User Certificate distribution with own CA via Afaria

Hi there
We have our own enterprise certificate authority Server (Microsoft Native).
We have already been able to request user certificates, get them on the device and use them for WiFi-Access. Still we have some questions concerning certificate handling.
In the Server-Configuration (Afaria 7 SP5) at Server -> Configuration -> Certificate Authority we found the Checkbox for "Revocation".
The Afaria Documentation describes the Checkbox like this:
"Revocation: Enable to allow users to revoke the certificate".
Who are the 'users' in this sentence? The Users for whom certificates have been requested? If this checkbox is not ticked, is it not possible to revoke certificates via CRL from the server?
Kind regards, Tobias

Hi, Tobias.
The "users" in this case would be the people assigned as Afaria administrators and granted proper privileges through the Afaria Administrator roles to revoke certificates for devices. The device owners cannot revoke their own certificates.
If the "Revocation" box is not checked you won't see the "Revoke Certificates" icon appear when highlighting a device from the Device Certificates views. So you cannot revoke the certificates from within the Afaria Administrator. You could still revoke them from the CA itself, however.
Let me know if you have further questions.
Thanks,
Keith Nunn
SAP Active Global Support

Similar Messages

COPA user-defined charact. w. own value maint. with existing check-table

Dear Experts,
I need to create a user-defined characteristic with own value maintenance with the pecularity that it needs to refer to the same check table as another user-defined characteristic with own value maintenance.
Could anybody explain me how I can do that?
Thanks in advance for your kind support.
Best Regards,
Eric

Hi Eric,
Generally when you are creating user defined charachteristic with own value maintainance check table is created by the system. So you requirement is not possible to achieve. As a workaounr you can create two char as you want and then copy the content of the first check table to the second one. This will have the same impact as what you have described.
Best Regards,
Abhisek Patnaik

Manage user certificates with UE-V?

Is it possible to manage user certificates with UE-V? I wish to store/manage Personal Certificates with UE-V but can't seem to find information about how to achieve this. Are Roaming Profiles still needed to have user certificates follow users
or can this be hacked into UE-V. I tried to create a template which handles the HKCU and User AppData paths which store Certificates but have not been able to get this to work.
Windows 7/Windows 8 Server 2008R2/Server2012
Any insight would be appreciated.
Thanks,
Mark Ringo

Hi Mark
Certificates are currently not supported with UE-V 1.0 / 1.0 SP1. Just saving HKCU keys and the RSA / System Certificate files in APPDATA does not work any more since Windows Vista. You have to use a logon / logoff script which does the trick via Microsoft
CryptoAPI (Export / Import).
I have included exampled with Powershell below.
Cheers
Michael
ExportCert.ps1
# Scriptname: ExportCert.ps1
# Author: Michael Rüefli
# Purpose: Export certificates local certificate store (Machine or User) to a PKCS12 file format
# Version: 1.0.1
# Fixed Issues / Changes:
# V 1.0.1 / Fixed Export where no filter has been specified. Changed the autogenerated password strenght
function ConvertToSid([STRING]$NtAccount)
$result = (New-Object system.security.principal.NtAccount($NTaccount)).translate([system.security.principal.securityidentifier])
return $result.value
#Get the Arguments
$exportpath = $args[0]
$certstore = $args[1]
$issuer_filter = $args[2]
#Check the Args
If ($args.count -lt 2)
Write-host "Too less arguments! Usage: ExportCert.ps1 <exportpath> <certstore> [<filter> optional>" -ForegroundColor red
write-host "Example: Powershell.exe ExportCert.ps1 H:\Certs CurrentUser DC=LOC" -ForegroundColor blue
exit
#Error Handler
Trap [Exception]{continue}
#Check Exportpath, if not there create it
If ((Test-Path -Path $exportpath) -ne $True)
New-Item -Path $exportpath -ItemType Directory
#Get certificates in store
If ($issuer_filter)
$HKCUCerts = (dir cert:\$certstore\My | ? { $_.Issuer -notmatch $issuer_filter})
Else
$HKCUCerts = (dir cert:\$certstore\My)
#process each certificate
Foreach ($cert in $HKCUCerts)
$friendlyname = $cert.FriendlyName
$type = [System.Security.Cryptography.X509Certificates.X509ContentType]::pfx
$username = $env:USERNAME
$sid = ConvertToSid $username
$pass = 'Letmein$$Cert2012'
$pass_secure = ConvertTo-SecureString -AsPlainText $pass -Force
$bytes = $cert.export($type, $pass)
[System.IO.File]::WriteAllBytes("$exportpath\$friendlyname.pfx", $bytes)
ImportCert.ps1
# Scriptname: ImportCert.ps1
# Author: Michael Rüefli
# Purpose: Import PKCS12 certificates from a file share into local certificate store (Machine or User)
# Version: 1.0
# Fixed Issues / Changes:
# V 1.0.1 / Changed the autogenerated password strenght
function ConvertToSid([STRING]$NtAccount)
$result = (New-Object system.security.principal.NtAccount($NTaccount)).translate([system.security.principal.securityidentifier])
return $result.value
#Get the Arguments
$importpath = $args[0]
$certstore = $args[1]
#Check the Args
If ($args.count -lt 2)
write-host "Too less arguments! Usage: ImportCert.ps1 <importpath> <certstore>" -ForegroundColor red
write-host "Example: Powershell.exe ImportCert.ps1 H:\Certs CurrentUser" -ForegroundColor blue
exit
#Error Handler
Trap [Exception]{continue}
function Import-PfxCertificate
param([String]$certPath,[String]$certRootStore,[String]$certStore,$pfxPass = $null,[String]$KeySet)
#Error Handler
Trap [Exception]{continue}
if ($args[0] -eq "-h")
Write-Host "usage: Import-509Certificate <Filename>,<certstore>,<cert root>,<keyset> `n `
Valid certstores: LocalMachine,CurrentUser `n `
Valid cert root: My,AuthRoot,TrustedPublisher `n `
Valid Keysets: MachineKeySet,UserKeySet"
break
write-host "Importing Certificate: $certPath"
$pfx = new-object System.Security.Cryptography.X509Certificates.X509Certificate2
if ($pfxPass -eq $null) {$pfxPass = read-host "Enter the pfx password" -assecurestring}
$pfx.import($certPath,$pfxPass,"MachineKeySet,Exportable,PersistKeySet")
$store = new-object System.Security.Cryptography.X509Certificates.X509Store($certStore,$certRootStore)
$store.open("MaxAllowed")
$store.add($pfx)
$store.close()
$username = $env:USERNAME
$certs = Get-ChildItem $importpath -Filter "*.pfx"
Foreach ($item in $certs)
$item
$friendlypath = $item.FullName
$friendlyname = ($item.Name).replace(".pfx","")
$sid = ConvertToSid $username
"$friendlyname-$username"
$pass = 'Letmein$$Cert2012'
$pass_secure = ConvertTo-SecureString -AsPlainText $pass -Force
Import-PfxCertificate "$friendlypath" "$certstore" "My" $pass_secure

Having issues with sending attachments via iMail to PC users

Having issues with sending attachments via iMail to PC users. Either they do not see all the attachments or the attachment comes across blank. Is there any suggested ways to resolve this?

You can also use Dropbox. 2GB free. Put files in the Public folder and you can send them links of the files instead.
You can use my referral link http://db.tt/MXNpy62 to create an account.

Is it possible to authenticate ActiveSync access with user certificates ?

I would like to authenticate Iphone users to access ActivSync services with a user certificates.
Exchange version is 2003 SP2
Front end is ISA Server 2006
I set up an internal PKI
I read in the Iphone Enterprise deployment guide the following:
Exchange ActiveSync Features Not Supported
Not all Exchange features are supported, including, for example:
Client certificate-based authentication
My question is: Is my configuration working ? If not, will it be supported in the future ? Is there a roadmap ?

It was easily possible with iPhone OS 2.x, but it seems has changed something for 3.0. See also http://discussions.apple.com/thread.jspa?messageID=9660201

OAM certificate Authentication failure redirection with no user certificate

Hi,
I am using Certificate authentication. I need to do an authentication fail redirect.
When I have valid certificate in my browser - authentication is successful. This is fine.
When I have invalid certificate (credential mapping failure) it redirects me to the intended url.
The problem is when I do not have a user certificate in my web browser. It does not redirect to the url.
Anyone has a solution? any suggesstion?
Please let me know. Its an urgent requirment.
Thanks.
Himadri

Hi Himadri,
It's some time since I have tested this, but I believe that what you have discovered is unavoidable behaviour, and you will need to handle this condition somehow in the configuration of the web server. The behaviour is:
- user presents certificate that is accepted by web server, but not OAM, then the OAM authentication failure redirect takes effect ;
- user presents certificate that is not accepted by web server (or no certificate as you discovered) then the web server handles the failure without giving the WebGate the chance to intervene.
Sorry I'm not sure how to do this in the web server.
Regards,
Colin

802.1x with AD support via ACS 4

Hello ,
I have been trying to configure 802.1x Authentication on a test switch . Authentication will be provided by the ACS server . This worked when I had the client setup for EAP-MD5 and had local user accounts on the ACS server . However this is impractical if we were to deploy this on a large scale. How can i configure 802.1X authentication to occur via the ACS with the ACS looking at the AD database . The trouble is AD does not support EAP-MD5. It supports PEAP but the problem I am having is "EAP-TLS or PEAP authentication failed during SSL handshake "
Has anyone here setup 802.1x with AD integration via ACS 4.0 . Please help.
Thanks.
Karthik

Hi Karthik,
The SSL handshake will fail in our experience for any of the following reasons:
- The supplicant cannot access the private key corresponding to it's certificate - check that the system a/c has pemissions over the private key found in c:\documents and settings\all users\application data\microsoft\crypto\rsa\machine keys
- The ACS sever does not trust the Root Certificate for the PKI that issued the supplicants certificate - Is the Supplicants Root CA present in the ACS Certificate Trust List?
- CRL checking is enabled and the CRL has expired or is inaccessible
If you up the logging levels to full and examine the csauth log closely you should get more detail as to the reason
Hope that helps
Andy

Retrieving personal user certificate for secure webservice

All,
I am currently creating a WLW 8.1 webservice that will interact with a non-browser client. The reason I mention non-browser is that in order to secure this webservice and also have it function correctly I need to retrieve a user's personal certificate. Our team has done this for web-content in the past with simple retrieval via the browser, but in this case the client is non-configurable and will be talking directly with my webservice.
My question is: is it possible to retrieve the user's certificate via a webservice? The certificate is not only used for security validation, but their credentials are also used to validate them in other programs on the back-end of the webservice. This allows personalized content based on the certificate.
Thanks for any help you can provide. I know that was long winded and semi-complicated so if any clarification is required please ask.
Thanks,
Sam

So in essence, then, Credential Roaming is exactly what we need.
yes.
> but if the cert needs to be in the Personal store PRIOR to the user being authenticated on 802.1x
this is one pitfall of this scenario. You need to have locally installed certificates prior to connecting to wireless network. This means, that you cannot initially connect to wireless prior logging on to domain by using wired network. Once certificates
are cached, you can connect to wireless networks with cached certificates.
Vadims Podāns, aka PowerShell CryptoGuy
My weblog: en-us.sysadmins.lv
PowerShell PKI Module: pspki.codeplex.com
PowerShell Cmdlet Help Editor pscmdlethelpeditor.codeplex.com
Check out new: SSL Certificate Verifier
Check out new:
PowerShell File Checksum Integrity Verifier tool.

User-defined rules with SPIN (SPARQL CONSTRUCT)

Hi,
We are looking at SPIN as an alternative to define and execute user-defined rules. It is very expressive and in that point looks superior over Jena, SWRL and Oracle type of user-defined rules with IF (filter) -> THEN type of syntax. Although, SPIN is TopQuadrant's, it is entirely SPARQL, and Oracle supports SPARQL CONSTRUCT via Jena Adapter. TopBraid Composer provides and excellent tool support and rule editor for SPIN rules as well.
There is no problem to execute SPIN rules via Jena Adapter, and I believe even via TopQuadrant's SIN API, which is TopQuadrants's SPARQL based infrence engine's API.
My question is about whether Oracle has looked into supporting SPARQL CONSTUCT based user-defined rules in its native inference engine?
Do you have a recommendation for how to use SPIN based user rules in combination with Oracle inference today?
Thanks
Jürgen

Hi Jürgen,
We are actually looking into a general mechanism that allows users to plug in their own queries/logic during inference. Thanks very much for bringing SPIN up. This general mechanism is very likely going to cover CONSTRUCT queries.
To extend the existing inference engine using the existing Jena Adapter release, one possible way is as follows.
1) Assume you have an ontology (model) A.
2) Create an empty model B.
3) run performInference on both A and B using OWLPrime.
4) run SPARQL CONSTRUCT queries against A, B and inferred data
5) store the query results (in the form of Jena models) back into model B.
6) If the size of model B does not change, then stop. Otherwise, repeat 3)
Note that model B is created to separate your original asserted data from inferred data.
If you don't need such a separation, then don't create it.
Thanks,
Zhe Wu

Problem loading/storing user certificate on 6230

I have generated a certificate using keytool and have signed my midlet using the same certificate. I then sent the certificate via IR to my Nokia 6230. The phone recevies it but says unknown format. Any suggestions on how to send the certificate to the phone?
The midlet loaded cant be started - the error message is "No Valid Certificate" - which i guess is correct since I havent loaded the certificate to the phone.
On the phone, under services->settings->security settings there is a user certificates and Authority Certificates. I presume, when i eventually succeed in getting the certificate loaded on the phone it would show up under User Certificates. Is this a good assumption?
thanks in advance,
anish

Hi Prateek,
Thanks for the reply. I have got my certificate signed by CA. The problem is importing the client certificate into the Trusted CA's.
When i try to import the client certificate into TrustedCA using the load button, after selecting the certi a pop up comes and asks for the password.
I tried with two diff certifi and this happens only to one which has got digital signature. I have asked the customer who sends the request and they are saying there is no such kind of password.
any help or suggestions would be appreciated
Thanks,
Srini

USER CAN'T FIND OWN PO IN GR FOR DESKTOP USER

Hi,
We are Using SRM 5.0 with Extended Classic Scenario
User Can't find his Own PO IN GR for Desktop user .But buyer can search
it via GR for professional user,
Only one PO is not Visible in GR for desktop user , rest all PO are
visisble which pending for GR confirmation.this user can post all GR's
but for 1 particular PO there is nothing appearing in GR transaction
because i checked in MIGO and we would be able to post GR in R/3 system
but somehow this 1 PO does not appear in the users list for GR.
Pls find the screen shot attached below
Can you Please suggest for any Oss Note avaibale against this.
This is very Urgent because user needs it by 25th of sep in order to
complete GR confirmation .
Please reply at the earliest.
Thanks in advance
Regards
Prasanna

Hi Prasanna,
Its really difficult to explain what's the real problem is with the information provided by you. Look at the following observations which may help you in resolve the issues :
1. Check in the Extended Search if any other fields were populated / checked which is causing this issue.
2. Check trying to confirm the P.O from Confirm goods / services centrally under Centralized Purchasing node.
3. Check for the status & document history of the P.O in under Process Purchase orders node.
4. Check whether the confirmation was already made against that P.O or some one would have accidentally clicked the "Complete" button in the change mode of Process Purchase orders. If this is the case then you can not confirm the P.O further.
Let me know about your observations after checking above points.
Award points for suitable answers.
Rgds,
Teja

[Solved] Generating User Certificate Programmatically

I have a requirement to automatically generate a user certificate when a new user is created (via a custom form). Is it possible to do this with OCA? How? Are there any alternatives?
Thanks,
Brian

Couldn't find a way to do this. Our solution was to email the new user with a hyperlink to OCA where they can request and download their certificate.

In R12, can payroll user enter expense report for employees via web-based?

Hi,
In R12, can payroll user enter expense report for employees via web-based screen? Previously in 11i, it can be done via the Expense Report forms.
Appreciate advise on this.
Thanks in advance.
Regards,
Shiau Chin

Hi Anne,
Please see page 42 of the [url http://download.oracle.com/docs/cd/B34956_01/current/acrobat/120oieig.pdf]iExpenses Implementation and Admin Guide for R12 . If you are unable to enter the ID as per the guide, I would suggest raising an Service Request with Oracle Support.
Cheers, Pete

Client certificate authentication with custom authorization for J2EE roles?

We have a Java application deployed on Sun Java Web Server 7.0u2 where we would like to secure it with client certificates, and a custom mapping of subject DNs onto J2EE roles (e.g., "visitor", "registered-user", "admin"). If we our web.xml includes:
<login-config>
 <auth-method>CLIENT-CERT</auth-method>
 <realm-name>certificate</realm-name>
<login-config>that will enforce that only users with valid client certs can access our app, but I don't see any hook for mapping different roles. Is there one? Can anyone point to documentation, or an example?
On the other hand, if we wanted to create a custom realm, the only documentation I have found is the sample JDBCRealm, which includes extending IASPasswordLoginModule. In our case, we wouldn't want to prompt for a password, we would want to examine the client certificate, so we would want to extend some base class higher up the hierarchy. I'm not sure whether I can provide any class that implements javax.security.auth.spi.LoginModule, or whether the WebServer requires it to implement or extend something more specific. It would be ideal if there were an IASCertificateLoginModule that handled the certificate authentication, and allowed me to access the subject DN info from the certificate (e.g., thru a javax.security.auth.Subject) and cache group info to support a specialized IASRealm::getGroupNames(string user) method for authorization. In a case like that, I'm not sure whether the web.xml should be:
<login-config>
 <auth-method>CLIENT-CERT</auth-method>
 <realm-name>MyRealm</realm-name>
<login-config>or:
<login-config>
 <auth-method>MyRealm</auth-method>
<login-config>Anybody done anything like this before?
--Thanks

We have JDBCRealm.java and JDBCLoginModule.java in <ws-install-dir>/samples/java/webapps/security/jdbcrealm/src/samples/security/jdbcrealm. I think we need to tweak it to suite our needs :
$cat JDBCRealm.java
* JDBCRealm for supporting RDBMS authentication.
* This login module provides a sample implementation of a custom realm.
* You may use this sample as a template for creating alternate custom
* authentication realm implementations to suit your applications needs.
* In order to plug in a realm into the server you need to
* implement both a login module (see JDBCLoginModule for an example)
* which performs the authentication and a realm (as shown by this
* class) which is used to manage other realm operations.
* A custom realm should implement the following methods:
* <ul>
* <li>init(props)
* <li>getAuthType()
* <li>getGroupNames(username)
* </ul>
* IASRealm and other classes and fields referenced in the sample
* code should be treated as opaque undocumented interfaces.
final public class JDBCRealm extends IASRealm
 protected void init(Properties props)
 throws BadRealmException, NoSuchRealmException
 public java.util.Enumeration getGroupNames (String username)
 throws InvalidOperationException, NoSuchUserException
 public void setGroupNames(String username, String[] groups)
}and
$cat JDBCLoginModule.java
* JDBCRealm login module.
* This login module provides a sample implementation of a custom realm.
* You may use this sample as a template for creating alternate custom
* authentication realm implementations to suit your applications needs.
* In order to plug in a realm into the server you need to implement
* both a login module (as shown by this class) which performs the
* authentication and a realm (see JDBCRealm for an example) which is used
* to manage other realm operations.
* The PasswordLoginModule class is a JAAS LoginModule and must be
* extended by this class. PasswordLoginModule provides internal
* implementations for all the LoginModule methods (such as login(),
* commit()). This class should not override these methods.
* This class is only required to implement the authenticate() method as
* shown below. The following rules need to be followed in the implementation
* of this method:
* <ul>
* <li>Your code should obtain the user and password to authenticate from
* _username and _password fields, respectively.
* <li>The authenticate method must finish with this call:
* return commitAuthentication(_username, _password, _currentRealm,
* grpList);
* <li>The grpList parameter is a String[] which can optionally be
* populated to contain the list of groups this user belongs to
* </ul>
* The PasswordLoginModule, AuthenticationStatus and other classes and
* fields referenced in the sample code should be treated as opaque
* undocumented interfaces.
* Sample setting in server.xml for JDBCLoginModule
* <pre>
* <auth-realm name="jdbc" classname="samples.security.jdbcrealm.JDBCRealm">
* <property name="dbdrivername" value="com.pointbase.jdbc.jdbcUniversalDriver"/>
* <property name="jaas-context" value="jdbcRealm"/>
* </auth-realm>
* </pre>
public class JDBCLoginModule extends PasswordLoginModule
 protected AuthenticationStatus authenticate()
 throws LoginException
 private String[] authenticate(String username,String passwd)
 private Connection getConnection() throws SQLException
}One more article [http://developers.sun.com/appserver/reference/techart/as8_authentication/]
You can try to extend "com/iplanet/ias/security/auth/realm/certificate/CertificateRealm.java"
[http://fisheye5.cenqua.com/browse/glassfish/appserv-core/src/java/com/sun/enterprise/security/auth/realm/certificate/CertificateRealm.java?r=SJSAS_9_0]
$cat CertificateRealm.java
package com.iplanet.ias.security.auth.realm.certificate;
* Realm wrapper for supporting certificate authentication.
* The certificate realm provides the security-service functionality
* needed to process a client-cert authentication. Since the SSL processing,
* and client certificate verification is done by NSS, no authentication
* is actually done by this realm. It only serves the purpose of being
* registered as the certificate handler realm and to service group
* membership requests during web container role checks.
* There is no JAAS LoginModule corresponding to the certificate
* realm. The purpose of a JAAS LoginModule is to implement the actual
* authentication processing, which for the case of this certificate
* realm is already done by the time execution gets to Java.
* The certificate realm needs the following properties in its
* configuration: None.
* The following optional attributes can also be specified:
* <ul>
* <li>assign-groups - A comma-separated list of group names which
* will be assigned to all users who present a cryptographically
* valid certificate. Since groups are otherwise not supported
* by the cert realm, this allows grouping cert users
* for convenience.
* </ul>
public class CertificateRealm extends IASRealm
 protected void init(Properties props)
 * Returns the name of all the groups that this user belongs to.
 * @param username Name of the user in this realm whose group listing
 * is needed.
 * @return Enumeration of group names (strings).
 * @exception InvalidOperationException thrown if the realm does not
 * support this operation - e.g. Certificate realm does not support
 * this operation.
 public Enumeration getGroupNames(String username)
 throws NoSuchUserException, InvalidOperationException
 * Complete authentication of certificate user.
 * As noted, the certificate realm does not do the actual
 * authentication (signature and cert chain validation) for
 * the user certificate, this is done earlier in NSS. This default
 * implementation does nothing. The call has been preserved from S1AS
 * as a placeholder for potential subclasses which may take some
 * action.
 * @param certs The array of certificates provided in the request.
 public void authenticate(X509Certificate certs[])
 throws LoginException
 // Set up SecurityContext, but that is not applicable to S1WS..
}Edited by: mv on Apr 24, 2009 7:04 AM

Can you add delegate access to a user's calendar or mailbox folder via powershell?

Basically I want to know if you can grant a user delegate access to another user's calendar or meeting room using native powershell commands?
I know you can do this via method 1, listed below, however when you grant permissions in this way and if a user wants to see who has delegate access to their calendar or inbox by going to delegate access in outlook they will not see user's who have access
to their calendar or inbox.
Method 1:
Add-MailboxFolderPermission -Identity "userA:\Calendar" -User UserB -AccessRights editor
The above is a nice and simple way of granting userB EDITOR access to UserA's calendar.
But as stated above as you are using mailboxFolderPermissions and not DelegateAccess, this applies directly to this folder and if userA goes to their delegate access view in Outlook, they will not see that userB has access to their calendar.
I know that you can use the below commands to see a list of user's who have delegate access to you calendar:
Get-Mailbox userA | Get-CalendarProcessing | select resourcedelegates
I am new to powershell and don't know if there is a way of setting delegate access to a user's calendar or inbox/folder via powershell commands, similar to the above.
Any help with this query would be much appreciated!
thanks

Delegate access is simply a combination of folder rights (which you've described) and Send As right, which is conferred by Add-MailboxPermission or Send On Behalf of right, which I'm not sure if you can confer with PowerShell. Set-CalendarProesssing applies
to resource mailboxes like conference rooms, not to user mailboxes.
Update: "Send on Behalf of" is conferred this way:
Set-Mailbox UserMailbox -GrantSendOnBehalfTo UserWhoSends
Ed Crowley MVP "There are seldom good technological solutions to behavioral problems."

User Certificate distribution with own CA via Afaria

Similar Messages

Maybe you are looking for