUser | ||
| EnumFQNOfGroupName | ||
| EnumFQNOfUserName | ||
| EnumGroupParents | Administer Groups | Read |
| EnumGroupsForKey | Read Key | |
| EnumGroupsForRule | ||
| EnumGroupsForSO | ReadACL (on SO) | |
| EnumGroupsForUser | ||
| EnumKeys | ||
| EnumKeysForUser | ||
| EnumRulesForGroup | Read | |
| EnumRulesForKey | Read Key | |
| EnumRulesForUser | ||
| EnumSOs | ||
| EnumSOsForGroup | Read | |
| EnumSubGroups | Visible | |
| EnumUserKeysOfUser | Read Key | |
| EnumUsersForKey | Read Key | |
| EnumUsersOfGroup | Administer Users | Read |
| EnumUsersWithFilter | Administer Users | |
| ExportLogEntries | Read Logentries | |
| ExportLogEntriesToMemory | Read Logentries | |
| GetDBIntegrityCheckReport | ||
| GetErrorDesc | ||
| GetGroupProperties | Administer Groups | Read Group |
| GetIntErrorCode | ||
| GetRightsOnGroupForSO | Administer Groups | Read (on Group) |
| GetRightsOnSOForSO | Read (on “on SO”) | |
| GetRuleProperties | Read (owner group of rule) | |
| GetRulePropertiesEx | Read (owner group of rule) | |
| GetSOCertificate | Read | |
| GetSOPermissions | Read | |
| GetUserProperties | ||
| GrantRightsOnGroupToSO | Administer Groups, Change ACLs | Change ACL + rights to set |
| GrantRightsOnSOToSO | Change ACLs | Change ACL + rights to set |
| ImportKey | Create Keys, (Create Profile) | Create Keys |
| ImportKeyEx | Create Keys, (Create Profile) | Create Keys |
| ImportKeyFile | Create Keys, (Create Profile) | Create Keys |
| LogoffFromDatabase | ||
| LogoffSO | ||
| LogonSO | Login to Database | |
| LogonToDatabase | ||
| ReadKey | Read Key (Create Profile) | Read (on group), (Create Profile (on group)) |
| ReadKeyEx | Read Key (Create Profile) | Read (on group), (Create Profile (on group)) |
| RecalcMACForRecord | Only MSO | |
| RemoveAllCertificatesFromUser | Assign Certificates or Assign Certificates to all Members | Assign Certificates (on parent group) or Assign Certificates to all Members in at least one user group |
| RemoveCertificateFromUser | Assign Certificates or Assign Certificates to all Members | Assign Certificates (on parent group) or Assign Certificates to all Members in at least one user group |
| RemoveGroupFromGroup | Administer Groups | Move Groups, Delete Subgroups (on parent group) |
| IsLinkedGroup | ||
| GetParentGroupOfKey | Read Key (Create Profile) | |
| RemoveKeyFromGroup | Create Keys, Delete Keys | Delete Keys |
| RemoveSO | Create SO | Delete SO, Change ACLs |
| RemoveUserFromGroup | Administer Groups, Administer Users | Delete User |
| RenameGroup | Administer Groups | Change Properties |
| SetGroupProperties | Administer Groups, (Use specific Keys), (Copy Keys) | Change Properties (Copy Key, (on group of key)) |
| SetRuleProperties | Create Rules | Create Rules (on owner group) |
| SetRulePropertiesEx | Create Rules | Create Rules (on owner group) |
| SetSOCertificate | Assign Certificates (Create Profile) | Change Certificate |
| SetSOPermissions | Change Permissions + permissions to set | Change Permissions |
| SetUserKey | Administer Users, Administer Groups, Copy Keys, Use specific Keys, | Change Properties (on parent group), Copy Key (on group of key) |
| SetUserProperties | Administer Users, (Administer Groups), (Copy Keys), (Use specific Keys) | Change Properties (on parent group), (Copy Key (on group of key)) |
| StartResolverForUser | Create Profiles or Create Profiles for all Members | Create Profiles (on users parent group) or Create Profile for all Members in at least one user group |
| StartResolverForUsersOfGroup | Create Profiles (Create Profiles for all Members) | Create Profiles (Create Profile for all Members in at least one user group) |
| StartResolverForUsersOf ChangedGroup | Create Profile (Create Profiles for all Members) | Create Profiles (Create Profiles for all Members in at least one user group) |
| UpdateKey | Create Keys | Create Keys |
| UpdateKeyEx | Only MSO | |
| WriteKey | Create Keys (Create Profile) | Create Keys |
| WriteRule | Create Rules | Create Rules |
| WriteRuleEx | Create Rules | Create Rules |
For GrantRightsOnGroupToSO()
The following table lists the permissions a SO must have in order to be granted or denied rights on a group. The SO who performs this operation needs the permissions “ Administer Groups” and “Change ACL” plus the rights that are being grant or denied.
| Right to Grant or Deny | Required Permission of Target |
|---|---|
| Create Keys | Create Keys |
| Copy Keys | Copy Keys |
| Delete Keys | Delete Keys |
| Create Rules | Create Rules |
| Assign Certificate | Assign Certificate |
| Assign Certificates to all Members | Assign Certificates to all Members |
| Add User | Administer Users |
| Copy User | Copy User |
| Delete User | Administer Users |
| Add Group | Administer Users |
| Delete Subgroup | Administer Users |
| Move Group | Administer Users |
| Change Group Properties | Administer Users |
| Delete Group | Administer Users |
| Create Profiles | Create Profiles |
| Create Profiles for all Members | Create Profiles for all Members |
| Change ACL | Change ACLs |
| Read | — |
| Visible | — |
For GrantRightsOnSOToSO()
The following table lists the permissions a SO must have in order to be granted or denied rights on another SO. The SO who performs this operation needs the permission “Change ACL” plus the rights that are being grant or denied.
| Right to Grant or Deny | Required Permission of Target |
|---|---|
| Change Name | — |
| Change Certificate | Assign Certificate |
| Change Region | — |
| Assign Configuration | — |
| Delete SO | Create SO |
| Change Permissions | Change Permissions |
| Change ACL | Change ACLs |
| Read | — |