We also built custom roles, such as one that let us reassign enrollment reference codes and authorization numbers. This was a simple matter of creating the role and assigning the appropriate rights. Building roles can be complex because of the dependencies between parts of the PKI and directory. Fortunately, Entrust checks dependencies before creating the role. For example, we had to assign a number of viewing rights to the role so that user information would be available.
Users also can exist in multiple roles simultaneously.
Adding Users Before adding users, we wanted to modify the data that would be held in the certificates. In our case, several fields were added to hold the users' locations and job titles. We also could have added the fields to the database and not to the certificate, which minimized information leakage. Remember, all data in the certificate is public. To change the template, which also changes the fields in the GUI, we edited the certificate definition file.