Red Hat CERTIFICATE SYSTEM 7.3 - ADMINISTRATION, Administration Manual

Page: 400 / 554

Chapter 16. Authentication for Enrolling Certificates
378
successfully authenticated, the request is processed without being sent to an agent's queue. If the
request passes the certificate profile configuration of the Certificate Manager, the certificate is issued
and stored in the internal database. It is delivered to the end entity immediately through the HTML
forms.
NOTE
An email can be automatically sent to an end entity when the certificate is issued for any
authentication method by configuring automated notifications. See
Chapter 18, Automated
Notifications
for more information on notifications.
16.2. Agent-Approved Enrollment
The Certificate Manager is initially configured for agent-approved enrollment. An end entity makes
a request which is sent to the agent queue for an agent's approval. An agent can modify request,
change the status of the request, reject the request, or approve the request. Once the request is
approved, the signed request is sent to the Certificate Manager for processing. The Certificate
Manager processes the request and issues the certificate.
The agent-approved enrollment method is not configurable. If a Certificate Manager is not configured
for any other enrollment method, the server automatically sends all certificate-related requests to
a queue where they await agent approval. This ensures that all requests that lack authentication
credentials are sent to the request queue for agent approval.
16.2.1. Configuring Agent-Approved Enrollment
To configure agent-approved enrollment:
1. Set up the certificate profiles to use to enroll users, such as specifying agent-approved enrollment
and setting policies for specific certificates in the certificate profile. See
Chapter 13, Certificate
Profiles
for more information about profiles.
2. Customize the HTML enrollment forms. For certificate profile-based enrollment, configure inputs
that are used to generate the HTML enrollment form dynamically.
16.3. Automated Enrollment
In automated enrollment, an end-entity enrollment request is processed as soon as the user
successfully authenticates by the method set in the authentication plug-in module; no agent approval
is necessary. The following authentication plug-in modules are provided:
•
Directory-based enrollment.
End entities are authenticated against an LDAP directory using their
user ID and password or their DN and password. See
Section 16.3.1, “Setting up Directory-Based
Authentication”
.
•
PIN-based enrollment.
End entities are authenticated against an LDAP directory using their user
ID, password, and a PIN set in their directory entry. See
Section 16.3.2, “Setting up PIN-based
Enrollment”
.
•
CMCAuth.
Clients are created and sent agent-signed requests. Those requests are then processed,
and the certificate issued. See
Section 16.4, “Setting up CMC Enrollment”
.