Red Hat CERTIFICATE SYSTEM 8.0 - ADMINISTRATION, Руководство администратора

Страница: 73 / 564

Configuring the Request Queues
51
Plug-in or Library Location Description
PKI::Request::Plug-
in::AutoAssign (plug-in) /var/lib/pki-ra/lib/perl/PKI/
Request/Plug-in Automatically assigns a request
to a group of agents.
PKI::Request::Plug-
in::CreatePin (plug-in) /var/lib/pki-ra/lib/perl/PKI/
Request/Plug-in Creates a one-time PIN for
SCEP enrollment.
PKI::Request::Plug-
in::EmailNotification (plug-in) /var/lib/pki-ra/lib/perl/PKI/
Request/Plug-in Sends email notifications.
PKI::Request::Plug-
in::RequestToCA (plug-in) /var/lib/pki-ra/lib/perl/PKI/
Request/Plug-in Sends an enrollment request to
the CA.
PKI::Base::CertStore (library) /var/lib/pki-ra/lib/perl/PKI/Base/
CertStore Accesses the certificate store in
the RA.
PKI::Base::PinStore (library) /var/lib/pki-ra/lib/perl/PKI/Base/
PinStore Accesses the one-time PIN
store.
PKI::Base::UserStore (library) /var/lib/pki-ra/lib/perl/PKI/Base/
UserStore Accesses the user and group
database.
PKI::Conn::CA (library) /var/lib/pki-ra/lib/perl/PKI/Conn/
CA Accesses the CA for
enrollment.
PKI::Request::Queue (library) /var/lib/pki-ra/lib/perl/PKI/
Request/Queue Accesses the request queue in
the RA.
Table 2.4. RA Request Queue Plug-ins and Libraries
2.3.3.2. Creating the Profile Entry
The response of the RA to each request is configured in the
/var/lib/pki-ra/conf/CS.cfg
file.
There are three ways that a request can be handled — created, approved, and rejected — so each
profile entry has to define the behaviors of the RA for those three scenarios. Much like a profile policy
set, each operation is defined with a different group of parameters:
• request.
profile_name
.approve_request, which specifies the plug-in to call when a request is
approved.
• request.
profile_name
.reject_request, which sets the plug-in to call when a request is rejected.
• request.
profile_name
.create_request, which sets the plug-in to call when a request is created.
The
profile_name
in the parameter is the name of the directory in the
/var/lib/pki-ra/docroot/
ee
directory for the new profile. For the default enrollment forms, these are
scep
,
agent
,
server
,
and
user
.
The request submission configuration must specify the plug-in to call, the name of the profile to use to
submit the request, the CA server to submit it to, and the format of the request. If there are multiple RA
groups, then it can also automatically assign the request to a specific group for approval.
... when a server certificate request is approved ...
request.server.approve_request.0.ca=ca1
request.server.approve_request.0.plugin=PKI::Request::Plugin::RequestToCA
request.server.approve_request.0.profileId=caRAserverCert
request.server.approve_request.0.reqType=pkcs10
request.server.approve_request.num_plugins=1
... when a server certificate request is submitted ...