@@ -1184,6 +1184,35 @@ The assessment criteria for each security requirements are described in a struct
## 6.5 Authentication and access control
- REFERENCE: ACC_PKI_AC_001
- OBJECTIVE:
Verify the product allows to create different user profiles (users with different access rights to functions, configuration, and stored data) for the roles defined by PKI policies, each with distinct credentials.
- PREPARATION:
Access to the administrative and user interfaces of the product.
- ACTIVITIES:
- Create one account for each manageable profile (at least: PKI Administrator, PKI Operator, PKI Officer, PKI Auditor) with unique credentials.
- For each account:
- Attempt to log in using credentials from other accounts or invalid credentials.
- Log in with the correct credentials for each account.
- Verify that only the authorized actions defined by the user profile are accessible.
- If the account is not authorized to, attempt to read stored data
- If the account is not authorized to, attempt to read configuration data
- If the account is not authorized to, attempt to modify stored data
- If the account is not authorized to, attempt to modify configuration data
- VERDICT:
SUCCESS if only correct identification and authentication allows access to the specific rights of a user profile, and only authorized users may read or modify stored data or configuration data.
FAIL if unauthorized access or incorrect rights assignment is detected.
- EVIDENCE:
a) Results of identification and authentication attempts (successful and failed).
b) List of validated functionalities and data access rights for each user profile.
c) Screenshots or logs of access attempts and rights verification.
