Setting Up Automated Cep Enrollment - Netscape MANAGEMENT SYSTEM 6.2 - ADMINISTRATOR Administrator's Manual

Setting Up Automated CEP Enrollment

You can configure the Certificate Manager to use either the challenge password or
the subject name (all or a part of it) as an authentication token during a CEP
enrollment, thus enabling users to get router certificates without any action on the
part of the Certificate Manager agent.
CMS does not install an authentication module for CEP enrollment, but does
provide a sample along with the CMS SDK that you can register and then
configure, named
FlatFileAuth
This plug-in uses a file, called an authentication token, containing information that
will be provided by the enrollee to uniquely identify it, and the password created
for the enrollee that they present during enrollment to authenticate themselves.
To set this up, you must create the authentication-token file, and register and
configure the plug-in. See "Authentication-Token File," on page 413 and "Setting
Up the CEP Plug-In," on page 414.
Authentication-Token File
You create a text file with CEP-enrollee information that is used by the plug-in to
authenticate the entity. The format of the authentication-token file is as follows:
<attribute>: <value>
<attribute>: <value>
...
<attribute>: <value>
<attribute>: <value>
Each enrolling user is represented by a sequence of attribute-value pairs,
terminated by a blank line or end-of-file (EOF). The attributes can be any part of the
subject name from the request, for example
, , , or the challenge password (
CN OU UID
follows:
UNSTRUCTUREDNAME
UNSTRUCTUREDADDRESS
.
SERIALNUMBER
). These attributes are described as
pwd
Specifies the DNS name of the router (for example,
router32.example.com). This is always specified in the
request.
Specifies the IP address of the router (for example,
101.22.33.124). This may not be in the request—a user
may not want to include this in the subject name of the
router certificate, and hence choose not to specify one
during enrollment.
CEP Enrollment
,
UNSTRUCTUREDADDRESS
Chapter 9 Authentication
,
413