Creating a service account for working with the user catalog and system data storage

For Indeed Certificate Manager system to operate properly, certain rights to access Active Directory objects and certification authorities are required. You can distribute the privileges between several accounts, or create one with maximum rights for system management, depending on the requirements of the company security policy.

Create a service account (say, servicecm) to perform data saving and reading operations in the Active Directory storage.

Configuring the user catalog in Active Directory

Grant the created service account (servicecm) the necessary permissions to work with the object (domains, containers, organizational unit) where the Indeed Certificate Manager users will be located. This account will be used to read and write user attributes.

To do this, do the following:

  1. Open Security property of the object (domain, container or unit) that contains the Indeed CM system users.
  2. Click Advanced. Click Add. Click Select a principal.
  3. In the Enter the object name to select text box, type service account (servicecm). Click OK.
  4. In the Applies to list box, select Descendant User objects.
  5. In the Permissions list, activate the Reset password checkbox.
  6. In the Properties list, set the Read all properties permission.
  7. In the Properties list, set the following permissions:
    • Write: pwdLastSet
    • Write: thumbnailPhoto or Write: jpegPhoto
    • Write: userAccountControl
  8. Click ОК and then Apply.

Set the same set of privileges for each object (domain, container or organizational unit) where Indeed CM users are located.

The permission to read all user properties is set for all domain accounts by default. If security policies prohibit reading of all user properties, then set the rights for the service account to read only required properties, according to the Table 3.

When configuring the permissions to read user properties different from default ones, it is also necessary to permit the service account (servicecm) to read the values of object attributes (i.e. Domain, container or organizational unit) that contains Indeed CM users. These attributes are: cn, objectGUID, name and showInAdvancedViewOnly.

LDAP Display Names are listed.

Granting access to the properties set increases the system performance significantly and also simplifies the security management (see Property Sets).

Table 3 – Attributes used by Indeed CM to work with user directory.

Attribute (LDAP Display Name)

Common Name

Commentary

c

Country/Region Abbreviation or Country/Region Name

Is a part of "Personal information" properties set.

cnCommon Name

Is a part of the "Public Information" properties set.

companyCompany

Is a part of the "Public Information" properties set.

departmentDepartment

Is a part of the "Public Information" properties set.

objectGUIDОbjectGUID

Is a part of the "Public Information" properties set.

givenNameGiven Name

Is a part of the "Public Information" properties set.

lLocality Name

Is a part of the "Personal Information" properties set.

mailE-mail Addresses

Is a part of the "Public Information" properties set.

managerManager

Is a part of the "Public Information" properties set.

sAMAccountNameSAM Account Name

Is a part of the "General Information" properties set.

snSurname

Is a part of the "Public Information" properties set.

st

State or Province Name

Is a part of the "Personal Information" properties set.

streetAddressAddress (или Street)

Is a part of the "Personal Information" properties set.

telephoneNumberTelephone Number

Is a part of the "Personal Information" properties set.

thumbnailPhoto

or jpegPhoto

Picture

Is a part of the "Personal Information" properties set.

userAccountControl

User Account Control

Is a part of "User Account Restrictions" properties set.

userPrincipalNameUser Principal Name

Is a part of the "Public Information" properties set.


  • No labels