UKO User Roles

Security administrator

The default security administrator is the hardcoded administrator who can add more security administrators, UKO administrators, and UKO operators. A security admin can also add, edit, or delete LDAP connections. LDAP directories have user lists that you can synchronize to the system and add the users with various roles.

A security administrator:

• Can view the Administration page
• Cannot view or download audit logs
• Can view API but not passcodes

Regular security admins cannot delete or change the role of hardcoded security admin. But the hardcoded security admin can change the roles of regular security admins or delete them.

UKO administrator

UKO administrators can manage (add, edit, or delete) system roles and have access to all vaults. They can see other UKO Admins and UKO operator roles.

A UKO administrator

• Can view and manage the Administration page
• Can view and download audit logs
• can view API and passcodes

UKO operator

A security administrator can assign the UKO operator role to users. Later, a UKO administrator can assign one or more of the Following UKO operator roles:

• Vault Admin
• Key Template Admin
• Key Custodian 1
• Key Custodian 2
• UKO Auditor

A UKO operator without a vault-specific role:

• Can view the Administration page
• Cannot view or download audit logs
• Can view API and passcodes

A UKO operator with a vault-specific role (except UKO Auditor):

• Can view the Administration page
• Cannot view or download audit logs
• Can view API and passcodes

A UKO Auditor:

• Can view the Administration page
• Can view or download audit logs
• Can view API and passcodes

For information about LDAP, see Lightweight Directory Access Protocol (LDAP). For information about user management, see Manage users.

Privileges of system roles and vault-specific roles

The following tables cover the privileges of system roles and vault-specific roles.