Should we issue multiple User Certificates for each end user

Question

My current Organization structure is like below

Org1
 - Peer 1
 -
 - 
 -
 - Peer 5
    - user 1 , user 2 .... user 100

Let us say I use Fabric-CA for issuing certificates.

1) There will be 100+ users on Peer 5. Should I provide each one a unique certificate ?

2) If I am adding each one a certificate, how would I set the permissions for the user. Like Role.ADMIN or Role.MEMBER ?

Answer 1

1) Yes, All fabric users should have unique certificate.

2) Since Fabric 1.1, There is new feature called "Attribute Based Access Control". You would require to add respective attributes in certificate itself while issuing, which you can retrieve within chaincode to implement permission part. Attributes can be anything as per your requirement.