Introduction to FIM CM
Applies To: Forefront Identity Manager 2010
Prerequisite Knowledge
This document assumes that you have a basic understanding of Microsoft® Forefront® Identity Manager (FIM) 2010, Active Directory, and Certificate Services.
For an overview of FIM 2010 documentation and guidance for using it, see the Documentation Roadmap.
Audience
This guide is intended for IT planners, systems architects, technology decision makers, consultants, infrastructure planners, and IT personnel who plan to deploy Microsoft® Forefront® Identity Manager (FIM) 2010 using Certificate Management.
Time Requirements
This the procedures in this document require 60 to 90 minutes for a new user to complete.
Note
These time estimates assume that the testing environment is already configured for the scenario and do not include the time required to set up the test environment.
Scenario Description
Fabrikam, a fictitious company, wants to evaluate Microsoft® Forefront Identity Manager Certificate Management (FIM CM).
The Testing Environment
The scenario outlined in this document has been developed and tested on a stand-alone computer running 64-bit Windows 2008 Server with Hyper-V. The server has a 2 x 3.0 GHz dual core processors and 4 GB of RAM. Using Hyper-V, the following 3 virtual machines were created on the host.
.gif "7f149bb5-8092-4ff4-9e7e-e02b47291fa7")
Table 1 Virtual Machines and Roles
| Name | Memory | Operating System | Description |
|---|---|---|---|
QS-DC.Fabrikam.com |
512 MB |
64-bit Windows 2008 Server |
Domain Controller |
QS-FIMCA.Fabrikam.com |
2048 MB |
64-bit Windows 2008 Server |
FIM – Certificate Management, Certificate Services, SQL 2008, IIS 7.0 |
QS-Vista.Fabrikam.com |
1024 MB |
64-bit Vista Enterprise |
Client |
Hyper V is not a requirement to complete the steps outlined below. The steps below can be implemented on physical computers as long as they reflect the same roles as the table above.
Before You Begin
This document only covers the basic certificate functionality of FIM. It is designed to get you quickly up and running in a test environment so that the product can be evaluated. This document does not cover using FIM, Certificate Management with smart cards. For further information on smart cards, see Introduction to Certificate Management Smartcards in the FIM 2010 document set.
This document makes some assumptions and requires the following to be true, prior to completing the steps outlined below. It assumes that there is a fabrikam.com Active Directory forest already in place. That QS-DC is the domain controller for this forest and that the QS-FIMCM and QS-Vista are joined to this domain. Setting up an Active Directory forest is outside the scope of this document.
Software Requirements
The following table summarizes the software that is required to implement the procedures in this document.
Table 2 Software requirements for FIM CM
| Software | Description |
|---|---|
Certification authority (CA) |
FIM CMrequires at least one or more of the following: 32-bit Microsoft® Windows Server® 2003, Enterprise Edition CA, 32-bit Microsoft Windows® Server 2008 Enterprise Edition CA, or 64-bit Microsoft Windows® Server 2008 Enterprise Edition CA. The Certification Authority must be an Enterprise CA. |
Microsoft® Forefront Identity Manager Certificate Management (FIM CM) |
At least one instance of the software installed on a server that is running Microsoft Windows® 2008 Enterprise Edition. |
Microsoft® SQL Server 2008 |
FIM CM supports Microsoft® SQL Server 2008 64-bit Enterprise, or Standard Edition. |
Internet Information Services (IIS) 7.x |
FIM CM uses IIS as its Web server to run the FIM CM Portal. |
Microsoft® .NET Framework 3.5 |
FIM CM is a Microsoft .NET-connected application. You must install the Microsoft .NET Framework 3.5 on the server. If FIM CM is installed on the same server as SQL 2008 then .NET Framework 3.5 SP1 is required. |
Microsoft Internet Explorer® 6.x or later |
Because FIM CM requires Secure Sockets Layer (SSL) and Transport Layer Security (TLS) for administrative traffic and certificates, Internet Explorer 6.x or later is required. In addition, FIM CM has advanced scripting features that are optimized for Internet Explorer. |
Required Accounts
The following table summarizes the accounts and permissions required by those accounts to implement the procedures in this document.
Table 3 Required Accounts
| Account | Description and permissions |
|---|---|
FIM CM Agent |
Provides the following services:
This user has the following access control settings:
|
FIM CM Key Recovery Agent |
Recovers archived private keys from the CA. This user has the following access control settings:
|
FIM CM Authorization Agent |
Determines user rights and permissions for users and groups. This user has the following access control settings:
|
FIM CM CA Manager Agent |
Performs CA management activities. This user must be assigned the Manage CA permission. |
FIM CM Web Pool Agent |
Provides the identity for the IIS application pool. FIM CM runs within a Microsoft Win32® application programming interface process that uses this user’s credentials. This user has the following access control settings:
|
FIM CM Enrollment Agent |
Performs enrollment on behalf of a user. This user has the following access control settings:
|
Britta Simon |
Generic user who will be used to test our implementation. |
Group Requirements
The following table summarizes the Active Directory groups that are required to implement the procedures in this document.
Table 4 Required Groups
| Group | Remark |
|---|---|
FIM CM Subscribers |
A group of all users that will access FIM CM for certificate services |
Implementing the Procedures in this Document
To implement the procedures in this document, you complete the following steps in the order shown:
Installing IIS 7.0
Installing the .NET Framework 3.5 SP1
Deploying Windows Server 2008 Certificate Services
Publishing the Key Recovery Agent and Enrollment Agent certificate template at the Certification Authority
Installing SQL 2008
Extending the Active Directory Schema
Create the FIMCMObjects container
Create the Active Directory User Accounts
Create and configure the FIM CM Subscribers group
Add our test user to the FIM CM Subscribers group
Installing Forefront Identity Manager – Certificate Management
Configuring Forefront Identity Manager – Certificate Management
Trust the FIMCMWebAgent Account for Delegation
Disable Internet Explorer Enhanced Security for Administrators
Disable Kernel-mode Authentication
Create and configure the Fabrikam User Profile Template
Assign FIM CM Subscribers permissions to the Service Connection Point
Assign FIM CM Subscribers permissions to the Fabrikam User Profile Template
Assign FIM CM Subscribers permissions to the User Certificate Template
Add the Microsoft Forefront Identity Manager Certificate Management site to Trusted Sites in Internet Explorer
Enable Initialize and script ActiveX controls not marked as safe for signing
Test the implementation
Later topics provide more detail about these steps.
Install Internet Information Services 7.0
The following steps will show you how to setup a basic installation of IIS 7.0 for use with FIM CM. The following tables summarize the individual pieces of IIS 7.0 that need to be installed.
Table 5 Required IIS 7.0 Web Server Role Services
| Role Service | Required Features |
|---|---|
Common HTTP Features |
|
Application Development |
|
Health and Diagnostics |
|
Security |
|
Performance |
|
Table 6 Required IIS 7.0 Management Tools Role Services
| Role Service | Required Features |
|---|---|
IIS Management Console |
To install Internet Information Services 7.0
Log on to the QS-FIMCM Server as Administrator
From the Start button, select Server Manager.
From the Server Manager screen, right-click Roles, and then select Add Rolesfrom the drop-down.
From the Add Roles Wizard, on the Before You Begin screen, click Next.
From the Server Roles screen, place a check in Web Server (IIS). Click Next. .
Note
This will bring up a small pop-up box with the title of Add features required for Web Server (IIS). Click the Add Required Features button. This will add the Windows Process Activation Service.
Click Next.
From the Web Server (IIS) screen, click Next.
From the Role Services screen, place a check in all of the items that are listed in tables 5 and 6 above if there is not one already present.
Note
When you select ASP.NET this will bring up a pop-up box with the title Add features required for Web Server (IIS). Click the Add Required Features button. This will automatically select ISAPI Extensions, ISAPI Filters, and .NET Extensibility. This will also add the .NET Environment to the Windows Process Activation Service.
Click Next.
From the Confirmation screen, review the information and click Install.
When the installation is complete, from the Results screen, click Close.
Close Server Manager.
Installing the .NET Framework 3.5 SP1
The following steps will show you how to setup the .NET Framework 3.5.
To install the .NET Framework 3.5 SP1
Log on to the QS-FIMCM Server as Administrator
On the QS-FIMCM server, download the .NET 3.5 Framework from the following location: https://go.microsoft.com/fwlink/?LinkID=185469.
Once that is complete, double-click on the dotnetfx35.exe file.
On the Welcome to Setup screen, after reading the License Agreement, select I have read and ACCEPT the terms in the License Agreement box and click Install.
When the installation is complete, on the Setup Complete screen, click Exit.
On the restart server screen, click restart now.
Deploying Microsoft Certificate Services
The following steps will show you how to setup Microsoft Certificate Services on the QS-FIMCM server.
To Install Microsoft Certificate Services
Log on to the QS-FIMCM Server as Administrator
From the Start button, select Server Manager.
From the Server Manager screen, right-click Roles, and then select Add Roles from the drop-down.
From the Add Roles Wizard, on the Before You Begin screen, click Next.
From the Server Roles screen, place a check in Active Directory Certificate Services. Click Next.
From the AD CS screen, click Next.
From the Role Services screen, make sure there is a check in Certification Authority and click Next.
From the Setup Type screen, make sure that Enterprise is selected and click Next.
From the CA Type screen, make sure that Root CA is selected and click Next.
From the Private Key screen, make sure that Create a new private key is selected and click Next.
From the Cryptography screen, leave the defaults and click Next.
From the CA Name screen, leave the defaults and click Next.
From the Validity Period screen, leave the defaults and click Next.
From the Certificate database screen, leave the defaults and click Next.
From the Confirmation screen, review the information and click Install.
When the installation is complete, from the Results screen, click Close.
Close Server Manager.
Publishing the Key Recovery Agent and Enrollment Agent certificate template at the Certification Authority
This section lists the steps for publishing the certificate template at the Certification Authority.
To publish the certificate templates at the Certification Authority
From the Start button, select Administrative Tools and Certification Authority.
This will open the certsrv mmc. Expand fabrikam-QS-FIMCM-CA.
Right-click Certificate Templates and select New and Certificate Template to Issue
From the list, hold down the Ctrl key, and select Enrollement Agent and Key Recovery Agent. Click OK.
Verify these are now in the list of Certificate Templates. Close the certsrv mmc.
Installing SQL 2008
The following steps will show you how to setup a basic installation of SQL 2008 for a lab environment. The following table summarizes the required SQL 2008 features.
Table 7 Required SQL 2008 Features
| Feature | Remarks |
|---|---|
Database Engine Services |
|
Management Tools - Basic |
|
To install SQL 2008
Log on to the QS-FIMCM Server as Administrator.
Place the SQL 2008 installation media in the CD drive.
From the AutoPlay windows that pops up, select Run SETUP.EXE
This will bring up another pop-up window that says the following. SQL Server 2008 setup requires Microsoft .NET Framework and an updated Windows Installer to be installed. To install these prerequisites and continue with Setup, click Ok. To exit Setup, click Cancel. Click OK.
This will bring up the Windows Update Standalone Installer window and will ask to install a hotfix for Windows (KB942288). Click OK.
When the installation is complete, click Restart Now.
Once the QS-FIMCM server has rebooted, log on again as Administrator.
From the Start button, select Computer.
Double-click the CD Drive with the SQL 2008 installation media.
From the SQL Server Installation Center screen, click Installation.
From the right, select New SQL Server stand-alone installation or add features in an existing installation. This will bring up the SQL Server 2008 Setup wizard. This wizard will run some pre-requisite checks.
Once the SQL Server 2008 Setup Wizard is done running the pre-requisite checks it should show Passed: 6. Click OK to continue. This wizard will close.
A new setup wizard will open to the Product Key screen. Enter your product key and click Next.
From the License Terms screen, after reading the License Agreement, select I accept the license terms box and click Next.
From the Setup Support Files screen, click Install.
Once this completes, a new wizard will appear. From the Setup Support Rules screen, click Next.
From the Feature Selection screen, place a check in the items listed above in table 7 and click Next.
From the Instance Configuration screen, leave the defaults and click Next.
From the Disk Space Requirements screen, leave the defaults and click Next.
From the Server Configuration screen, click the Use the same account for all SQL Server services button.
From the Use the same account for all SQL Server services screen, next to Account Name, enter fabrikam\Administrator. Next to password, enter the Administrator’s password. Click Ok.
Click Next.
From the Database Engine Configuration screen, click the Add Current User button and then click Next.
From the Error and Usage Reporting screen, leave the defaults and click Next.
From the Installation Rules screen, leave the defaults and click Next.
From the Ready to Install screen, click Install.
When the installation is complete, from the Installation Progress screen, click Next.
From the Complete screen, click Close.
Extending the Active Directory Schema
This section lists the steps for extending the Active Directory schema.
To simplify the process of extending the Active Directory schema, you use the Visual Basic script file that ships with Identity Lifecycle Manager 2007.
To extend the Active Directory Schema
Log on to the QS-DC Server as Administrator.
Place the FIM installation media in the CD drive.
From the Start button, select Computer.
Right-click the CD Drive with the FIM installation media and select Explore.
In the Certificate Management installation folder, double-click the x64 folder, and open the Schema folder.
In the Schema folder there are the following two files, CLM.LDIF and ModifySchema.vbs. To update the Active Directory schema, double-click the ModifySchema.vbs file.
To finalize the schema extension process, click OK in the Success dialog box.
Create the FIMCMObjects container in Active Directory
This section lists the steps for creating the FIMCMObjects container in Active Directory. This organizational unit will be the container for the additional Active Directory objects that are required.
To create the FIMCMObjects container
Log on to the QS-DC Server as Administrator.
From the Start button, select Administrative tools, then Active Directory Users and Computers.
Right-click fabrikam.com, select New and then select Organizational Unit. This will bring up the New Object – Organizational Unit window.
On the New Object – Organizational Unit screen, in the Name box, enter FIMCMObjects and click OK.
Close Active Directory Users and Computers.
Create the Active Directory User Accounts
This section lists the steps for creating the Active Directory user accounts that are used in this scenario. 7 total accounts will be created for this scenario. FIM CM uses 6 accounts to perform its various operations. Detailed information on these accounts are provided in table 3 above. One account will also be used to simulate a regular user. Table 8, below, summarizes the accounts that will be created.
Note
You can allow the FIM CM Configuration Wizard to automatically create the 6 accounts that are required. However, since it is best practice in a production environment to manually create these accounts and ensure that they have replicated around prior to running the Configuration Wizard, this approach will be used.
Table 8 Account Summary
| First Name | Last Name | User logon name | Password |
|---|---|---|---|
FIM CM Agent |
FIMCMAgent |
Pass1word! |
|
FIM CM Key Recovery Agent |
FIMCMKRAgent |
Pass1word! |
|
FIM CM Authorization Agent |
FIMCMAuthAgent |
Pass1word! |
|
FIM CM CA Manager Agent |
FIMCMManagerAgent |
Pass1word! |
|
FIM CM Web Pool Agent |
FIMCMWebAgent |
Pass1word! |
|
FIM CM FIM CM Enrollement Agent |
FIMCMEnrollAgent |
Pass1word! |
|
Britta |
Simon |
bsimon |
Pass1word! |
To create the Active Directory User Accounts
Log on to the QS-DC Server as Administrator.
From the Start button, select Administrative tools, then Active Directory Users and Computers.
Expand fabrikam.com, right-click FIMCMObjects, select New and then select User. This will bring up the New Object – User window.
On the New Object – User screen, in the First Name box, enter FIM CM Agent.
On the New Object – User screen, in the User logon box, enter FIMCMAgent and click Next.
On the New Object – User screen, in the Password box, enter Pass1word!.
On the New Object – User screen, in the Confirm Password box, enter Pass1word!.
On the New Object – User screen, remove the check from User must change password at next logon.
On the New Object – User screen, add a check to Password never expires and click Next.
Click Finish.
Repeat these steps for all of the accounts listed in table 8 above.
Create the Active Directory Group Accounts
This section lists the steps for creating the Active Directory group account that is used in this scenario. One group account will be created for this scenario.
Table 9 Group Account Summary
| Group Name | Group Scope | Group Type |
|---|---|---|
FIM CM Subscribers |
Global |
Security |
To create the Active Directory Group Object
Log on to the QS-DC Server as Administrator.
From the Start button, select Administrative tools, then Active Directory Users and Computers.
Expand fabrikam.com, right-click FIMCMObjects, select New and then select Group. This will bring up the New Object – Group window.
On the New Object – Group screen, in the Group Name box, enter FIM CM Subscribers.
On the New Object – Group screen, make sure the Group Scope is Global.
On the New Object – Group screen, make sure the Group Type is Security.
Click OK.
Add our test user to the FIM CM Subscribers group
This section lists the steps for disabling Internet Explorer Enhanced Security
To add Britta Simon to the FIM CM Subscribers group
Log on to the QS-DC Server as Administrator.
From the Start button, select Administrative tools, then Active Directory Users and Computers.
Expand fabrikam.com, select FIMCMObjects, right-click FIM CM Subscribers and then select Properties. This will bring up the FIM CM Subscribers Properties window.
Click the Members tab, and click the Add button. This will bring up the Select Users, Contacts, Computers, or Groups screen.
In the Enter the object names to select box, enter Britta Simon, and then click Check Names. This should resolve with an account with an underline under it.
Click OK.
Click Apply.
Click OK.
Close Active Directory Users and Computers.
Installing Forefront Identity Manager – Certificate Management
The following will steps show you how to install the FIM CM binaries.
To install Forefront Identity Manager – Certificate Management
Log on to the QS-FIMCM Server as Administrator.
Place the FIM installation media in the CD drive.
From the splash screen, under Forefront Identity Manager Certificate Management, select Install Certificate Management 64 bit
Note
You may receive a pop-up that says the following. Active content can harm your computer or disclose personal information. Are you sure that you want to allow CDs to run active content on your computer? For this scenario you can safely ignore this warning and click Yes.
This will bring up the File Download – Security Warning screen that will as you Do you want to save this file? Click Run
This will bring up the Internet Explorer – Security Warning screen that will as you Do you want to run this software? The software name will be Certificate Management.msi. Click Run.
This will bring up the Forefront Identity Manager Certificate Management setup wizard. On the welcome screen, click Next.
From the End-User License Agreement screen, after reading the License Agreement, select I accept the terms in the license agreement box and click Next.
From the Custom Setup screen, leave the defaults and click Next.
From the Virtual Web Folder screen, leave the default of CertificateManagement for the Virtual folder and click Next.
From the Install Forefront Identity Manager Certificate Management screen, click Install.
When the installation is complete, click Finish.
Run the Certificate Manager Config Wizard
The following steps will show you how to configure FIM CM.
To run the Certificate Manager Config Wizard
Log on to the QS-FIMCM Server as Administrator
On the QS-FIMCM server go to Start, select All Programs, click Microsoft Forefront Identity Manager and click Certificate Manager Config Wizard.
From the Welcome screen, click Next.
From the Certification Authority screen, leave the defaults and click Next.
From the SQL Server screen, leave the defaults and click Next.
From the Database screen, leave the defaults and click Next.
From the Active Directory screen, leave the defaults and click Next.
From the FIM CM Agent Accounts screen, take the check out of Use the FIM CM default settings and click Custom Accounts. This will bring up the Agents – FIM CM window.
On the FIM CM Agent tab, enter FIMCMAgent for the User Name. In the Password and Confirm Password box enter Pass1word!. Place a check in the Use an existing user checkbox.
On the Key Recovery Agent tab, enter FIMCMKRAgent for the User Name. In the Password and Confirm Password box enter Pass1word!. Place a check in the Use an existing user checkbox.
On the Authorization Agent tab, enter FIMCMAuthAgent for the User Name. In the Password and Confirm Password box enter Pass1word!. Place a check in the Use an existing user checkbox.
On the CA Manager Agent tab, enter FIMCMManagerAgent for the User Name. In the Password and Confirm Password box enter Pass1word!. Place a check in the Use an existing user checkbox.
On the Web Pool Process Worker Agent tab, enter FIMCMWebAgent for the User Name. In the Password and Confirm Password box enter Pass1word!. Place a check in the Use an existing user checkbox.
On the Enrollment Agent tab, enter FIMCMEnrollAgent for the User Name. In the Password and Confirm Password box enter Pass1word!. Place a check in the Use an existing user checkbox.
Click OK and on the FIM CM Agent Accountsscreen, and click Next.
From the Certificates screen, leave the defaults and click Next.
From the E-mail screen, leave the defaults and click Next.
From the Summary screen, review the configuration and click Configure.
Note
This will bring up a screen that says the following. FIM CM virtual IIS directory is currently not configured to require communication over a secure channel (SSL). It is strongly recommended to configure FIM CM virtual IIS directory to require secure channel (SSL). To perform the configuration, click OK. To return to the configuration wizard, click Cancel. This message can be safely ignored. Click OK.
When the configuration is complete, click Finish.
Trust the FIMCMWebAgent Account for delegation.
This section lists the steps for disabling Internet Explorer Enhanced Security
To trust the FIMCMWebAgent Account for delegation.
Log on to the QS-DC Server as Administrator.
From the Start button, select Administrative tools, then Active Directory Users and Computers.
Expand fabrikam.com, select FIMCMObjects, right-click FIM CM Web Pool Agent and then select Properties. This will bring up the FIM CM Web Agent Properties window.
Click the Delegation tab, and select Trust this user for delegation to any service (Kerberos).
Click Apply.
Click OK.
Close Active Directory Users and Computers.
Disable Internet Explorer Enhanced Security for Administrators
This section lists the steps for disabling Internet Explorer Enhanced Security
To disable IE ESC
Log on to the QS-FIMCM Server as Administrator.
From the Start button, select Server Manager.
From the Server Manager screen, on the right hand side, scroll down to Security Information, and then select Configure IE ESC.
From the Internet Explorer Enhanced Security Configuration screen, under Administrators, select Off.
Click OK.
Close Server Manager.
Disable Kernel-Mode Authentication
In order to use FIM CM with IIS 7 you must disable Kernel-mode authentication.
To disable Kernel-mode Authentication
Log on to the QS-FIMCM Server as Administrator
On the QS-FIMCM server go to Start, select Administrative Tools and choose Internet Information Services Manager.
On the left, expand Sites, expand Default Web Site, and then click CertificateManagement.
In the center pane, scroll down and double click Authentication.
Right-click Windows Authentication and select Advanced Settings…
Take the check out of Enable Kernel-mode authentication.
Click OK.
Close Internet Information Services Manager.
Create the Fabrikam User profile template
This section lists the steps for creating the Fabrikam User profile template.
To create the Fabrikam User profile template
Log on to the QS-FIMCM Server as Administrator.
From the Start button, select Internet Explorer.
From Internet Explorer, in the Address box, enter https://qs-fimcm/certificatemanagement and click the green arrow.
From the Forefront Identity Manager screen, click click to enter.
From the Forefront Identity Manager Certificate Management home screen, on the right, scroll down and under Administration, click Manage profile templates.
From the Profile Template Management screen, place a check in FIM CM Sample Profile Template, then click Copy a selected profile template.
From the Duplicate Profile screen, delete the contents of the New profile template name box and enter Fabrikam User Profile Template. Click OK.
From the Edit Profile Template [FIM CM User Profile Template] screen, from the left, under Select a view, click Enroll Policy.
From the Edit Profile Template [FIM CM User Profile Template] screen, scroll down, under Workflow: Initiate Enroll Request, click Add new principal for enroll request initiation.
From the Edit Profile Template [FIM CM User Profile Template] screen, next to the Principal box, click Lookup….
From the Search for Users and Groups screen, select Groups, and in the Name box, enter FIM CM Subscribers, click Search.
Once the search completes, click fabrikam\FIM CM Subscribers under User Logon.
Click OK.
Close Internet Explorer.
Assign the FIM CM Subscribers group permissions to the Service Connection Point
This section lists the steps for assigning the FIM CM Subscribers group permissions to the Service Connection Point
To assign the FIM CM Subscribers group permissions to the Service Connection Point.
Log on to the QS-DC Server as Administrator.
From the Start button, select Administrative tools, then Active Directory Users and Computers.
Expand fabrikam.com, expand System, expand Microsoft, expand Certificate Lifecycle Manager, right-click QS2-FIMCM and select Properties. This will bring up the QS2-FIMCM Properties window.
Click the Security tab, and click Add.
In the Enter the object names to select box, enter FIM CM Subscribers, and then click Check Names. This should resolve with an account with an underline under it.
Click OK.
Make sure the FIM CM Subscribers group is selected and place a check in the box under Allow for Read.
Click Apply.
Click OK.
Close Active Directory Users and Computers.
Assign FIM CM Subscribers permissions to the Fabrikam User Profile Template
This section lists the steps for granting access to the FIM CM User Profile. This must be done before our user, Britta Simon, can use the template.
To assign permissions to the Fabrikam User Profile Template
Log on to the QS-DC Server as Administrator.
From the Start button, select Administrative tools, then Active Directory Sites and Services.
At the top click View and select Show services Node.
Expand Services, expand Public Key Services and then select Profile Templates.
On the right, right-click Fabrikam User Profile Template and select Properties.
Select the Security tab and click Add.
In the Enter the object names to select box, enter FIM CM Subscribers, and then click Check Names. This should resolve with an account with an underline under it.
Click OK.
Make sure the FIM CM Subscribers group is selected and place a check in the box under Allow for Read and FIM CM Enroll.
Click Apply.
Click OK.
Close Active Directory Sites and Services.
Assign the FIM CM Subscribers group permissions to the Users Certificate Template
This section lists the steps for assigning the FIM CM Subscribers group permissions to the Users Certificate Template.
To assign the FIM CM Subscribers group permissions to the Users Certificate Template.
Log on to the QS-FIMCM Server as Administrator.
From the Start button, select Run…, then enter mmc. Click OK.
Select File and click Add/Remove Snap-in… This will bring up the Add or Remove Snap-ins window.
From the left, scroll down and select Certificate Templates and click Add>.
Click OK.
From the Console1 window, click Certificate Templates (QS-FIMCM). This will populate the center pane with a list of certificate templates.
From the center, scroll down, right-click User and select Properties. This will bring up the User properties window.
Select the Security tab and click the Add button.
In the Enter the object names to select box, enter FIM CM Subscribers, and then click Check Names. This should resolve with an account with an underline under it.
Click OK.
Make sure the FIM CM Subscribers group is selected and place a check in the box under Allow for Read and Enroll.
Click Apply.
Click OK.
Close Console1.
Add the Microsoft Forefront Identity Manager Certificate Management site to Trusted Sites in Internet Explorer
This section lists the steps for adding the FIM CM site to Trusted Sites in Internet Explorer.
To add the Microsoft Forefront Identity Manager Certificate Management site to Trusted Sites in Internet Explorer
Log on to the QS-Vista as Britta Simon.
From the Start button, select Internet Explorer.
From Internet Explorer, in the Address box, enter https://qs-fimcm/certificatemanagement and click the green arrow.
At the top of Internet Explorer, select Tools, and click Internet Options.
Click the Security tab, and select Trusted Sites from the Select a zone to view or change security settings box.
Click the Sites button. This will bring up a Trusted Sites window.
In the Add this Website to the zone: box, type http:qs-fimcm, remove the check from Require server verification (https:) for all sites in this zone, and click Add.
Click Close.
From the Internet Options screen, click OK.
Close Internet Explorer.
Enable Initialize and script ActiveX controls not marked as safe for signing
This section lists the steps for enabling Initialize and script ActiveX controls not marked as safe for signing in Internet Explorer. This is required because we are not using SSL in our lab environment. By default, with Vista SP1 the web control that we are using to request a certificate is only marked as safe if it is hosted in SSL.
To Enable Initialize and script ActiveX controls not marked as safe for signing
Log on to the QS-Vista as Britta Simon.
From the Start button, select Internet Explorer.
At the top of Internet Explorer, select Tools, and click Internet Options.
Click the Security tab, and select Trusted Sites from the Select a zone to view or change security settings box.
Click the Custom level… button. This will bring up a Security Settings – Trusted Sites Zone window.
Under Settings scroll down and click Enable for Initialize and script ActiveX controls not marked as safe for signing.
Click OK.
From the Internet Options screen, click OK.
Close Internet Explorer.
Test the Implementation
This section lists the steps for testing the implementation. In order to test this, you will log on to the QS-Vista computer as Britta Simon and request a user certificate.
To test the implementation
Log on to the QS-Vista as Britta Simon.
From the Start button, select Internet Explorer.
From Internet Explorer, in the Address box, enter https://qs-fimcm/certificatemanagement and click the green arrow.
From the Forefront Identity Manager screen, click click to enter.
From the Forefront Identity Manager Certificate Management home screen, click Request a new set of certificates.
Note
This will take you directly to the Enrollment Request Initiation screen. If the FIM CM Subscribers group had more than one profile template to choose from, this option would appear.
From the Enrollement Request Initiation screen, type Sample Data Item in the Sample Data Item box.
Click Next.
From the Installing Certificates screen, verify there is a check mark under Success, and click Next.
From the Request Complete screen, click Main Menu.
Close Internet Explorer.