Management Agent for Certificate and Smart Card Management

Use the management agent for Certificate and Smart Card Management to create profiles based on existing Certificate Lifecycle Manager (CLM) Profile Templates that you can then use to manage the lifecycle of both software and smart card-based certificates.

Properties

Schema Information

The schema is generated based on a fixed schema that models the database structure. Refresh schema is not available for this management agent because it uses a static schema that cannot be changed.

Remarks

• The management agent imports the following object types from CLM:

  • Requests (clmRequest)

  • Profiles (clmProfile)

  Note

  In addition, a third object, clmConfig holds various configuration settings from CLM.

• Objects in CLM are identified by GUIDs. Profile objects and request objects each have GUIDs assigned to them. Users in CLM are not assigned new GUIDs; they use the objectGUID attribute from the corresponding Active Directory user object. Joining objects from CLM to the metaverse (MV) is done using the objectGUID attribute from Active Directory. This requires the management agent for Active Directory to have an import attribute flow rule that sends the objectGUID attribute to the metaverse as a binary attribute. This can be done using direct import attribute flow with the management agent for Active Directory.

  Important

  The objectGUID attribute is not part of the metaverse schema by default. The objectGUID attribute must be added as a custom attribute, of type binary (indexed), to the person object type in the metaverse before you can create a management agent for Certificate and Smart Card Management.

• The management agent for Certificate and Smart Card Management must match the version of the CLM server that it is connecting to. For example, if you have upgraded the CLM server to Feature Pack 1 (FP1), then you must reinstall the management agent for Certificate and Smart Card Management from the FP1 media.

• When creating and configuring an instance of the management agent for Certificate and Smart Card Management, the only configuration changes that are supported are those in Configure Connection Information and in Configure Additional Parameters pages in Management Agent Designer. You must not make any changes to any of the other configuration pages.

• For a specified profile template, the management agent for Certificate and Smart Card Management supports the following management policies:

  • Enroll Policy

  • Reinstate Policy

  • Recover On Behalf Policy

  • Duplicate Policy

  • Disable Policy (Smart card profile templates only)

  • Retire Policy (Smart card profile templates only)

  • Temporary Cards Policy (Smart card profile templates only)

• To run the management agent for Certificate and Smart Card Management, the MIIS service account must have access to the following registry keys:

  Registry key	Minimum access required
  HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog	Read/Write
  HKLM\Software\Microsoft\EnterpriseCertificates	Read
  HKLM\Software\Microsoft\SystemCertificates	Read
  HKLM\Software\Policies\Microsoft\SystemCertificates	Read

• The user account specified in the Configure Connection Information page in Management Agent Designer must be assigned the correct permissions at the following locations:

  • Service Connection Point (SCP) - SCP permissions determine whether a user is assigned a management role within the CLM deployment. For example, if a user must initiate requests for other users, the user is assigned the CLM Request Enroll permission at the SCP.

  • Profile template object - The profile template permissions determine whether a user can read the profile template’s contents (to execute management policy workflows within the profile template) or receive certificates based on the profile template’s management policies. If a user is required to enroll certificates based on the profile template, the user must be assigned the CLM Enroll permission on the profile template.

  • Users or groups - A user or group that is assigned a CLM management role must have permissions on the user or group objects they manage within the environment. For example, if you want to enable a manager to recover certificates issued to members of the EFSUsers group, you must assign the manager, or a group containing the manager, the CLM Request Recover permission on the EFSUsers group object.

  • Within a management policy - A user or group must be assigned the management role within the management policy. For example, if a user is tasked with approving enrollment requests, you must assign that user permission to approve enrollment requests within the Enroll management policy. Management policies are stored in the Profile template objects and are configured using the CLM Web portal.

    Note

    For more information on CLM permissions, see the CLM online help.

  • CLM SQL tables - If you have configured CLM to use Windows Authentication for access to the CLM SQL database, the user account specified when creating the management agent for Certificate and Smart Card Management requires the db_datareader role on the Profiles and Requests tables in the CLM SQL database.

  • Registry key - For the SQL connection string to be read from the registry on the server running CLM, the account specified in the management agent for Certificate and Smart Card Management must be granted Read access to the following registry key on the server running CLM:

    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CLM\v1.0\Server\WebUser

    Note

    If you are missing any of the required permission assignments, you receive an "Access Denied" error message when you attempt to run the management agent.

• The management agent installation program installs the Microsoft.CLM.ClmMaProxy.DLL in the %ProgramFiles%\Microsoft Certificate Lifecycle Manager\web\bin folder on all connected servers running CLM.

• The CLM web.config file (%ProgramFiles%\Microsoft Certificate Lifecycle Manager\web\web.config) must be updated before running the management agent for Certificate and Smart Card Management. In the “<!-- REMOTING SECTION (BUILT-IN) ++++++++++++++++++++++++++++++++++++++++++-->” section, between the <service></service> tags, add the following line:

  <wellknown mode="Singleton" type="ExtensibleWfMA.ClmMaProxy, Microsoft.Clm.ClmMaProxy" objectUri="clmManagementAgent.rem"/>
  

• Each server running CLM requires its own management agent. However, if you have multiple servers running CLM that share a single SQL database, for example in a load balancing environment, you have to create only one management agent.

• The management agent for Certificate and Smart Card Management supports the use of Delta imports; however, if you use failover for the CLM SQL database, in the event that a failover of the database occurs, you must perform a Full Import run of the management agent after the failover event. You must also perform a Full Import run of the management agent if you subsequently fail back to the original SQL database.

• During provisioning of a request, ILM 2007 FP1 sets the originator of the request as the user account name specified in Configure Connection Information in Management Agent Designer. ILM 2007 FP1 uses the user account attribute to prevent a situation in which ILM 2007 FP1 attempts to reprovision an existing request. If the account ILM 2007 FP1 uses to connect to the server running CLM has changed, previously provisioned requests might be reprovisioned.

• To run the management agent for Certificate and Smart Card Management, the MIIS Server Account must be a member of the MIISJoiners security group.

• The management agent for Certificate and Smart Card Management must be configured to run in a separate process.

Configure Additional Parameters

The following additional parameters can be configured in Management Agent Designer.

See Also

Concepts

Management Agents in MIIS 2003