Not able to Register and Certify User fom the WebAdmin

HCL Domino Domino Forum
1

Hi, i setted up the WebAdmin with the CA Process.After this i have migrated the cert.id to the CA Process.

So good, so fine.

Now, if i register a user from the WebAdmin - all OK.

But, if the user trys to access the server with the notes client and his id comes this message:

Server Error: Your certificate has not been signed by the Certificate Auhtority. Try again later.

???

I’ve tryed to recertify the user with the cert.id - after this the user can access the server…!?

HOW can i register the user from the WebAdmin without recertifying the User in the Adressbook?

thanks in advance for any help or an link wo a whitepaper

Volkan Senguel

2

Subject: Not able to Register and Certify User fom the WebAdmin

If you register a user thru the CA process, the CA certifier will sign the certificate and drop it back into the admin4.nsf. From there, the Adminp process will pick up the certificate and post it to the Domino directory. During the next authentication, the new certificate will be pulled into the users user.id file.

So, there could potentially be a delay for the certificate to be issued or a delay in adminp to update the Domino directory.

You should check whether the CA process is even running, and thus can issue certificates.

Is the certificate even issued ?

Has the adminp process posted the certificate to the person document yet ?

To speed things up, you could issue the server console command “TELL ADMINP PROCESS ALL”.

Otherwise, things go on schedule.

Thomas - IBM

3

Subject: RE: Not able to Register and Certify User fom the WebAdmin

Thanks Thomas for this info, but i have waited a few days (friday - monday) and the certficate was not issued.

I see in the admin4.nsf under Certification Authority Requests → Certificate Requests all the user where i have registered with the webadminlike this:

O=TAG/C=CH

Issued by Certification Authority

   03/11 02:07 CN=Test User/O=TAG/C=CH

   03/11 02:02 CN=Test User2/O=TAG/C=CH

More infos in the Process Doc:

Request State Information

Certificate Authority: O=TAG/C=CH

Request State: Issued by Certification Authority

Request Protocol: 0

Transaction ID:

Should de UserID be leaved in the Adressbook during the AdminP process is runing? / i have tryed both.

Or i can remove them from it? because we have no UserIDs in the Adressbook from the users.

Is there anywhere a Whitepaper for the WebAdmin or the CA Authority ?

Thanks Thomas for your response.

4

Subject: RE: Not able to Register and Certify User fom the WebAdmin

Volkan,

The following may help identifying problem :

(I am assuming the certificate has been issued already)

  • check your admin4 database for request “Recertify Person in Domino Directory” : this request is for posting the issued certificate to the person document in domino directory. Is the response document indicate a success ? if yes, procceed to next.

  • open the person document, exam the Notes certificate, is it there ? if yes, procceed to next.

  • have the user login to his/her home server with the id file (please note that this id file is not fully functional yet, since the certificate is not signed). During authentication protocol, the certificate should be bought down and jammed into the user id file and that finalized the registation.

Please let us know whether this works or not.

Thanks,

ShiuFun

5

Subject: RE: Not able to Register and Certify User fom the WebAdmin

Hi ShiuFun, I have checked the 3 Steps.

Step1:

I see there no success or failed status on the doc (see below).

*Action: Recertify Person in Domino Directory

*Server(s) to perform the action: Administration Server for the Domino Directory

*Name(s) to perform the action on: Firstname Lastname

*Action requested by: Zelda/TAG/CH

*Name of process to perform action: Adminp

Certified public key: 03003902 CF87DDD6 0AG01620 G002C787

D1FB9003 …

Step2:

The notes Certifiacte is there in the adress book

Step3:

No luck with the new UserID file

Server Error: Your certificate has not been signed by the Certificate Auhtority. Try again later.

<-???->

But, how can i delegate the user registration to our help desk without that an admin should do anything?

Thanks a lot

Volkan Senguel

6

Subject: Answer to your 2nd question…

But, how can i delegate the user registration to our help desk without that an admin should do anything?

You can give these people access to the webadmin.nsf database and only grant them the “People&Groups” role in the ACL… then they’ll only get the “People & Groups” tab to see in the UI.

Thomas - IBM

7

Subject: RE: Answer to your 2nd question…

Thanks Thomas, i know that :wink:

But after the registration comes my alltime problem…see this topic

.?

thx

Volkan

8

Subject: RE: Answer to your 2nd question…

Bottom line is: The CA signs the the user certificate and tells adminp to post the signed cert to the users person document. This is done at the ADMINISTRATION server of the Domino Directory. Next time that user accesses his HOME/MAIL server, the server pushes the signed cert to the local users ID file. So, it could be that the updated person document didn’t replicate between the Admininstration server and the home/mail server.

If this doesn’t help to troubleshoot/figure out the issue, then you should escalate this issue with Lotus Support, as I can’t think of any other things to check.

Thomas - IBM

9

Subject: RE: Answer to your 2nd question…

Thanks Thomas, the Admin Server and the User Server are the Same :wink:

Now i need a solution where the UserHelpDesk can register new users.

Is there a possibility to do that with the NotesAdmin Client?

I should have a solution where i not must give the login for the Cert.id and no access to other server options.

You know it an unwritten law, that anyone has any small access to the server, that he can delete db files with the Notes Admin :frowning:

thanks

Volkan