Red Hat CERTIFICATE SYSTEM 7.2 - MIGRATION GUIDE, Administration Manual, Page: 368 / 512

Chapter 15. Authentication for Enrolling Certificates
348
setpin host=yourhost port=9446 length=11 input=infile output=outfile write
"binddn=cn=pinmanager,o=example.com" bindpw="password" basedn=o=example.com
"filter=(uid=u*)"
g. Use the output file for delivering PINs to users after completing setting up the required
authentication method.
After confirming that the PIN-based enrollment works, deliver the PINs to users so they can
use them during enrollment. To protect the privacy of PINs, use a secure, out-of-band delivery
method.
2. Set the policies for specific certificates in the certificate profiles to enroll users. See
Chapter 12,
Certificate Profiles
for information about certificate profile policies.
3. Create and configure an instance of the
UidPwdPinDirAuth
authentication plug-in.
a. Open the CA Console.
pkiconsole https://server.example.com:9443/ca
b. In the
Configuration
tab, select
Authentication
in the navigation tree.
The right pane shows the
Authentication Instance
tab, which lists the currently configured
authentication instances.
c. Click
Add
.
The
Select Authentication Plug-in Implementation
window appears.
d. Select the
UidPwdPinDirAuth
plug-in module.
e. Fill in the following fields in the
Authentication Instance Editor
window:
•
Authentication Instance ID.
Accept the default instance name or enter a new name.
•
removePin.
Sets whether to remove PINs from the authentication directory after end users
successfully authenticate. Removing PINs from the directory restricts users from enrolling
more than once, and thus prevents them from getting more than one certificate.
•
pinAttr.
Specifies the authentication directory attribute for PINs. The
PIN Generator
utility sets the attribute to the value of the
objectclass
parameter in the
setpin.conf
file; the default value for this parameter is
pin
.
•
dnpattern.
Specifies a string representing a subject name pattern to formulate from the
directory attributes and entry DN.
•
ldapStringAttributes.
Specifies the list of LDAP string attributes that should be considered
authentic
for the end entity. Entering values for this parameter is optional.
•
ldapByteAttributes.
Specifies the list of LDAP byte (binary) attributes that should be
considered
authentic
for the end entity. If specified, the values corresponding to these