Versions Compared
Key
- This line was added.
- This line was removed.
- Formatting was changed.
For Indeed Certificate Manager Axidian CertiFlow system to operate properly, you must have certain access rights to access Active Directory objects and certification authorities are required. You . Depending on your company's security policy, you can distribute the privileges between several accounts, or create one service account with maximum rights for system management, depending on the requirements of the company security policy.
Create a service account (say, CFADServiceOpse.g. cfServiceAD) and grant it the necessary permissions to work with the an object (domainsdomain, containerscontainer, organizational unit) where the Indeed Certificate Manager users will be locatedthat contains Axidian CertiFlow users. This account will be used to read and write user attributes.
To do this, do the followingGo through these steps:
- Open Security property property of the object (domain, container or organizational unit) that contains the Indeed CM system Axidian CertiFlow users.
- Click Advanced. Click →Add. Click →Select a principal.
- In the Enter the object name to select text box, type enter the name of the service account (CFADServiceOpscfServiceAD) . Click and click OK.
- In the Applies to list box, select Descendant User objects.
- In the Permissions list, activate:
- List contents
Read all properties permission.
Info By default, permission to read all user properties is granted to all accounts in the domain.
- Reset password - Required required to be able to Resetting the Reset user's password via the system interface.
- In the Properties list, set the following permissions:
- Write pwdLastSet - Also required to be able to reset the user's password.
- Write thumbnailPhoto or Write jpegPhoto - Required to Photo uploading required to be able to Upload a photo to a user in Active Directory via the system interface.
- Write userAccountControl - Required for the required to enable option Enforce smart card logon option.
- Click ОК and then and Apply.
Warning |
---|
Set Assign the same set of privileges for to each object (domain, container or organizational unit) where Indeed CM users are located.that contains Axidian CertiFlow users. |
In case the domain security policies forbid If reading all user properties are forbidden the domain security policies, then set the rights for , you can specify that the service account access has permissions to only to read the required necessary user attributes according to (Table 3) and object attributes of the object (domain, container, or organizational unit) in which are located the Indeed CM users.that contains Axidian CertiFlow users.
Go through these steps:
- In On the ADSI edit snap-in, open the Security property of the object (domain, container or division) that contains the Indeed CM Axidian CertiFlow users.
- For Set the following in This object and all descendant objects .field:
- In the Permissions click check the List contents check box.
- In the Properties click check the check following boxes next to:
- Read сanonicalName
- Read Distinguished Name
- Read objectClass
- Read objectGuid
- Read showInAdvancedViewOnly
- For Set the following in Descendant user objects: User objects .field:
- In the Permissions check the List contents box.
- In the Properties select read/write the following sets of properties and attributes corresponding to (Table 3):
- Read personal Information
- Read general Information
- Read account restrictions
- Read public Information
- Write pwdLastSet
- Write thumbnailPhoto or Write jpegPhoto
- Write userAccountControl
Info |
---|
LDAP Display Names are listed below. Granting access to the properties set significantly increases the system performance significantly and also simplifies the security management (see Property Sets). |
Table 3
–. Attributes used by
Indeed CMAxidian CertiFlow to work with
user directory.users catalog
Table auto |
---|
Attribute (LDAP Display Name) | Common Name | Commentary |
---|---|---|
c | Country/Region Abbreviation or Country/Region Name | Is a part Part of "Personal information" properties set. |
сanonicalName | Canonical Name | Is a part Part of the "Public Information" properties set. |
cn | Common Name | Is a part Part of the "Public Information" properties set. |
company | Company | Is a part Part of the "Public Information" properties set. |
department | Department | Is a part Part of the "Public Information" properties set. |
distinguishedName | Distinguished Name | Is a part Part of the "Public Information" properties set. |
givenName | Given Name | Is a part Part of the "Public Information" properties set. |
l | Locality Name | Is a part Part of the "Personal Information" properties set. |
E-mail Addresses | Is a part Part of the "Public Information" properties set. | |
manager | Manager | Is a part Part of the "Public Information" properties set. |
objectClass | Object Class | Is a part Part of the "Public Information" properties set. |
objectGUID | ОbjectGUID | Is a part Part of the "Public Information" properties set. |
objectSid | Object Sid | Is a part Part of the "General Information" properties set. |
otherMailbox | Other Mailbox | Is a part Part of the "Public Information" properties set. |
proxyAddresses | Proxy Addresses | Is a part Part of the "Public Information" properties set. |
pwdLastSet | Pwd Last Set | Is a part Part of "User Account Restrictions" properties set. |
sAMAccountName | SAM Account Name | Is a part Part of the "General Information" properties set. |
sn | Surname | Is a part Part of the "Public Information" properties set. |
st | State or Province Name | Is a part Part of the "Personal Information" properties set. |
streetAddress | Address (или or Street) | Is a part Part of the "Personal Information" properties set. |
telephoneNumber | Telephone Number | Is a part Part of the "Personal Information" properties set. |
thumbnailPhoto or jpegPhoto | Picture | Is a part Part of the "Personal Information" properties set. |
userAccountControl | User Account Control | Is a part Part of "User Account Restrictions" properties set. |
userPrincipalName | User Principal Name | Is a part Part of the "Public Information" properties set. |