Identity Lifecycle Manager 2007

Workflow design. The biggest benefit of ILM 2007 certificate management is the ability to define workflows for certificate management. For example, you can define exactly what process is used to obtain Secure MIME (S/MIME) certificates or to unblock a smart card. The following three common models exist for certificate management.

• In a Self-Service model, all processes within a workflow are initiated by the certificate subscriber defined in the profile template. For example, a user can initiate the request of an Encrypting File System (EFS) certificate. Self-service for certificate acquisition is typically considered a low-assurance model because no person other than the certificate requestor is involved in the issuance of the certificate. However, self-service is acceptable for several scenarios such as IPsec certificates or EFS encryption certificates.
• In a Delegated model, a workflow is initiated by a certificate manager but is completed by the certificate subscriber. This workflow is considered medium assurance and is typically used for certificates that require strong validation of the subscriber's identity. For example, the certificate request for an EFS recovery agent or a Key Recovery Agent might use a delegated workflow. A certificate manager will initiate the request, with control being passed to the subscriber through the use of one-time secrets in an email message to complete the request.
• In a Centralized model, the entire request is completed by the certificate manager. This workflow is typically used for high-assurance certificates. The certificate manager acts as an enrollment agent and places the subscriber's name information in the subject of the issued certificate.

Permissions. To define certificate management workflows, you must assign CLM extended permissions. The following seven extended permissions are assigned to users, groups, or the ILM 2007 certificate management Service Connection Point (SCP—which I define in the following section):

• CLM Audit—Allows viewing the profile template setting, approving requests, and generating reports
• CLM Enrollment Agent—Allows the holder to request a certificate on behalf of another user
• CLM Request Enroll—Allows the initiation, execution, or completion of an enrollment request
• CLM Request Recover—Allows the initiation of encryption key recovery operations from the CA database
• CLM Request Renew—Allows the initiation, execution, or completion of a renewal request when an original user certificate is near its expiration date and needs to be replaced with a new certificate that has a new validity period
• CLM Request Revoke—Allows termination of a certificate's validity before its expiration date (e.g., a certificate can be revoked because a user's laptop was stolen)
• CLM Request Unblock Smart Card— Allows a smart card's user PIN to be reset, reestablishing access to the smart card's key material

In addition, profile template objects include the CLM Enroll permission. Users who request certificates included in a profile template must be assigned the CLM Enroll permission on the profile template. If a user requests a certificate on behalf of another user, both the requestor (enrollment agent) and the target user must be assigned CLM Enroll permissions.

Note that ILM 2007 certificate management permissions can be assigned only to users, global groups, or universal groups. Permission assignments made to domain local groups are ignored.

Permission assignment locations. In ILM 2007 certificate management, effectively managing permissions includes intertwining the following five permission assignment locations. Figure 1 illustrates these locations.

1. Service Connection Point—If a user or group is assigned a CLM extended permission at the SCP, then the user gains access to the CLM management Web portal. A permission assignment at the SCP translates to a potential assignment of permissions. The permissions are effective only if a matching permission is assigned to a user or a group. Users require only Read permissions on the SCP to participate in CLM workflows.
2. Profile Template Object—A user or group must be assigned the Read and CLM Enroll permission on the profile template object to allow enrollment of certificates based on the profile template. If the workflow includes a manager acting as an enrollment agent, both the manager and the target users must be assigned the CLM Enroll permission.
3. Users/Groups—This permission assignment location goes hand-in-hand with the SCP. As I stated earlier, the SCP permission is a potential assignment. You could perform the assigned action on some user or group. A permission assignment on a user or group closes this loop. The user or group permission defines the target of the management action.
4. Certificate Template(s)—If the workflow requires the submission of certificate requests to a CA, the submitter of the request must be assigned the Read and Enroll permissions on the included certificate templates.
5. Within a Management Policy—The final permission assignment occurs within a management policy. The managers within a workflow must be assigned the right to initiate, approve, or act as an enrollment agent in a workflow. Alternatively, you can enable the self-service option to let a user initiate personal workflow requests.

Reporting. ILM 2007 certificate management includes excellent reporting facilities. In general, reports can be classified into the following three categories.

• CLM Summary Reports—Provide summarized reports for all managed requests, certificate usage, certificate expiry, and smart card inventories. These reports are useful when reporting to management about the state of all certificates managed by ILM 2007.
• CLM Detail Reports—Provide detailed reports for smart cards, smart card histories, requests, certificate template usage, and certificate revocation lists. Detail reports are appropriate when you are researching certificate usage for a specific person or smart card device.
• CLM Settings Reports—Provide detailed setting information for certificate templates or profile templates. These reports can be used to document the finalized settings defined for each certificate template or profile template you deploy.