Red Hat CERTIFICATE SYSTEM 8.0 - ADMINISTRATION, Admin Manual

Page: 258 / 564

Chapter 9. Authentication for Enrolling Certificates
236
9.2. Automated Enrollment
In automated enrollment, an end-entity enrollment request is processed as soon as the user
successfully authenticates by the method set in the authentication plug-in module; no agent approval
is necessary. The following authentication plug-in modules are provided:
•
Directory-based enrollment.
End entities are authenticated against an LDAP directory using their
user ID and password or their DN and password. See
Section 9.2.1, “Setting up Directory-Based
Authentication”
.
•
PIN-based enrollment.
End entities are authenticated against an LDAP directory using their user
ID, password, and a PIN set in their directory entry. See
Section 9.2.2, “Setting up PIN-Based
Enrollment”
.
•
Certificate-based authentication
. Entities of some kind — both end users and other entities, like
servers or tokens — are authenticated to the CA using a certificate issued by the CA which proves
their identity. This is most commonly used for renewal, where the original certificate is presented to
authenticate the renewal process. See
Section 9.2.3, “Using Certificate-Based Authentication”
.
•
AgentCertAuth
. This method automatically approves a certificate request if the entity submitting the
request is authenticated as a subsystem agent. A user authenticates as an agent by presenting an
agent certificate. If the presented certificate is recognized by the subsystem as an agent certificate,
then the CA automatically processes the certificate request.
This form of automatic authentication can be associated with the certificate profile for enrolling for
server certificates.
This plug-in is enabled by default and has no parameters.
•
Flat file-based enrollment
. Used exclusively for router (SCEP) enrollments, a text file is used which
contains a list of IP addresses, hostnames, or other identifier and a password, which is usually a
random PIN. A router authenticates to the CA using its ID and PIN, and then the CA compares the
presented credentials to the list of identities in the text file. See
Section 9.2.4, “Configuring Flat File
Authentication”
.
•
raCertAuth
. This is similar to agent-approved authentication because, in fact, the RA agent has
already approved the certificate request. The RA then submits the approved certificate request
to the CA; the RA essentially is authenticated as a CA agent, so the request submitted by the RA
subsystem is automatically approved.
9.2.1. Setting up Directory-Based Authentication
The
UidPwdDirAuth
and the
UdnPwdDirAuth
plug-in modules implement directory-based
authentication. End users enroll for a certificate by providing their user IDs or DN and password to
authenticate to an LDAP directory.
1. Create an instance of either the
UidPwdDirAuth
or
UdnPwdDirAuth
authentication plug-in
module and configure the instance.
a. Open the CA Console.
pkiconsole https://server.example.com:9445/ca
b. In the
Configuration
tab, select
Authentication
in the navigation tree.