Enterprises
ADSS Web RA subscription that is acquired for any group of people (team) or organization is called an enterprise account. These accounts are registered by admin operators. An enterprise account has three type of users, i.e. Enterprise Owner, Enterprise Admin (RAO) and Enterprise User:
- Enterprise Owner: While registering an Enterprise in ADSS Web RA, no user is created, only an owner of the enterprise is created. Only an enterprise will be created and then the operator will be able to create a user. An Enterprise Owner could be the CEO of the company who requests to register an enterprise in the ADSS Web RA.
- Enterprise Admin/ Enterprise RAO/ LRA Admin: These terms/ role names are used interchangeably but all refers to the same role. An Enterprise Admin is allowed to manage the users and certificate's vetting on behalf of his enterprise. An enterprise admin can invite the users from his organization to get the certificates. If self registration is disabled in the application then only the invited users via email can register their accounts in an enterprise. The enterprise admin can additionally vet a certificate request, revoke a certificate, delete a user etc.
- Enterprise User: An Enterprise RAO may send invitations to the organisational staff members of their associated enterprise(s) to bring them under their enterprise umbrella(s). The invitees who accept these invitations become the enterprise users. An enterprise user may have the restricted access on ADSS Web RA and will have to abide by the rules, as configured by their Enterprise RAO. An enterprise user can be a part of multiple enterprises.
Terminologies
- Low Assurance Certificates: These certificates are issued to individuals e.g. email signing, authentication, encryption certificates
- High Assurance Certificates: These certificates that are issued to organizations or websites e.g. TLS server authentication, code signing, eSeal or legal person certificates
- Multi tenancy: when an RAO or user is part of multiple enterprises, it is called multi tenancy in ADSS Web RA. The ADSS Web RA supports the multi tenancy and a user can be part of the multiple enterprises but at a time, he can see the certificates/requests of the one enterprise
How it Works?
- The ADSS Web RA must be configured for the High Assurance Certificates to be vetted by the Admin RAO
- The Enterprise RAO can be configured to vet the Low Assurance Certificates
- An enterprise can have one or more Enterprise RAOs who can manage and vet the low assurance certificates
- High assurance certificate should always be vetted by the Admin RAO because they bear more responsibility and requires more rigorous verification
- The Enterprise RAOs can invite the users in the ADSS Web RA from where they can submit the certificate issuance requests. The Enterprise RAOs vet the requests and either approve or reject the requests
- An Enterprise RAO can be a RAO for one of more enterprises. Similarly, a user can be registered in one or more enterprises using the same email address. Note that when an RAO or user is part of multiple enterprises, it can see the requests or certificates from the selected enterprise only. In short, at a time only one enterprise's data will be shown to the RAO or user
- An Enterprise RAO can see the activities of an enterprise user by clicking the more options button
- An enterprise can have the following statuses, the detailed actions are described in the table below:
- Active - users are allowed to login the system and submit the new certificate requests
- Suspended - the enterprise is temporarily suspended. The users of this enterprise can login the system but cannot submit the new requests
- Blocked - when you need to permanently block an enterprise. When blocked, neither users can login nor can they submit the request
- A user can also have the following statuses similar to an enterprise.
- Active - users are allowed to login the system and submit the new certificate requests
- Suspended - the user is temporarily suspended. The users can login the system but cannot submit the new requests
- Blocked - when you need to permanently block the user. When blocked, neither users can login nor they can submit the request
Delete an Enterprise
- Enterprise Owners should not be allowed to delete an enterprise in their role
- Deleting an enterprise is a very sensitive operation and application administrators should perform this activity using four eyes principal
- If an enterprise is deleted, the certificates issued by/ against any user of this organization will be permanently revoked and you cannot reinstate these certificate
The following are the steps to delete an enterprise:
- Click Enterprises from the left menu.
- Click the
adjacent to the enterprise in question.
- Select Delete.
- A confirmation dialog will appear. Click Yes.
Access Control Information
There are some certain rules that will be followed while managing or viewing enterprises list and it's related information. These rules are based on the user's type which includes Enterprise RAOs, Admin RAOs or Administrators.
Roles |
Allowed Features |
Enterprise RAO |
ADSS Web RA stores the all activities of the user and an Admin or Enterprise Admin can view that from More Options (
|
Admin RAO / Administrators |
|
Certificate Sharing
Sharing certificates between users of the same organisation is important when one of the users who was managing legal certificates leaves the organisation or is not available. In such situation, the other users are unable to manage certificates. The certificate sharing feature is available so that certificate management of SSL certificates is made easier between the users of the same organisation.
|
All profiles that are set in the Service Plan will be listed except the ones with Document Signing purpose. |
The following Certificate Sharing section will be visible to the persons with the same roles.
Same certificate will be visible to the other users of the same organisation that are configured in the Roles from Admin Portal.
The users can perform actions like re-issuance, rekeying, renewal, etc. of the certificates shared with them.