Default AUTH_MAP Rules¶

Transaction type	Action	Field	Previous value	New value	Who can	Description
_NYM	_ADD	_role	_*	_TRUSTEE	_{1 TRUSTEE}	_{Adding a new TRUSTEE}
_NYM	_ADD	_role	_*	_STEWARD	_{1 TRUSTEE}	_{Adding a new STEWARD}
_NYM	_ADD	_role	_*	_ENDORSER	_{1 TRUSTEE OR 1 STEWARD}	_{Adding a new ENDORSER}
_NYM	_ADD	_role	_*	_{NETWORK_MONITOR}	_{1 TRUSTEE OR 1 STEWARD}	_{Adding a new NETWORK_MONITOR}
_NYM	_ADD	_role	_*	_<None>	_{1 TRUSTEE OR 1 STEWARD OR 1 ENDORSER}	_{Adding a new Identity Owner}
_NYM	_EDIT	_role	_TRUSTEE	_STEWARD	_{1 TRUSTEE}	_{Changing Trustee to Steward}
_NYM	_EDIT	_role	_TRUSTEE	_ENDORSER	_{1 TRUSTEE}	_{Changing Trustee to Endorser}
_NYM	_EDIT	_role	_TRUSTEE	_{NETWORK_MONITOR}	_{1 TRUSTEE}	_{Changing Trustee to Network Monitor}
_NYM	_EDIT	_role	_TRUSTEE	_<None>	_{1 TRUSTEE}	_{Demoting a Trustee}
_NYM	_EDIT	_role	_STEWARD	_TRUSTEE	_{1 TRUSTEE}	_{Changing Steward to Trustee}
_NYM	_EDIT	_role	_STEWARD	_ENDORSER	_{1 TRUSTEE}	_{Changing Steward to Endorser}
_NYM	_EDIT	_role	_STEWARD	_{NETWORK_MONITOR}	_{1 TRUSTEE}	_{Changing Steward to Network Monitor}
_NYM	_EDIT	_role	_STEWARD	_<None>	_{1 TRUSTEE}	_{Demoting a Steward}
_NYM	_EDIT	_role	_ENDORSER	_TRUSTEE	_{1 TRUSTEE}	_{Changing Endorser to Trustee}
_NYM	_EDIT	_role	_ENDORSER	_STEWARD	_{1 TRUSTEE}	_{Changing Endorser to Steward}
_NYM	_EDIT	_role	_ENDORSER	_{NETWORK_MONITOR}	_{1 TRUSTEE}	_{Changing Endorser to Network Monitor}
_NYM	_EDIT	_role	_ENDORSER	_<None>	_{1 TRUSTEE}	_{Demoting a Endorser}
_NYM	_EDIT	_role	_{NETWORK_MONITOR}	_TRUSTEE	_{1 TRUSTEE}	_{Changing Network Monitor to Trustee}
_NYM	_EDIT	_role	_{NETWORK_MONITOR}	_STEWARD	_{1 TRUSTEE}	_{Changing Network Monitor to Steward}
_NYM	_EDIT	_role	_{NETWORK_MONITOR}	_ENDORSER	_{1 TRUSTEE OR 1 STEWARD}	_{Changing Network Monitor to Endorser}
_NYM	_EDIT	_role	_{NETWORK_MONITOR}	_<None>	_{1 TRUSTEE OR 1 STEWARD}	_{Demoting a Network Monitor}
_NYM	_EDIT	_role	_<None>	_TRUSTEE	_{1 TRUSTEE}	_{Promoting Identity Owner to Trustee}
_NYM	_EDIT	_role	_<None>	_STEWARD	_{1 TRUSTEE}	_{Promoting Identity Owner to Steward}
_NYM	_EDIT	_role	_<None>	_ENDORSER	_{1 TRUSTEE OR 1 STEWARD}	_{Promoting Identity Owner to Endorser}
_NYM	_EDIT	_role	_<None>	_{NETWORK_MONITOR}	_{1 TRUSTEE OR 1 STEWARD}	_{Promoting Identity Owner to Network Monitor}
_NYM	_EDIT	_verkey	_*	_*	_{1 any (*) role owner}	_{Rotation the key or assigning a key to a DID under guardianship}
_ATTRIB	_ADD	_*	_*	_*	_{1 any (*) role owner of the corresponding NYM}	_{Adding a new ATTRIB for the NYM}
_ATTRIB	_EDIT	_*	_*	_*	_{1 any (*) role owner of the corresponding NYM}	_{Editing an ATTRIB for the NYM}
_SCHEMA	_ADD	_*	_*	_*	_{1 TRUSTEE OR 1 STEWARD OR 1 ENDORSER}	_{Adding a new Schema}
_SCHEMA	_EDIT	_*	_*	_*	_{No one can edit existing Schema}	_{Editing a Schema}
_{SET_CONTEXT}	_ADD	_*	_*	_*	_{1 TRUSTEE OR 1 STEWARD OR 1 ENDORSER}	_{Adding a new Context}
_{SET_CONTEXT}	_EDIT	_*	_*	_*	_{No one can edit existing Context}	_{Editing a Context}
_{SET_RICH_SCHEMA}	_ADD	_*	_*	_*	_{1 TRUSTEE OR 1 STEWARD OR 1 ENDORSER}	_{Adding a new Rich Schema}
_{SET_RICH_SCHEMA}	_EDIT	_*	_*	_*	_{No one can edit existing Context}	_{Editing a Rich Schema}
_{CLAIM_DEF}	_ADD	_*	_*	_*	_{1 TRUSTEE OR 1 STEWARD OR 1 ENDORSER}	_{Adding a new CLAIM_DEF}
_{CLAIM_DEF}	_EDIT	_*	_*	_*	_{1 owner TRUSTEE OR 1 owner STEWARD OR 1 owner ENDORSER}	_{Editing a CLAIM_DEF: INDY-2078 - can not be configured by auth rule; ADD CLAIM_DEF rule is currently used for editing where owner is always true as it's part of the primary key}
_{REVOC_REG_DEF}	_ADD	_*	_*	_*	_{1 TRUSTEE OR 1 STEWARD OR 1 ENDORSER}	_{Adding a new REVOC_REG_DEF}
_{REVOC_REG_DEF}	_EDIT	_*	_*	_*	_{1 any (*) role owner}	_{Editing a REVOC_REG_DEF}
_{REVOC_REG_ENTRY}	_ADD	_*	_*	_*	_{1 any (*) role owner of the corresponding REVOC_REG_DEF}	_{Adding a new REVOC_REG_ENTRY}
_{REVOC_REG_ENTRY}	_EDIT	_*	_*	_*	_{1 any (*) role owner}	_{Editing a REVOC_REG_ENTRY}
_NODE	_ADD	_services	_*	_{['VALIDATOR']}	_{1 STEWARD (if it doesn't own NODE transaction yet)}	_{Adding a new node to the pool in the active (Validator) state}
_NODE	_ADD	_services	_*	_[]	_{1 STEWARD if it doesn't own NODE transaction yet}	_{Adding a new node to the pool in inactive state}
_NODE	_EDIT	_services	_{['VALIDATOR']}	_[]	_{1 TRUSTEE OR 1 owner STEWARD}	_{Demoting a node}
_NODE	_EDIT	_services	_[]	_{['VALIDATOR']}	_{1 TRUSTEE or 1 owner STEWARD}	_{Promoting a node}
_NODE	_EDIT	_{node_ip}	_*	_*	_{1 owner STEWARD}	_{Changing Node's ip address}
_NODE	_EDIT	_{node_port}	_*	_*	_{1 owner STEWARD}	_{Changing Node's port}
_NODE	_EDIT	_{client_ip}	_*	_*	_{1 owner STEWARD}	_{Changing Client's ip address}
_NODE	_EDIT	_{client_port}	_*	_*	_{1 owner STEWARD}	_{Changing Client's port}
_NODE	_EDIT	_blskey	_*	_*	_{1 owner STEWARD}	_{Changing Node's blskey}
_{POOL_UPGRADE}	_ADD	_action	_*	_start	_{1 TRUSTEE}	_{Starting upgrade procedure}
_{POOL_UPGRADE}	_EDIT	_action	_start	_cancel	_{1 TRUSTEE}	_{Canceling upgrade procedure}
_{POOL_RESTART}	_ADD	_action	_*	_*	_{1 TRUSTEE}	_{Restarting the whole pool}
_{POOL_CONFIG}	_EDIT	_action	_*	_*	_{1 TRUSTEE}	_{Changing Pool config (for example, putting the pool into read only state)}
_{AUTH_RULE}	_EDIT	_*	_*	_*	_{1 TRUSTEE}	_{Changing an authentification rule}
_{AUTH_RULES}	_EDIT	_*	_*	_*	_{1 TRUSTEE}	_{Changing a number of authentification rules}
_{TRANSACTION_AUTHOR_AGREEMENT}	_ADD	_*	_*	_*	_{1 TRUSTEE}	_{Adding a new Transaction Author Agreement}
_{TRANSACTION_AUTHOR_AGREEMENT_AML}	_ADD	_*	_*	_*	_{1 TRUSTEE}	_{Adding a new Transaction Author Agreement Mechanism List}
_{VALIDATOR_INFO}	_ADD	_*	_*	_*	_{1 TRUSTEE OR 1 STEWARD OR 1 NETWORK_MONITOR}	_{Getting validator_info from pool}

Who Is Owner¶

Transaction Type	Action	Who is Owner
_NYM	_ADD	_N/A
_NYM	_EDIT	_{The DID defined by the NYM txn (`dest` field) if `verkey` is set; otherwise the submitter of the NYM txn (`identifier` field)}
_ATTRIB	_ADD	_{The owner of the DID (`dest` field) the ATTRIB is created for (see NYM's owner description)}
_ATTRIB	_EDIT	_{The owner of the DID (`dest` field) the ATTRIB is created for (see NYM's owner description)}
_SCHEMA	_ADD	_N/A
_SCHEMA	_EDIT	_{The DID used to create the SCHEMA}
_{SET_CONTEXT}	_ADD	_N/A
_{SET_CONTEXT}	_EDIT	_{The DID used to create the CONTEXT}
_{SET_RICH_SCHEMA}	_ADD	_N/A
_{SET_RICH_SCHEMA}	_EDIT	_{The DID used to create the RICH_SCHEMA}
_{CLAIM_DEF}	_ADD	_N/A
_{CLAIM_DEF}	_EDIT	_{The DID used to create the CLAIM_DEF}
_{REVOC_REG_DEF}	_ADD	_N/A
_{REVOC_REG_DEF}	_EDIT	_{The DID used to create the REVOC_REG_DEF}
_{REVOC_REG_ENTRY}	_ADD	_{The DID used to create the corresponding REVOC_REG_DEF}
_{REVOC_REG_ENTRY}	_EDIT	_{The DID used to create the REVOC_REG_ENTRY}
_NODE	_ADD	_N/A
_NODE	_EDIT	_{The Steward's DID used to create the NODE}
_{POOL_UPGRADE}	_ADD	_N/A
_{POOL_UPGRADE}	_EDIT	_N/A
_{POOL_RESTART}	_ADD	_N/A
_{POOL_RESTART}	_EDIT	_N/A
_{POOL_CONFIG}	_ADD	_N/A
_{POOL_CONFIG}	_EDIT	_N/A
_{GET_VALIDATOR_INFO}	_ADD	_N/A
_{GET_VALIDATOR_INFO}	_EDIT	_N/A
_{AUTH_RULE}	_ADD	_N/A
_{AUTH_RULE}	_EDIT	_N/A
_{TRANSACTION_AUTHOR_AGREEMENT}	_ADD	_N/A
_{TRANSACTION_AUTHOR_AGREEMENT_AML}	_ADD	_N/A

Endorser using¶

Endorser is required only when the transaction is endorsed, that is signed by someone else besides the author.
If transaction is endorsed, Endorser must sign the transaction.
If author of txn has role ENDORSER, then no multi-sig is required, since he’s already signed the txn.
Endorser is required for unprivileged roles only.
Unprivileged users cannot submit any transaction (including administrative transactions like pool upgrade or restart) without a signature from a DID with the endorser role that is specified in the endorser field.