- Overview
- Reference Guide
- Setup & Architecture
- Release Notes
- Workflow
- API Reference
- Integration Guide
- Discovery Agent Setup Guide
Identity and Access Control
CertSecure Manager controls access in two steps. Authentication confirms who a user or application is when it signs in to the portal or calls the API. Authorization then decides what that user or application is allowed to see and do. This page summarizes both and links to the sections where each is configured.
Signing In to the Portal
Users sign in to CertSecure Manager through Keycloak, the identity broker that is installed with CertSecure Manager. Each Keycloak realm defines a set of users and the identity providers they can sign in with, and administrators can connect more than one realm, for example for different business units or environments.
CertSecure Manager supports the following sign-in methods:
| Method | Description | Configured In |
|---|---|---|
| Keycloak realm account | The user signs in with an email address and password on the CertSecure Manager sign-in page. The first administrator account is created this way during onboarding. | Installation > Windows > First Login |
| Single sign-on through an identity provider | The realm brokers sign-in to an external OIDC or SAML 2.0 identity provider, such as Microsoft Entra ID (Azure AD) or Okta. | Miscellaneous > Settings > Configure Realms |
| LDAP (Active Directory) federation | Users and groups are synchronized from Active Directory over LDAP, so that directory users can sign in with their existing credentials. | Installation > Windows > Realm Setup |
| Directory user federation | The realm reads users from an LDAP or Active Directory server, and CertSecure Manager creates the matching accounts so that departments and roles can be assigned before the first sign-in. | Miscellaneous > Settings > Configure Realms > User Federation |
Note: The Admin account registered during onboarding is the highest authority in CertSecure Manager and cannot be removed from the application.
Directory Accounts
Accounts that come from a directory are created by a background sync and are never deleted by it. A person who leaves the directory cannot sign in, and the administrators are told by email so that they can delete the account or restore the person. An account that an administrator deletes leaves a deregistration record, so that the sync does not create it again. For details, refer to Administration > Users.
Controlling What Users Can Do
Once a user is signed in, role-based access control decides what they can do. A role is a named collection of permissions. Each user is assigned one or more roles, and their effective access is the combination of all the permissions those roles grant. Departments add a second boundary by limiting the CAs and certificate templates the members of a department can use.
| Building Block | Purpose | Learn More |
|---|---|---|
| Users | The people who can sign in, each with an email address, one or more roles, and a department. | Administration > Users |
| Roles | Built-in roles, such as Admin, PKI Admin, and Department PKI Admin, and custom roles that you define. | Administration > Roles and Permissions |
| Permissions | Administrator permissions for configuring the platform, and user permissions for day-to-day certificate operations. | Permission categories |
| Departments | Groups of users that can access only the CAs and templates assigned to the department. | Administration > Departments |
Accessing CertSecure Manager Through the API
Applications and scripts that call the CertSecure Manager API authenticate with an API token instead of a user sign-in. Each token belongs to a user and acts with that user's roles, permissions, and department scope, so the same authorization rules apply to the API as to the portal.
- Generate and manage tokens in Utilities > API Tokens. This requires the Manage API Tokens permission.
- Send the token in the Authorization header of every request:
Authorization: Bearer <token>For examples, token errors, and the public endpoints that do not need a token, refer to API Reference > Authorizing Requests. For guidance on protecting tokens, refer to API Reference > Securing API Access.
Where to Configure Access
| Task | Location in the Portal |
|---|---|
| Connect or manage Keycloak realms | Misc > Settings > Configure Realms |
| Add an identity provider for single sign-on | Misc > Settings > Configure Realms > Identity Providers |
| Create or edit users | Administration > Users |
| Create custom roles and assign permissions | Administration > Roles and Permissions |
| Restrict users to specific CAs and templates | Administration > Departments |
| Generate, renew, or revoke API tokens | Utilities > API Tokens |
| Connect an Active Directory or LDAP user directory | Misc > Settings > Configure Realms > User Federation |
| Map directory groups to departments | Administration > Users > Sync Lists |
| Delete a department | Administration > Departments |