[Ejbca-develop] Delegation with Administrator Roles

[Michael S. <mi...@st...>]

HI!

(using 6.2)

I'd like to delegated control (approval, revocation, etc.) for some specific EE
profiles of sub CAs to groups of RA admins.

Therefore I've created a special sub CA for issuing RA admin certs, let's call
it "CA_RA-Admins" and a EE profile "EE_RA-Admin".

After that a administrator role was created and certs issued based on
"EE_RA-Admin" were added.

Access rules were defined granting rights for "Other-Sub-CA" with EE profile
"EE_Others".

But it does not work. I have to grant rights to "CA_RA-Admins" and the EE
profile "EE_RA-Admin" to make it work. But obviously that's not right.

Even when issuing certs based EE profile "EE_RA-Admin" with "Other-Sub-CA" it
does not work.

How do others delegate control to certain administrator roles?

Ciao, Michael.