10.6. Registering Custom Authentication Plug-ins
10.6. Registering Custom Authentication Plug-ins Custom authentication plug-in modules can be registered through the CA Console. Authentication plug-in modules can also be deleted through the CA Console. Before deleting a module, delete instances that are based on that module. Note For writing custom plug-ins, refer to the Authentication Plug-in Tutorial . Create the custom authentication class. For this example, the custom authentication plug-in is called UidPwdDirAuthenticationTestms.java . Compile the new class. Create a directory in the CA's WEB-INF web directory to hold the custom classes, so that the CA can access them for the enrollment forms. Copy the new plug-in files into the new classes directory, and set the owner to the Certificate System system user ( pkiuser ). Log into the console. Register the plug-in. In the Configuration tab, click Authentication in the navigation tree. In the right pane, click the Authentication Plug-in Registration tab. The tab lists modules that are already registered. To register a plug-in, click Register . The Register Authentication Plug-in Implementation window appears. Specify which module to register by filling in the two fields: Plugin name. The name for the module. Class name. The full name of the class for this module. This is the path to the implementing Java TM class. If this class is part of a package, include the package name. For example, to register a class named customAuth in a package named com.customplugins , the class name is com.customplugins.customAuth . After registering the module, add the module as an active authentication instance. In the Configuration tab, click Authentication in the navigation tree. In the right pane, click the Authentication Instance tab. Click Add . Select the custom module, UidPwdDirAuthenticationTestms.java , from the list to add the module. Fill in the appropriate configuration for the module. Note pkiconsole is being deprecated. Create a new end-entity enrollment form to use the new authentication module. Add the new profile to the CA's CS.cfg file. Note Back up the CS.cfg file before editing it. Restart the CA.
javac -d . -classpath USDCLASSPATH UidPwdDirAuthenticationTestms.java mkdir /usr/share/pki/ca/webapps/ca/WEB-INF/classes cp -pr com /usr/share/pki/ca/webapps/ca/WEB-INF/classes chown -R pkiuser:pkiuser /usr/share/pki/ca/webapps/ca/WEB-INF/classes pkiconsole https://server.example.com:8443/ca cd /var/lib/pki/pki-tomcat/ca/profiles/ca cp -p caDirUserCert.cfg caDirUserCertTestms.cfg vi caDirUserCertTestms.cfg desc=Test ms - This certificate profile is for enrolling user certificates with directory-based authentication. visible=true enable=true enableBy=admin name=Test ms - Directory-Authenticated User Dual-Use Certificate Enrollment auth.instance_id=testms vim /var/lib/pki/ instance-name /ca/conf/CS.cfg profile.list=caUserCert,caDualCert,caSignedLogCert,caTPSCert,caRARouterCert,caRouterCert,caServerCert,caOtherCert,caCACert,caInstallCACert,caRACert,caOCSPCert,caTransportCert,caDirUserCert,caAgentServerCert,caAgentFileSigning,caCMCUserCert,caFullCMCUserCert,caSimpleCMCUserCert,caTokenDeviceKeyEnrollment,caTokenUserEncryptionKeyEnrollment,caTokenUserSigningKeyEnrollment,caTempTokenDeviceKeyEnrollment,caTempTokenUserEncryptionKeyEnrollment,caTempTokenUserSigningKeyEnrollment,caAdminCert,caInternalAuthServerCert,caInternalAuthTransportCert,caInternalAuthKRAstorageCert,caInternalAuthSubsystemCert,caInternalAuthOCSPCert,DomainController, caDirUserCertTestms profile.caDirUserCertTestms.class_id=caEnrollImpl profile.caDirUserCertTestms.config=/var/lib/pki/pki-tomcat/ca/profiles/ca/caDirUserCertTestms.cfg pki-server restart instance_name