Page History

Creating a service account for working with the user catalog and system data storage

For Indeed Certificate Manager For Axidian CertiFlow system to operate properly, you must have certain access rights to access Active Directory objects and certification authorities are required. You . Depending on your company's security policy, you can distribute the privileges between several accounts, or create one service account with maximum rights for system management, depending on the requirements of the company security policy.

Create a service account (say, servicecm) to perform data saving and reading operations in the Active Directory storage.

Configuring the user catalog in Active Directory

Grant the created service account (servicecm) the e.g. cfServiceAD) and grant it the necessary permissions to work with the an object (domainsdomain, containerscontainer, organizational unit) where the Indeed Certificate Manager users will be locatedthat contains Axidian CertiFlow users. This account will be used to read and write user attributes.

To do this, do the followingGo through these steps:

1. Open Security property property of the object (domain, container or organizational unit) that contains the Indeed CM system Axidian CertiFlow users.
2. Click Advanced. Click →Add. Click →Select a principal.
3. In the Enter the object name to select text text box, type service enter the name of the service account (servicecmcfServiceAD) . Click and click OK.
4. In the Applies to list box, select Descendant User objects.
5. In the Permissions list, activate:
   • Reset password
   • List contents

   • Read all properties permission.

     Info
     By default, permission to read all user properties is granted to all accounts in the domain.

     
     

   • Reset password - required to be able to Reset user's password via the system interface.
6. In the Properties list, set the following permissions:
   • Write pwdLastSet -  Also required to be able to reset the user's password.
   • Write thumbnailPhoto or Write jpegPhoto -  Required required to be able to upload Upload a photo to a user in Active Directory via the system interface.
   • Write userAccountControl -  Required for the required to enable option Enforce smart card logon option.
7. Click ОК and then  and Apply.

The permission to read all user properties is set for all domain accounts by default. If security policies prohibit reading of all user properties, then set the rights for the service account to read only required properties, according to the Table 3.

If all user properties are not allowed to be read in the domain by security policies, then set the rights for the service account access only to the required user attributes according to the Table 3 and attributes of the object (domain, container or organizational unit) in which the Indeed CM users.

In case the domain security policies forbid reading all user properties, you can specify that the service account has permissions to only read the necessary user attributes (Table 3) and object attributes (domain, container, When configuring the permissions to read user properties different from default ones, it is also necessary to permit the service account (servicecm) to read the values of object attributes (i.e. Domain, container or organizational unit) that contains Indeed CM Axidian CertiFlow users. These attributes are: cn, objectGUID, name and showInAdvancedViewOnly.

Go through these steps:

1. In On the ADSI edit snap-in, open the Security property of the object (domain, container or division) that contains the Indeed CM Axidian CertiFlow users.
2. For Set the following in This object and all descendant objects .field:
   • In the Permissions click check the List contents check box.
   • In the Properties click check the check following boxes next to:
     • Read сanonicalName
     • Read Distinguished Name
     • Read objectClass
     • Read objectGuid
     • Read showInAdvancedViewOnly
3. For Set the following in Descendant user objects: User objects .field:
   • In the Permissions check the List contents box.
   • In the Properties select read/write the following sets of properties and attributes corresponding to (Table 3):
     • Read personal Information
     • Read general Information
     • Read account restrictions
     • Read public Information
     • Write pwdLastSet
     • Write thumbnailPhoto or Write jpegPhoto
     • Write userAccountControlWrite userCertificate

Table 3

. Attributes used by

Axidian CertiFlow to work with

users catalog

Table auto