Page History

For Indeed Certificate Manager Axidian CertiFlow system to operate properly, you must have certain access rights to access Active Directory objects and certification authorities are required. You . Depending on your company's security policy, you can distribute the privileges between several accounts, or create one service account with maximum rights for system management, depending on the requirements of the company security policy.

Create a service account (say, CFServiceOpse.g. cfServiceAD) and grant it the necessary permissions to work with the an object (domainsdomain, containerscontainer, organizational unit) where the Indeed Certificate Manager users will be locatedthat contains Axidian CertiFlow users. This account will be used to read and write user attributes.

To do this, do the followingGo through these steps:

1. Open Security property property of the object (domain, container or organizational unit) that contains the Indeed CM system Axidian CertiFlow users.
2. Click Advanced. Click →Add. Click →Select a principal.
3. In the Enter the object name to select text box, type enter the name of the service account (CFServiceOpscfServiceAD) . Click and click OK.
4. In the Applies to list box, select Descendant User objects.
5. In the Permissions list, activate:
   • List contents

   • Read all properties permission.

     Info
     By default, permission to read all user properties is granted to all accounts in the domain.

     
     

   • Reset password -  Required required to be able to Resetting the Reset user's password via the system interface.
6. In the Properties list, set the following permissions:
   • Write pwdLastSet -  Also required to be able to reset the user's password.
   • Write thumbnailPhoto or Write jpegPhoto -  Required to Photo uploading required to be able to Upload a photo to a user in Active Directory via the system interface.
   • Write userAccountControl -  Required for the required to enable option Enforce smart card logon option.
7. Click ОК and then  and Apply.

In case the domain security policies forbid If reading all user properties are forbidden the domain security policies, then set the rights for , you can specify that the service account access has permissions to only to read the required necessary user attributes according to (Table 3) and object attributes of the object (domain, container, or organizational unit) in which are located the Indeed CM users.that contains Axidian CertiFlow users.

Go through these steps:

1. In On the ADSI edit snap-in, open the Security property of the object (domain, container or division) that contains the Indeed CM Axidian CertiFlow users.
2. For Set the following in This object and all descendant objects .field:
   • In the Permissions click check the List contents check box.
   • In the Properties click check the check following boxes next to:
     • Read сanonicalName
     • Read Distinguished Name
     • Read objectClass
     • Read objectGuid
     • Read showInAdvancedViewOnly
3. For Set the following in Descendant user objects: User objects .field:
   • In the Permissions check the List contents box.
   • In the Properties select read/write the following sets of properties and attributes corresponding to (Table 3):
     • Read personal Information
     • Read general Information
     • Read account restrictions
     • Read public Information
     • Write pwdLastSet
     • Write thumbnailPhoto or Write jpegPhoto
     • Write userAccountControl

Table 3

. Attributes used by

Axidian CertiFlow to work with

users catalog

Table auto