Table of Contents
Advertisement
Setting Up Pin Based Enrollment
Pin based authentication involves setting up pins for each of your users in the
LDAP directory, distributing those pins to your users, and then having the users
provide their pin along with their user ID and password when they fill out a
certificate request. Users are then authenticated both against an LDAP directory
using their user ID and password, and against the pin that is contained in their
LDAP entry. When the user successfully authenticates, their request is
automatically processed and a new certificate is issued.
CMS provides a tool that will add the need schema for pins to the Directory Server,
and generate the pins for each user.
To set up pin based authentication you do the following:
•
Use the pin tool to add schema needed for pins, add pins to the user entries in
your directory, and then distribute the pins to your users. See "Creating Pins,"
on page 396.
•
Set any policies for certificate extensions, or for constraints on certificates, see
Chapter 11, "Policies" for information about policies. Alternatively, you can
enroll users through the certificate profile functionality setting policies for
specific certificates in the certificate profile, see Chapter 10, "Certificate
Profiles" for information about policies.
•
Create an instance of the
and configure the instance. See "Setting Up the UidPwdPinDirAuth
Authentication," on page 397 for details.
•
Customize the HTML enrollment forms. Make sure the proper authentication
method is contained in the form, and do any other customization required.
In the enrollment form you use, be sure to include the following line, and
replace
myAuthMgr
<INPUT TYPE="HIDDEN" NAME="authenticator" VALUE="myAuthMgr">
For more information on customizing the enrollment forms, see the CMS
Customization Guide.
•
In the case of certificate profile-based enrollments, customize the enrollment
forms by configuring the inputs in the certificate profile. Make sure you
include the information that will be needed by the plug-in to authenticate the
user. If the default inputs do not contain all of the information that needs to be
collected, you can either create an input that does using the CMS SDK, or
submit a request created with a third-party tool.
UidPwdPinDirAuth
with the name of the authentication instance you added.
Automated Enrollment
Authentication plug-in module
Chapter 9
Authentication
395
Advertisement
Table of Contents
