Page History

Creating a service account for working with the user catalog and system data storage

For Indeed Certificate Manager For Axidian CertiFlow system to operate properly, you must have certain access rights to access Active Directory objects and certification authorities are required. You . Depending on your company's security policy, you can distribute the privileges between several accounts, or create one service account with maximum rights for system management, depending on the requirements of the company security policy.

Create a service account (say, servicecm) to perform data saving and reading operations in the Active Directory storage.

Configuring the user catalog in Active Directory

Grant the created service account (servicecm) the e.g. cfServiceAD) and grant it the necessary permissions to work with the an object (domainsdomain, containerscontainer, organizational unit) where the Indeed Certificate Manager users will be locatedthat contains Axidian CertiFlow users. This account will be used to read and write user attributes.

To do this, do the followingGo through these steps:

1. Open Security property property of the object (domain, container or organizational unit) that contains the Indeed CM system Axidian CertiFlow users.
2. Click Advanced. Click →Add. Click →Select a principal.
3. In the Enter the object name to select text text box, type service enter the name of the service account (servicecmcfServiceAD) . Click and click OK.
4. In the Applies to list box, select Descendant User objects.
5. In the Permissions list, activate the Reset password checkbox.In the Properties list, set the Read all properties permission:
   • List contents

   • Read all properties

     Info
     By default, permission to read all user properties is granted to all accounts in the domain.

     
     

   • Reset password - required to be able to Reset user's password via the system interface.
6. In the Properties list, set the following permissions:
   • Write : pwdLastSetpwdLastSet - required to be able to reset user's password.
   • Write : thumbnailPhoto or Write : jpegPhotojpegPhoto - required to be able to Upload a photo to a user in Active Directory via the system interface.
   • Write : userAccountControluserAccountControl - required to enable Enforce smart card logon option.
7. Click ОК and then  and Apply.

In case the domain security policies forbid reading The permission to read all user properties is set for all domain accounts by default. If security policies prohibit reading of all user properties, then set the rights for the you can specify that the service account has permissions to only read only required properties, according to the Table 3.When configuring the permissions to read user properties different from default ones, it is also necessary to permit the service account (servicecm) to read the values of object attributes (i.e. Domain, container the necessary user attributes (Table 3) and object attributes (domain, container, or organizational unit) that contains Indeed CM Axidian CertiFlow users. These attributes are: cn, objectGUID, name and showInAdvancedViewOnly.

Go through these steps:

1. In the ADSI edit snap-in, open the Security property of the object (domain, container or division) that contains Axidian CertiFlow users.
2. Set the following in This object and all descendant objects field:
   • In Permissions check the List contents box.
   • In Properties check the following boxes:
     • Read сanonicalName
     • Read Distinguished Name
     • Read objectClass
     • Read objectGuid
     • Read showInAdvancedViewOnly
3. Set the following in Descendant user objects: User objects field:
   • In Permissions check the List contents box.
   • In Properties select read/write the following sets of properties and attributes (Table 3):
     • Read personal Information
     • Read general Information
     • Read account restrictions
     • Read public Information
     • Write pwdLastSet
     • Write thumbnailPhoto or Write jpegPhoto
     • Write userAccountControl

Table 3

. Attributes used by

Axidian CertiFlow to work with

users catalog

Table auto