Configuring Profile Templates

Microsoft® Identity Lifecycle Manager "2" Certificate Management Service (ILM CMS) is an identity-assurance management system that helps organizations provision and manage digital certificates and smart cards. ILM CMS integrates with standard enterprise infrastructure components such as Active Directory® domain service, Microsoft SQL Server™ database software, and Microsoft Windows Server® 2003 Certificate Services to provide a centralized administrative interface for both certificate managers and certificate subscribers. A server that runs ILM CMS is known as a CLM server.

At the center of all ILM CMS management activities are configurable profile templates that organize certificate templates, profile template details, and management policies:

• Certificate templates define certificate content and certification authorities (CAs). A single CLM profile template can include multiple certificate templates.

• Profile templates provide information, such as which certificates you issue for a particular user community, whether you store the certificates in software or on a smart card, and which certificate templates you include in the profile template.

• Management policies define workflows for tasks such as enrollment, recovery, and revocation. Management policies also define who performs tasks such as request initiation and approval.

The following topics describe how to configure CLM profile templates:

• Using the MMC with CLM 2007

• Creating a Certificate Template with the MMC

• Software-Based Certificates and Smart Cards

• Creating a Profile Template

• Assigning Permissions on a Profile Template

• Configuring a Profile Template for Software-Based Certificates

• Configuring a Profile Template for Smart Card Certificates

• Appendix A: Certificate Template Configuration

• Appendix B: Regular Expresssions

• Appendix C: Document Printing

• Appendix D: Smart Card Printing

• Appendix E: Assigning Approval Permissions Using Active Directory Permissions

Using the MMC with CLM 2007

ILM CMS provides a Web-based user interface (CLM Web site) for creating and managing subscriber certificates. Although you can perform most profile template configuration tasks by using a Web browser, you must use the Microsoft Management Console (MMC) with the appropriate snap-ins to complete the following tasks that are specific to Active Directory:

• Create users, groups, and certificate templates.

• Assign CLM permissions.

• Modify permissions on certificate or profile templates.

Before you configure CLM profile templates, you must configure the MMC for these ILM CMS administrative tasks.

To configure the MMC for CLM 2007

1. Click Start, click Run, type mmc, and then click OK.

2. In the MMC, click File, and then click Add/Remove Snap-in.

3. In Add/Remove Snap-in, click Add.

4. In Add Standalone Snap-in, click Active Directory Users and Computers, and then click Add.

5. To add the other snap-ins, repeat steps 3 and 4 of this procedure.

   The other snap-ins are Active Directory Sites and Services, Certificate Templates, and Certification Authority.

6. After you add all four snap-ins, click Close.

7. In Add/Remove Snap-in, click OK.

8. In the MMC, click File, and then click Save As.

9. In Save As, type a unique name for the snap-in, for example, CLMAdminSnapin.msc, and then click Save.

Creating a Certificate Template with the MMC

Before you configure CLM profile templates, you must use Windows Server 2003 to configure certificate templates and deploy them to your enterprise CAs. Certificate templates define the format and content of a certificate, and enable you to define specific attributes for certificates that meet the needs of your organization. For example, you can use certificate templates to do the following tasks:

• Define whether a user can export the private key associated with a certificate.

• Define what cryptographic service providers (CSPs) a certificate template supports.

• Define issuance and application policies for issued certificates.

ILM CMS uses the version 2 certificate templates in Windows Server 2003. You can use these templates to customize most settings in the template. Several preconfigured, version 2 templates are supplied in the default configuration of Windows Server 2003, and you can add more as necessary.

You can use Certificate Templates in the MMC to create and configure certificate templates. To create a new certificate template, you copy an existing template that is similar in function to the required certificate template, and then modify it.

To create a certificate template with the MMC

1. Click Start, click Run, in Open, type certtmpl.msc, and then click OK.

2. Right-click the template that you want to copy, and then click Duplicate Template.

3. Type a new name for the certificate template.

4. Make any necessary changes, and then click OK.

For more information about configuring certificate templates, see Appendix A: Certificate Template Configuration and Implementing and Administering Certificate Templates in Windows Server 2003.

Software-Based Certificates and Smart Cards

You can use ILM CMS to manage both software-based certificates, which reside on a user’s computer, and certificates on smart cards. The certificate manager view of the CLM Web site provides sample profile templates for software-based and smart card. Table 1 shows these certificates.

Table 1   Software-based certificates and smart cards

A single CLM profile template cannot support both smart cards and software-based certificates. If you deploy both smart cards and software-based certificates, you must create separate profile templates for them.

Creating a Profile Template

You can use the CLM Web site to create and configure profile templates. To create a new profile template, you copy an existing profile template or one of the sample profile templates, and then modify its certificates and policies as necessary.

To create a profile template

1. Log on to ILM CMS as an administrator.

2. On the Home page, in Administration, click Manage profile templates.

3. In Profile Template List, select the check box next to an existing profile template or one of the sample CLM profile templates, and then click Copy a selected profile template.

4. On the Duplicate Profile page, type the name for the new template, and then click OK.

5. On the Edit Profile Template page, review the profile template settings.

Assigning Permissions on a Profile Template

When you copy a profile template, you also copy the permissions associated with the original template. To change the permissions on the new profile template, open Active Directory Sites and Services and configure permissions on the new profile template object.

To assign permissions on a profile template

1. Log on to a Windows Server 2003 computer as a domain administrator.

2. Open the MMC for ILM CMS that you created earlier.

   If you did not create the MMC, you can use Active Directory Sites and Services to edit the CLM profile template.

3. On the View menu, click Show Services Node.

4. In the console tree, expand Active Directory Sites and Services, expand Services, and then expand Public Key Services.

5. In the console tree, click Profile Templates.

6. In the details pane, right-click the profile template that you want to edit, and then click Properties.

7. In the [Profile Template Name] Properties dialog box, click the Security tab.

8. Select the user or group that you want to configure permissions for, and then apply the permission. When you are finished, click OK.

Configuring a Profile Template for Software-Based Certificates

After you create a profile template, you must configure its general settings and management policies. The default view of the Edit Profile Template page is Profile Details, as indicated in the navigation area on the left side of the page. Table 2 shows the sections in this view of the Edit Profile Template page.

Table 2   Sections in the Profile Details view of the Edit Profile Template page

The following topics describe how you can configure these settings for software-based certificate profiles. For information about configuring smart card profile templates, see Configuring a Profile Template for Software-Based Certificates.

General settings: software-based certificate profile templates

After you create a profile template for software-based certificates, you must configure its general settings.

To configure general settings for a profile template

1. Log on to ILM CMS as an administrator.

2. On the Home page, in Administration, click Manage profile templates.

3. In Profile Template List, click the name of the profile template that you want to edit.

4. On the Edit Profile Template page, click Change general settings.

5. Under General Settings, there are four sections that have settings you can configure.

   Table 3 shows these sections and their settings.

Table 3   General settings for software-based certificate profiles

Certificate templates: software-based certificate profile templates

On the Edit Profile Template page, you can use the Certificate Templates section to assign certificate templates to a profile template. Each profile template must have at least one certificate template associated with it.

If you copied a profile template that already had certificate templates associated with it, those certificate templates are listed in the new profile template.

To assign certificate templates to a profile template

1. On the Edit Profile page, in Certificate Templates, click Add new certificate template.

2. Configure the general options for the certificate templates that you want to add.

   Table 4 shows these options.

3. In Certificate Authorities, select a CA from the list of all available CAs.

4. In Certificate Templates, select certificate templates that you want to add to the profile template.

   Certificate Templates lists all certificate templates published by the selected CA.

5. To add certificate templates from a different CA, repeat steps 3 and 4 of this procedure.

6. Click Add.

Table 4   General options for software certificate templates

To delete certificate templates from a profile template

1. On the Edit Profile page, in Certificate Templates, select the certificate templates that you want to delete.

2. Click Delete selected certificate templates.

Management policies: software-based certificate profile templates

Each CLM profile template contains a group of configurable management policies. These policies define the workflow, data collection, and principals who participate in the certificate management process for that profile template. Table 5 shows these options.

Table 5   Management policy options

To access management policies for a profile template

1. Log on to ILM CMS as an administrator.

2. On the Home page, in Administration, click Manage profile templates.

3. On the Profile Template Management page, click the link for the profile template that has the policy you want to access.

4. Under Select a view, click the link for the policy that you want to access.

All management policies associated with a profile template are listed under Select a view. Table 6 shows these policies.

Table 6   Management policies for software-based certificate profiles

Management policy workflows: software-based certificate profile templates

Each management policy has settings that you can configure to define the workflow for that policy. Each policy has general settings, such as whether the policy is enabled and whether an enrollment agent is required. In addition, depending on how you configure the general settings, you might have specific workflow settings, such as who can initiate and approve requests, and what data items ILM CMS collects. The following topics describe specific management policy workflow settings and are titled to match the text displayed in the management policy.

Workflow: General

Each management policy has several general workflow settings. Table 7 shows these settings. However, no management policy has all of these settings; the available settings vary from policy to policy.

Table 7   General workflow settings

Workflow: Initiate [Policy Name] Requests

This setting is available for the following policies:

• Duplicate

• Enroll

• Online Update

• Recover

• Recover on Behalf

• Renew

• Suspend and Reinstate

• Revoke

You can use this setting to allow a user other than the user needing a certificate to initiate a request. For example, you can allow help desk personnel to initiate a recover request for a certificate when a subscriber phones the help desk.

A request initiator can be a user or a group. A group must be global or universal because the CLM server only resolves global and universal group memberships, not domain local group memberships.

To initiate Enroll, Renew, or Online Update requests, the user or group must be assigned Read permission and CLM Request Enroll permission on the profile template object. If the request is initiated by a user other than the subscriber, the initiator must be assigned Read permission and any necessary ILM CMS permissions. The permissions must be assigned at the service connection point and on the subscriber or a group that contains the subscriber.

To configure which users or groups can initiate requests

1. On the Edit Profile Template page, in Workflow: Initiate [Policy] Requests, click Add new principal for [policy] request initiation.

2. In Permission, type the name of the new principal (user or group), and then select the permission that you want.

   You can click Lookup in Active Directory to search for users or groups.

3. Click OK.

Workflow: Approve [Policy Name] Requests

The Approve Requests policy setting is available for the following policies:

• Duplicate

• Enroll

• Online Update

• Recover

• Recover on Behalf

• Renew

• Suspend and Reinstate

• Revoke

If you configure general workflow settings for a management policy to require one or more approvals, you must designate one or more groups to approve pending requests. Requests remain in a pending state until ILM CMS collets the required number of approvals for those requests.

If a request requires only one approval, and a user has permission both to initiate and approve a request, the approval takes place automatically. If you do not designate a user or group to approve requests, the CLM agent account approves the requests.

To configure which users or groups can approve requests

1. On the Edit Profile Template page, in Workflow: Approve [Policy] Requests, click Add new principal for [policy] request approval.

2. In Permission, type the name of the new principal (user or group), and then select the permission that you want.

   You can click Lookup in Active Directory to search for users or groups.

3. Click OK.

Workflow: Enroll Agent for [Policy Name]

The Enroll Agent for [Policy Name] policy setting is available for the following policies:

• Duplicate

• Enroll

• Recover

• Recover on Behalf

• Renew

If you configure general workflow settings for a management policy to require an enrollment agent, the designated enrollment agent submits the request to the CLM server for another user. The CLM server uses the certificate of the CLM Enrollment Agent to sign the certificate request. ILM CMS can then place the name information for the designated subscriber in the subject field for the issued certificate.

An enrollment agent can be a user or a group. A group must be global or universal because the CLM server resolves only global and universal group memberships, not domain local group memberships.

If initiating Enroll or Renew requests, both the subscriber and the enrollment agent accounts must be assigned Read permission and CLM Request Enroll permission on the profile template object. The enrollment agent must be assigned Read permission, CLM Enrollment Agent permission, and CLM Request Enroll permission. The permissions must be assigned at the service connection point and on the subscriber or a group that contains the subscriber.

To specify an enrollment agent for requests

1. On the Edit Profile Template page, in the Workflow: Enroll Agent for Duplicate Requests section, click Add new principal for enrollment agent.

2. In Permission, type the name of the new principal (user or group), and then select the permission that you want.

   You can click Lookup in Active Directory to search for users or groups.

3. Click OK.

Workflow: Revocation Settings

Revocation policy settings are available for the following policies:

• Recover

• Renew

• Suspend and Reinstate

• Revoke

You must define Revocation policy settings for a management policy that recovers, revokes, disables, retires, reinstates, or replaces an existing certificate. The Revocation policy settings in a management policy only affect the primary profile template. If duplicates of the profile exist, the Revocation policy settings do not affect the duplicate profile templates.

To configure Revocation policy settings

1. On the Edit Profile Template page, in Workflow: Revocation Settings, click Change revocation settings.

2. In Workflow Options for Revocation, configure the Revocation policy settings, and then click OK.

   Table 8 shows these settings.

Table 8   Revocation policy settings

Workflow: Duplicate Revocation Settings

Duplicate Revocation policy settings are available for the Recover policy. These policy settings are similar to Revocation policy settings in that they define the type of revocation that takes place when a management policy executes. However, duplicate revocation settings define the Revocation policy only for duplicate profiles, not for the primary profile on which the duplicates are based.

To configure Duplicate Revocation policy settings

1. On the Edit Profile Template page, in Workflow: Duplicate Revocation Settings, click Change duplicate revocation settings.

2. In Workflow Options for Duplicate Revocation, configure the Revocation policy settings, and then click OK.

   Table 9 shows these settings.

Table 9   Duplicate Revocation policy settings

Workflow: Settings for the [Revocation Reason] Reason

These settings are available for the Online Update policy. The Online Update policy provides settings for three categories of certificate updates. Table 10 shows these settings.

Table 10   Online Update setting categories

You can configure Revocation policy settings for all three of these update categories. In addition, for updates involving certificate content changes or certificate expiration, you can specify whether to revoke archived certificates, if your profile template contains archived certificates. And, for certificate content change updates, you can choose whether to update all certificates or allow the request initiator to select a certificate.

To configure Online Update policy settings

1. On the Edit Profile Template page, select the appropriate update workflow category, and then click Change revocation settings.

   Available categories are Certificate Content Change, Certificate Template List Change, or Certificate Expiry.

2. Configure the settings for the selected update category, and then click OK.

   Table 11 shows these settings.

Table 11   Revocation policy settings for online updates

Data Collection

You can configure each management policy in a profile template to collect required data items from either the subscriber or the ILM CMS manager. For example, to document that photo identification for an employee has been verified, you can configure a management policy to require that the certificate manager submit two data collection items: the form of identification, such as a driver’s license, and an identifying characteristic, such as the license number.

To configure Data Collection policy settings

1. On the Edit Profile Template page, in Data Collection, click Add new data collection item.

2. On the data collection page that opens, configure the policy settings for each data item.

   Table 12 shows these settings.

Table 12   Data collection policy settings

ILM CMS uses regular expressions for data item validation. A regular expression is a text pattern that consists of ordinary characters, such as the letters A through Z, and special characters, which are known as metacharacters. The pattern describes one or more strings to match when searching text. For more information on regular expressions used by ILM CMS, see Appendix B: Regular Expressions.

One-Time Passwords

You can configure each management policy in a profile template to require that a subscriber provide a one-time password to complete a request. You can require up to two passwords, which you can use the ILM CMS default password provider or a custom provider to generate.

To configure one-time passwords

1. On the Edit Profile Template page, in One-Time Passwords, click Change password provider settings.

2. In Password Provider, select and configure one of the options.

   Table 13 shows these options.

Table 13   Password provider options

To customize the default password provider

1. On the Edit Profile Template page, in One-Time Passwords, click Change password provider settings.

2. In Password Provider, select and configure one of the options.

3. For Password provider type, type Microsoft.CLME2.BusinessLayer.DefaultSecretProvider.

4. For Password provider data, type the string corresponding to one of the rules shown in Table 14.

Table 14   Custom password settings

Passwords Distribution

ILM CMS can display a one-time password on the computer screen for the user, send the passwords in e-mail, or not distributed the password at all.

To configure one-time password distribution methods

1. On the Edit Profile Template page, in Passwords Distribution, click the distribution method that you want.

   The default method for new passwords is Display on screen.

2. In One-Time Password Distribution, in Distribution method, select a method.

   Table 15 shows these methods.

3. If you select an e-mail option, in From, type the account or user name that you want, create the e-mail subject line, and then create the message text.

   Table 16 shows the dynamic text fields that you can use to insert dynamic text from ILM CMS and Active Directory into the message.

Table 15   One-time password distribution methods

Table 16   Dynamic e-mail fields

If you give a user a URL that opens the one-time password page in the subscriber view of the CLM Web site, you can configure the URL so that the page displays the correct number of text boxes for entering one-time passwords. (The default view has two text boxes.) To change the number of text boxes that ILM CMS displays, you add the following HTML query to the end of the one-time password page URL:

https://www.contoso.com/clm/content/sm/auth/Authorization.aspx?PasswordCount=1

The PasswordCount value determines the number of text boxes that ILM CMS displays. Supported values are 1 and 2.

Document Printing

As part of the workflow for a specific policy, ILM CMS might have to distribute printed instructions to a user. ILM CMS can print these documents from the CLM server or from a client computer as part of the workflow. PIN cover letters, which include the PIN and instructions for using it, are typically printed from the server. Other documents, such as confirmation letters and instructions for installing the Microsoft Certificate Lifecycle Manager Client, are often printed from client computers.

For more information about document printing, see Appendix C: Document Printing.

To configure document printing

1. On the Edit Profile Template page, in Document Printing, click Add new document to be printed.

2. In Printed Document Information, type a name for the document that you want to print.

   Use a friendly name that a user can understand easily.

3. Type a description that a user will see for the document that you want to print. Type the full path to the document template.

4. Type the Multipurpose Internet Mail Extension (MIME) type for the document.

5. In Document Print Location, click Print on Client or Print on Server.

Configuring a Profile Template for Smart Card Certificates

As with profiles for software-based certificates, after you create a smart card profile template, you must configure its general settings and management policies. The default view of the Edit Profile Template page is Profile Details, as indicated in the navigation area. Table 17 shows the sections that are available in this view of the Edit Profile Template page.

Table 17    Smart card profile template sections

The following topics describe how to configure these settings for smart card certificate profiles. For more information about configuring software-based certificate profiles, see Configuring a Profile Template for Software-Based Certificates.

General settings: smart card profile templates

To configure general settings for smart card profile templates

1. To configure settings in General Settings of the Edit Profile Template page, click Change general settings.

2. Under General Settings, configure settings for the profile template.

   There are four sections that have settings than an administrator can configure. Table 18 shows these settings.

Table 18   General settings for smart card profile templates

Certificate templates: smart card profile templates

On the Edit Profile Template page, you can assign certificate templates to a profile template in the Certificate Templates section. Each profile template must have at least one certificate template associated with it.

If you copy a profile template that has certificate templates associated with it already, ILM CMS lists those certificate templates in the new profile template.

To assign certificate templates to a profile template

1. On the Edit Profile page, in Certificate Templates, click Add new certificate template.

2. Configure the general options for the certificate templates that you want to add.

   Table 19 shows the options.

3. In Certificate Authorities, select a CA from the list of all available CAs.

4. In Certificate Templates, select certificate templates that you want to add to the profile template.

   Certificate Templates lists all certificate templates published by the selected CA.

5. To add certificate templates from a different CA, repeat steps 3 and 4 of this procedure.

6. Click Add.

Table 19   General options for smart card certificate templates

To delete certificate templates from a profile template

1. On the Edit Profile page, in Certificate Templates, select the certificate templates that you want to delete.

2. Click Delete selected certificate templates.

Smart card configuration settings

To change smart card settings for a profile template

• On the Profile Details page, in Smart Card Configuration, click Change settings to modify the smart card settings for the profile template.

  Table 20 shows these options.

Table 20   Smart card configuration settings (grouped by section)

To enable administrator key diversification for a smart card profile template

1. On the Profile Template Management page, click a smart card profile template to manage.

2. On Edit Profile Template page, under Smart Card Configuration, click Change settings.

3. Under Microsoft Smart Card Base CSP, select the Diversify Admin Key check box, and then type an initial administrator key value in Admin key initial value (hex).

4. Select the Default option for Smart Card Initialization Provider, and then enter the certificate thumbprint of the certificate that you want to use to create a hash value for the new administrator key.

   The certificate that you use to diversify the admin key must support SHA-256.

If you are using a hardware security module (HSM) to protect keys on your CA, you must modify the default CSP data for the certificate template.

To enable administrator key diversification using an HSM

1. Log on to the CA as a user with the Manage CA permission.

2. Click Start, click Run, type mmc, and then click OK.

3. In the console tree, click Certificate Templates.

4. In the details pane, right-click the CLM Agent user account certificate template, and then click Duplicate Template.

   The default certificate template for the CLM Agent user account is User.

   Note

   We recommend that you provide a user friendly name for this certificate that will make it easy to identify it for use with an HSM.

5. Right-click the duplicate certificate template and then click Properties.

6. In the Properties dialog box, click the Request Handling tab, and then click CSPs.

7. In the CSP Selection dialog box, clear the check box for the HSM CSP, select the Microsoft Enhanced RSA and AES Cryptographic Provider check box, and then click OK.

8. Click the General tab, select the Publish certificate in Active Directory check box, and then click OK.

9. Log off the CA.

10. Log on to a CLM server with the CLM Agent user account.

11. Click Start, click Run, type mmc, and then click OK.

12. In the File menu, click Add/Remove Snap-in.

13. In the Add/Remove Snap-in dialog box, click Add.

14. In the Add Standalone Snap-in dialog box, click Certificates, and then click Add.

15. On the Certificates snap-in page, select My user account, and then click Finish.

16. In the Add Standalone Snap-in dialog box, click Close.

17. In the Add/Remove snap-in dialog box, click OK.

18. In the console tree, expand Certificates - Current User, and then expand Personal.

19. Right-click Certificates, point to All Tasks, and then click Request New Certificate.

20. On the Welcome to the Certificate Request Wizard page, click Next.

21. On the Certificate Types page, click User, select the Advanced check box, and then click Next.

22. On the Cryptographic Service Provider page, select Microsoft Enhanced RSA and AES Cryptographic Provider, and then click Next.

23. On the Certification Authority page, click Next.

24. On the Certificate Friendly Name and Description page, type a friendly name and description, and then click Next.

25. On the Completing the Certificate Request Wizard page, click Finish.

26. In the details pane, double-click the new certificate, and then click the Details tab.

27. On the Details tab, scroll through the available fields, click Thumbprint, and then click Copy to File or note the certificate thumbprint on paper for later use.

28. Log on to CLM as an administrator.

29. On the Home page, under Administration, click Manage profile templates.

30. On the Profile Template Management page, click a smart card profile template to manage.

31. On Edit Profile Template page, under Smart Card Configuration, click Change settings.

32. Under Microsoft Smart Card Base CSP, select the Diversify Admin Key check box, and then type an initial administrator key value in Admin key initial value (hex).

33. Select the Default option for Smart Card Initialization Provider, and then type the certificate thumbprint that you noted earlier in this procedure.

    The certificate that you use to diversify the admin key must support SHA-256.

Management policies: smart card profile templates

Each CLM profile template contains a group of management policies that you can configure. These policies define the workflow and data collection for that profile template, and the principals who participate in its certificate management process.

To access management policies for smart card profile templates

1. Log on to ILM CMS as an administrator.

2. On the Home page, in Administration, click Manage profile templates.

3. On the Profile Template Management page, click the link for the profile template that has the policy that you want to access.

4. Under Select a view, click the link for the policy that you want to access.

   All management policies associated with a profile template are listed under Select a view.

Smart card profile templates include the same management policies that are available for software-based certificate profiles:

• Duplicate

• Enroll

• Online Update

• Recover on Behalf

• Renew

• Suspend and Reinstate

For information about these six policies and their workflow settings, see Management policies: software-based certificate profile templates.

In addition, ILM CMS has the following additional management policies unique to smart card profiles:

• Replace

• Disable

• Retire

• Temporary Cards

• Unblock

• Offline Unblock

Table 21 shows these policies.

Table 21   Management policies specific to smart card profile templates

Management policy workflows: smart card profile templates

As with profile templates for software-based certificates, each management policy in a smart card profile template has settings that you can configure to define the workflow for that policy. Most policy workflow settings for smart card profile templates are identical to those for software-based certificates. For more information, see Management Policy Workflows: software-based certificate profile templates.

The following topics describe the management policy workflow settings that are unique to smart card profiles.

Workflow: Smart Card Application Management

Smart cards might include applications in the form of Java applications, such as an application that maintains a credit balance for buying food at a company cafeteria. You can configure ILM CMS to manage smart card applications at the policy level in smart card profile templates. If you add a new application to a smart card or change an existing application, the Online Updates policy allows you to update or/add the smart card application.

To configure smart card application management

1. On the specific management policy name, under Workflow: Smart Card Application Management, click Change smart card application management settings.

2. To enable smart card application management, select the Enable personalization check box.

3. Type the path to the smart card application management profile file.

4. This file must be a valid XML file with the smart card application management settings. Smart card application management runs as part of the policy workflow, and it integrates into the workflow before ILM CMS invokes the Certificate Lifecycle Manager Client.

Temporary smart cards policy settings

The Temporary Cards policy has several general workflow settings unique to that policy. Table 22 shows these settings.

Table 22   Temporary Cards policy workflow settings

Workflow: Unblock Agent for Offline Unblock Requests

The offline unblock policy requires a certificate manager or help desk operator assistance to be performed. In this section you configure which users and groups can assist the user in performing the operation. The users configured in this section will obtain the challenge characters from the end-user and enter them into the system. The system will compute the challenge response which the operator will communicate back to the end-user.

To configure unblock agent for offline unblock requests

1. On the specific management policy name, under Workflow: Unblock Agent for Offline Unblock Requests, click Add new principal for unblock agent.

2. In Permission, type the name of the new principal (user or group), and then select the permission that you want.

   You can click Lookup in Active Directory to search for users or groups.

3. Click OK.

Appendix A: Certificate Template Configuration

Appendix A describes certificate template settings in the Certificate Templates MMC that are relevant to ILM CMS. Each of the headings in this section detail tabs in the Properties page for a certificate template. This appendix does not detail how to configure information in the Properties tab.

Request Handling tab

You can view Request Handling tab in the Certificate Templates MMC.

To view the Request Handling tab

1. In Certificate Templates, right-click a certificate template and select Properties.

2. In *[TemplateName]*Properties, click the Request Handling tab.

Delete revoked or expired certificates (do not archive) setting

If you enable the Delete Revoked or Expired Certificates (do not archive) setting for a smart card certificate template that is managed by ILM CMS, the Certificate Lifecycle Manager Client deletes any revoked or expired certificates that ILM CMS issued using that template. Enabling this setting ensures that profiles managed by ILM CMS maintain only a valid set of authentication certificates. This minimizes the amount of smart card memory required by profiles.

CSPs setting

When you use ILM CMS to issue certificates for smart cards, ILM CMS ignores the selected CSPs and uses the CLM profile template configuration instead. As a result, you do not have to install the smart card CSP on the CA in order to issue smart card certificates in ILM CMS.

Subject Name tab

You can view the Subject Name tab in the Certificate Templates MMC.

To view the Subject Name tab

1. In Certificate Templates, right-click a certificate template and select Properties.

2. In *[TemplateName]*Properties, click the Subject Name tab.

Supply in the request setting

By default, ILM CMS does not supply the subject name in the certificate request. Do not use the Supply in Request setting unless you enable the Show advanced options setting in the Certificate Templates section of the profile template.

Build from this Active Directory information setting

The Build from this Active Directory information setting has two options.

Subject name format setting

When you use the CLM Subject Name Policy Module plug-in, we recommend that you configure the value for Subject Name Format to None. When this value is configured as None, ILM CMS does not generate unexpected subject name formats in issued certificates. Setting this value to None gives subject name control to the CLM Subject Name Policy Module plug-in.

Include this information in alternate subject name setting

The value for the Include this information in alternate subject name setting, which is called the Subject Alternative Name in the CLM Web site, has no direct effect on ILM CMS functionality. However, certificates issued through ILM CMS must adhere to the subject name requirements specified in the certificate template. As a result, if data needed to comply with subject name requirements is not present in Active Directory when ILM CMS issues a certificate, ILM CMS returns an error raised by the CA. You commonly encounter this error when you use the SubjectAltName parameter to store an e-mail address for a user, and when the subject name data is not provisioned with Active Directory.

Issuance Requirements tab

You can view the Issuance Requirements tab in the Certificate Templates MMC.

To view the Issuance Requirements tab

1. In Certificate Templates, right-click a certificate template and select Properties.

2. In *[TemplateName]*Properties, click the Issuance Requirements tab.

CA certificate manager approval setting

You can specify whether a CA certificate manager's approval is required for a certificate template in ILM CMS. However, ILM CMS does not support certificate templates that require additional CA certificate manager approval, which is configured on the Issuance Requirements tab. Because ILM CMS does not support additional CA certificate manager approval, do not enforce it on the certificate template.

This number of authorized signatures setting

When you use an enrollment agent in ILM CMS, you should configure the This number of authorized signatures setting to 1. When you configure the number of signatures to 1, you must also configure the policy type and application policy. Configure the Policy type required in signature setting to Application policy. Configure the Application policy setting to Certificate Request Agent.

If you do not configure the This number of authorized signatures setting to 1, all certificates issued using an enrollment agent have the subject name of the enrollment agent.

Appendix B: Regular Expressions

ILM CMS uses regular expressions to validate data. A regular expression is a text pattern consisting of ordinary characters, for example, the letters A through Z, and special characters known as metacharacters. The pattern describes one or more strings to match when searching text.

Table 23 shows examples of regular expressions. Table 24 shows the metacharacters available in ILM CMS.

Table 23   Regular expression examples

Table 24   Regular expression metacharacters available CLM 2007

Appendix C: Document Printing

As part of the workflow for a specific policy, ILM CMS might have to distribute printed instructions to the user. ILM CMS can print these documents from the CLM server or from a client computer as part of the workflow. PIN cover letters, which include the PIN and instructions for using it, are typically printed from the server. Other documents, such as confirmation letters and instructions for installing the Certificate Lifecycle Manager Client, are often printed from client computers.

The following topics describe document printing in ILM CMS:

• Document printing requirements

• Creating a document

• Configuring a profile template for document printing

• Automated server printing

• E-mail distribution attributes

Document printing requirements

Printing documents from the CLM server has the following requirements:

• You must install and register Microsoft Office Word 2003 on the CLM server.

• You must make Word 2003 available to CLM Agent (CLMAgent).

  Note

  CLMAgent is a software agent that is created during a default installation of ILM CMS. CLMAgent conducts operations for the ILM CMS that require specific permissions. ILM CMS uses this agent's certificate to sign data.

• You must install a printer and make it available to CLMAgent from the CLM server. This can be a local or network printer.

• You must assign Launch permissions to CLMAgent for Word 2003 documents in the DCOM object configuration at the CLM server.

• You must assign Read permissions to CLMAgent for the Program Files\Microsoft Certificate Lifecycle Manager\Print Documents folder.

To configure document printing permissions

1. Log on to the CLM server as the CLMAgent.

2. In Word 2003, test printing a document.

3. Log off from the CLM server.

4. Log on to the CLM server as a system administrator, click Start, click Run, type dcomcnfg, and then click OK.

5. In the Component Services console tree, expand Component Services, expand Computers, expand My Computer, and then expand DCOM Config.

6. In the console tree, right-click Microsoft Word Document, and then click Properties.

7. On the Security tab, under Launch Permissions, click Customize, and then click Edit.

8. On the Security page, click Add, select CLMAgent, and then click OK.

9. On the Security page, ensure that the Local Launch and Local Activation permissions for CLMAgent are both configured to Allow, and then click OK.

10. On the Security tab, under Access Permissions, click Customize, and then click Edit.

11. Select CLMAgent, and then ensure that the Local Access permission is configured to Allow.

12. Click OK to save your changes.

13. On the Identity tab, select This user.

14. In User, type CLMAgent.

15. Type the CLMAgent password, and then type it again to confirm it.

16. Click OK to exit and save the Word 2003 document properties.

17. Close the Component Services console.

Creating a document

You can use the following procedure to create ILM CMS policy workflow documents.

To create a document to print as part of a policy workflow

1. Use Notepad to compose the document.

   Table 25 shows the fields to use to map to dynamic data.

2. In Notepad, copy the contents of the document, and then paste it into Word 2003.

3. Save the Word 2003 document, in HTML (.htm) format, to the Print Documents folder at the following location: %ProgramFiles%\Microsoft Certificate Lifecycle Manager\Print Documents.

Table 25   Dynamic fields for CLM 2007 policy workflow documents

Configuring a profile template for document printing

After you create a document, you must configure the CLM profile template to print it.

To configure a profile template for document printing

1. Log on to ILM CMS as an administrator.

2. On the Home page, in Administration, click Manage profile templates.

3. On the Profile Template Management page, click the link for the profile template that you want to configure for document printing.

4. Under Select a view, click the policy you want to configure.

5. On the Edit Profile Template page, in Document Printing, click Add new documents to print.

6. In Printed Document Information, configure the document printing settings.

   Table 26 shows these settings.

7. Choose whether to print the document at the server or at a client computer and click OK.

Table 26   Document printing settings

Automated server printing

ILM CMS prints documents from the CLM server automatically, if you configure the profile template for server printing, and if the following conditions are met:

• Server printing is configured

• The request initiator is the executor of the request

• The number of approvals is configured to 0 (zero)

• The request type is one of the following:

  • Suspend/reinstate

  • Disable/revoke

  • Retire

  You must configure all of the following settings to Off: erase user data, block user PIN, block admin PIN, reset admin PIN).

E-mail distribution attributes

For workflows involving e-mail distribution, ILM CMS permits the use of specific fields that map to dynamic data. Table 27 shows these fields.

Table 27   E-mail dynamic fields

Appendix D: Smart Card Printing

ILM CMS supports smart card printing. Smart card printing requires a smart card printing station that is equipped with a smart card printer that is compatible with ILM CMS. It also requires you to install prerequisite software.

The following topics describe smart card printing:

• Smart card printing requirements

• Enabling interaction between CLM 2007 and ID Works

• Defining smart card layout and contents

• Configuring a profile template for smart card printing

Smart card printing requirements

Table 28 lists the smart card printers that ILM CMS supports.

Table 28   Supported smart card printers

To enable smart card printing from a Microsoft Windows® XP operating system or Windows Server 2003 smart card printing station, you must install prerequisite software. Table 29 lists these prerequisites.

Table 29   Prerequisite software for smart card printing

Enabling interaction between CLM 2007 and ID Works

After you install ID Works, you configure the software to enable interaction between ILM CMS and ID Works.

To enable interaction between CLM 2007 and ID Works

1. Install the smart card printer driver.

   This driver allows Microsoft Windows to interact with the smart card printer.

2. Install the Bulk Smart Card Issuance Tool.

   Bulk Smart Card Issuance registers a custom dynamic-link library (DLL) that allows ILM CMS to pass smart card field mappings to ID Works. ID Works uses these mappings to include data on printed smart cards.

3. In ID Works Enterprise Administrator, enable Printer Plug-ins.

4. To enable the correct printer plug-ins to allow the custom ILM CMS DLL to interact with ID Works, follow these steps:

   • In ID Works Enterprise Administrator, on the Printing menu, click Assign Printer Plug-ins.

   • In Installed Printer Name, click Smart Driver.

   • In Printer Plug-in Name, click DataCard ImageCard Select/IV Plug-in.

5. On the local drive for the smart card printing station, create a project folder for smart card layouts. A typical path for this folder is %ProgramFiles%\Datacard\ID WORKS\Projects.

Defining smart card layout and contents

After you configure the interaction between ILM CMS and ID Works, you can use ID Works Enterprise Designer to define the smart card layout and contents. This requires you to map the attributes you want from the Active Directory and CLM databases to the corresponding variables in ID Works Enterprise Designer. Table 30 shows the ILM CMS and Active Directory field mapping tags for smart card printing. All of the fields in the table correspond to Active Directory attributes, except SCSerialNumber, SCPIN, and SCSequence.

Table 30   CLM 2007 and Active Directory fields

Serial:{SCSerialNumber}

The variable names used in ID Works are not predefined. You can choose any name for a variable, as long as you use that name, matching the case, in the smart card layout definition. If the smart card design requires multiple field mappings, separate the fields using semicolons.

After you have defined the smart card layout and, you save the resulting file to the smart card layout projects folder on the smart card printing station.

Configuring a profile template for smart card printing

After you define the smart card layout and contents using ID Works, you configure the CLM profile template to print it.

To configure a profile template for smart card printing

1. Log on to ILM CMS as an administrator.

2. On the Home page, in Administration, click Manage profile templates.

3. On the Profile Template Management page, click the link for the profile template that you want to modify for smart card printing.

4. On the Edit Profile Template page, in Smart Card Configuration, click Change settings.

5. In Printing, select the Print smart card check box.

6. For Print project name, type the name of the project file that you used when you saved the file in ID Works Enterprise Designer.

7. In Card name, type the name of the smart card definition that you used in the ID Works project file, for example, Employee.

   The smart card name defines the layout of the printed smart card.

8. In Print project field mapping, type the field names that you used in ID Works Enterprise Designer, and then click OK.

Appendix E: Assigning Approval Permissions Using Active Directory Permissions

You can optionally enable that users who are managers can be assigned Approval permissions for their employees.

Managers (as defined by the Active Directory Manager attribute) can be assigned approval permissions for all requests originated by their employees.

You can enable this permission by modifying the <add key="Clm.RequestSecurity.ManagerCanApprove" value="false" /> value in the Web.config file. If you change this value to true, you will enable this functionality for all new requests.