Red Hat CERTIFICATE SYSTEM 8.0 - ADMINISTRATION, Admin Manual

Page: 76 / 564

Chapter 2. Making Rules for Issuing Certificates
54
2.4.1. Editing Enrollment Profiles for the TPS
Administrators have the ability to customize the default smart card enrollment profiles, used with
the TPS. For instance, a profile could be edited to include the user's email address in the Subject
Alternative Name extension. The email address for the user is retrieved from the authentication
directory. To configure the CA for LDAP access, change the following parameters in the profile files,
with the appropriate directory information:
policyset.set1.p1.default.params.dnpattern=UID=$request.uid$, O=Token Key User
policyset.set1.p1.default.params.ldap.enable=true
policyset.set1.p1.default.params.ldap.basedn=ou=people,dc=host,dc=example,dc=com
policyset.set1.p1.default.params.ldapStringAttributes=uid,mail
policyset.set1.p1.default.params.ldap.ldapconn.host=localhost.example.com
policyset.set1.p1.default.params.ldap.ldapconn.port=389
These CA profiles come with LDAP lookup disabled by default. The
ldapStringAttributes
parameter tells the CA which LDAP attributes to retrieve from the company directory. For example, if
the directory contains
uid
as an LDAP attribute name, and this will be used in the subject name of the
certificate, then
uid
must be listed in the
ldapStringAttributes
parameter, and
request.uid
listed
as one of the components in the
dnpattern
.
Editing certificate profiles is covered in
Section 2.2, “Setting up Certificate Profiles”
.
2.4.2. Creating Custom TPS Profiles
Certificate profiles are created as normal in the CA, but they also have to be configured in the TPS for
it to be available for token enrollments.
TIP
New profiles are added with new released of Red Hat Certificate System. If an instance is
migrated to Certificate System 8.0, then the new profiles need to be added to the migrated
instance as if they are custom profiles.
1. Create a new token profile for the issuing CA. Setting up profiles is covered in
Section 2.2, “Setting
up Certificate Profiles”
.
2. Copy the profile into the CA's profiles directory,
/var/lib/ subsystem_name /profiles/ca
.
3. Edit the CA
CS.cfg
file, and add the new profile references and the profile name to the CA's list of
profiles. For example:
vim /etc/ subsystem_name /CS.cfg
profile.list=caUserCert,...,caManualRenewal, tpsExampleEnrollProfile
...
profile.caTokenMSLoginEnrollment.class_id=caUserCertEnrollImpl
profile.caTokenMSLoginEnrollment.config=/var/lib/
subsystem_name /profiles/ca/
tpsExampleEnrollProfile.cfg
4. Edit the TPS
CS.cfg
file, and add a line to point to the new CA enrollment profile. For example:
vim /etc/pki-tps/CS.cfg