User manual REDHAT CERTIFICATE SYSTEM ENTERPRISE SECURITY GUIDE

[. . . ] Red Hat Certificate System Enterprise Security Client Guide Red Hat Author(s): Red Hat, Inc. ISBN: N/A Publication date: Red Hat Certificate System Enterprise Security Client Guide Red Hat Certificate System Enterprise Security Client Guide: Copyright © 2006 Red Hat, Inc. All rights reserved. This material may be distributed only subject to the terms and conditions set forth in the Open Publication License, V1. 0. A copy of this license is available at http://www. opencontent. org/openpub1. Any Red Hat trademarks that are incorporated in the documentation are not subject to the Open Publication License and may only be used or replicated with the express permission of Red Hat, Inc. 1 http://www. opencontent. org/openpub Red Hat Certificate System Enterprise Security Client Guide 1. [. . . ] Assuming that the smart card being enrolled is uninitialized and the appropriate Phone Home information has been configured, the user's enrollment process is as follows: 1. The Enterprise Security Client is running. An uninitialized smart card, pre-formatted with the Phone Home information for the TPS and enrollment interface URL for the user's organization, is inserted. The smart card can be added either by placing a USB form factor smart card into a free USB slot or by inserting a 25 Chapter 4. Using the Enterprise Security Client traditional full-sized smart card into a smart card reader. When the system recognizes the smart card, it displays a message indicating it has detected an uninitiated smart card. Figure 4. 2. Smart Card Enrollment with a Card This screen gives the option either to close the dialog or to proceed with enrolling the smart card. If the card be removed, a message appears that the smart card is no longer detected. 26 Smart Card Auto Enrollment Figure 4. 3. Smart Card Enrollment Message When the Card Is Removed Reinserting the card brings the previous dialog back with the option to enroll the smart card. Click Enroll My Smart Card to continue with the enrollment process. Since the Enterprise Security Client now knows where the enrollment UI is located because of Phone Home, the enrollment form opens for the user to enter the required information. This UI can be customized. 27 Chapter 4. Using the Enterprise Security Client Figure 4. 4. This example is the default enrollment UI included with the TPS server. This UI is a standard HTML form, so simple modifications, such as setting the company logo or adding extra text or changing field text, is possible. The sample enrollment UI requires the following information for the TPS server to process the smart card enrollment operation: · LDAP User ID. This is the LDAP directory user ID of the user enrolling the smart card; this can also be a screen name or employee or customer ID number. This is the alpha-numeric password corresponding to the user ID entered; this can be a simple password or a customer number. 28 Smart Card Auto Enrollment NOTE The LDAP user ID and password refer to the fact that the TPS server is usually associated with a Directory Server which stores user information and to which the TPS refers to authenticate users. · Password. This sets the smart card's password, used to protect the card information. This confirms the smart card's password. Once the form is filled out, click Enroll My Smartcard to submit the information and enroll the card. When the enrollment process is complete, a message page opens which shows that the card was successfully enrolled and can offer custom instructions on using the newly-enrolled smart card. 29 Chapter 4. [. . . ] Find the new $Keychain entry in the list of valid chains. The chain has the the key's UID in its name. The certificates and keys on the token can easily be viewed. 3. Enterprise Security Client XUL and Javascript Functionality Enterprise Security Client stores the XUL markup and Javascript functionality in the ESC_INSTALL_PATH/chrome/content/esc directory, where ESC_INSTALL_PATH is the Enterprise Security Client installation directory. [. . . ]