KeyControl User Accounts

You can create user accounts for KeyControl that have access to certain areas of the KeyControl webGUI based on their assigned user role. These accounts can also be used in the HyTrust CLI (Command Line Interface) and the HyTrust API calls when KeyControl authorization is required.

Each user account can have one or more roles assigned to it, and it may be assigned to one or more groups. The combination of user role and group membership fully defines the user's access level in KeyControl. The user role dictates what operations the user can perform and their group membership dictates which objects in the system they can affect.

Note:

The only user role that does not have an associated group is the Security Admin, because Security Admins only work with KeyControl users, groups, and Admin keys. Because these items are universal across all groups and cannot be further divided, there is no reason to have a Security Admin group.

By default, the KeyControl installer creates the user account secroot, which is automatically assigned all three user roles and placed in the two default groups (the Cloud Admin Group and Domain Admin Group). You can change the password and group membership for secroot, but you cannot delete the account or change its default user roles. We recommend you only give the secroot password to a very small number of administrators who need root-level access. In general, you should create a user account for every user and specifically define the account's privileges and group membership on a user by user basis.

The available user roles and their privileges are described below.

HyTrust DataControl v 4.1