Administrator Responsibilities for Users

The System Administrator role creates user accounts. The Security Administrator role sets up the security aspects of an account.

For details on setting up users and roles, see the following:

• Setting Up and Managing User Accounts by Using the CLI (Task Map) in Managing User Accounts and User Environments in Oracle Solaris 11.1

• Part III, Roles, Rights Profiles, and Privileges, in Oracle Solaris 11.1 Administration: Security Services

System Administrator Responsibilities for Users

In Trusted Extensions, the System Administrator role is responsible for determining who can access the system. The system administrator is responsible for the following tasks:

• Adding and deleting users

• Adding and deleting roles

• Assigning the initial password

• Modifying user and role properties, other than security attributes

Security Administrator Responsibilities for Users

In Trusted Extensions, the Security Administrator role is responsible for all security attributes of a user or role. The security administrator is responsible for the following tasks:

• Assigning and modifying the security attributes of a user, role, or rights profile

• Creating and modifying rights profiles

• Assigning rights profiles to a user or role

• Assigning privileges to a user, role, or rights profile

• Assigning authorizations to a user, a role, or rights profile

• Removing privileges from a user, role, or rights profile

• Removing authorizations from a user, role, or rights profile

Typically, the Security Administrator role creates rights profiles. However, if a profile needs capabilities that the Security Administrator role cannot grant, then the root role can create the profile.

Before creating a rights profile, the security administrator needs to analyze whether any of the commands in the new profile need privilege or authorization to be successful. The man pages for individual commands list the privileges and authorizations that might be needed.