Identity Lifecycle Manager 2007

Implementing CLM Permissions: An Example
To illustrate the capabilities of ILM 2007's certificate management component, let's look at an example of how to implement CLM permissions. In this example, the Certificate Managers group uses a delegated enrollment model to issue code signing certificates to the Certificate Subscribers group. (Note: This example discusses only the Enroll workflow. For a typical deployment, workflows must be defined for each management policy in the profile template. For example, separate workflows can be defined for revoking certificates and recovering certificates.)

Defining profile details. To create a new profile template, you must duplicate an existing profile template. Because this profile template will issue a software-based certificate, you can use the following steps to duplicate the CLM Sample Profile Template that ships with ILM 2007.

1. Start Microsoft Internet Explorer (IE).
2. Navigate to http://clmserver/clm.
3. Click the Microsoft Certificate Lifecycle Manager logo.
4. On the Home page, in the Administration section, click Manage profile templates.
5. On the Profile Template Management page, in the Profile Template List section, select the CLM Sample Profile Template check box, then click Copy a selected profile template.
6. On the Duplicate Profile page, in the Profile Template Name section, in the New Profile Template Name box, type Code Signing Certificates, and click OK.
7. In the Certificate Templates section, click Add new certificate template.
8. In the Certificate Authorities section, select CAName.
9. In the Certificate Templates section, select CodeSigning, and click Add.
10. In the Certificate Templates section, select the User check box, then click Delete selected certificate templates.

After you complete these steps, the Profile Template will have the Profile Details settings that Figure 2 shows. (Note: If you were deploying smart cards, you would also need to configure the smart card Cryptographic Service Provider—CSP, the smart card details, and if required, smart card printing settings in the profile details.)

Defining the Enroll policy. The Enroll policy defines the workflow for the issuance of certificates. My example uses a delegated workflow, requiring the certificate managers to initiate the workflow for the code signing certificate issued to the certificate subscriber. To define the Enroll policy, complete the following steps. Figure 3 illustrates these steps.

1. In the Select a view section, click Enroll Policy.
2. In the Workflow: General section, click Change general settings.
3. Disable the Use self serve option, and click OK.
4. In the Workflow: Initiate Enroll Requests section, add the Domain\Certificate Managers group and remove the NT Authority\System group.
5. In the Data Collection section, click Sample Data Item.
6. Change the name of the data collection item to Photo Identification, change the Data Item Originator to Certificate Manager, and click OK.
7. In the OneTime Passwords section, leave the default setting of a single one-time password.
8. In the Passwords Distribution section, leave the Display on screen default option.

The one-time secret will then be displayed to the certificate manager and will be provided to the certificate subscriber after validation of the subscriber's photo identification.

Defining permissions. To allow processing of the workflow, permissions must be assigned at all five permission assignment locations. When you use the previous procedure to define the Enroll policy, only the Management Policy permissions are defined. The following additional permissions must be assigned.

• Service Connection Point—Assign the Certificate Managers group CLM Enroll permissions to allow the group to initiate an enrollment process.
• Certificate Subscribers Group—Assign the Certificate Managers group the CLM Enroll permission. This assignment defines that Certificate Managers can initiate enrollment only for the members of the CLM Subscribers group.
• Code Signing Certificates Profile Template— Assign both the Certificate Managers and the Certificate Subscribers groups the Read and CLM Enroll permissions. In a delegated model, both the manager and subscribers must have CLM Enroll permissions.
• Code Signing Certificate Template—Assign the Certificate Subscribers group the Read and Enroll permissions. You must assign the Read and Enroll permissions only to the group that submits the request to the CA. The Certificate Managers group merely initiates the request; the Certificate Subscribers group submits the request to the CA.