WesE
Mon Apr 21 16:57:49 CDT 2008
With those security settings I get the same error. Any suggestions on how to
get the CLM client to do detailed logging? I am using (export from regedit):
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CLM\v1.0\SmartCardClient]
"LogFileName"="c:\\temp\\Scclient.log"
"Log Level"=dword:00000004
perms on c:\temp are allow everyone.
Thanks
-Wes
"Paul Adare" wrote:
> On Fri, 18 Apr 2008 14:59:01 -0700, WesE wrote:
>
> > Here is some more detail. Note in this scenario I am using a delegated
> > security model.
> >
> > To keep things brief I will use the following shorthand:
> >
> > CLM Subscriber: CLM_S, this is the end user that will be using the Smartcard.
> > CLM Initiator: CLM_I, this is the user that interacts with the host running
> > the CLM Client and the person who creates the SC request for CLM_S. CLM_I
> > also executes the request (after approval) and is the ID operating the CLM
> > Client web app when the SC is accessed.
> > SC request approver: CLM_A, this is user who is identified as the Approver
> > in the workflow.
> > Finally there is the clmEnrollAgent, this is the account name and I am not
> > completely sure of its role but it is not the same account as CLM_I.
> >
> > Security settings:
> >
> > SCP: CLM_A (Read & CLM Audit); CLM_I (Read & CLM Audit); CLM_S (None)
>
> CLM_I needs Read, CLM Request Enroll, and CLM Enrollment Agent permission
> on the SCP.
>
> >
> > AD Group that CLM_S is a member of: CLM_I (Full Control)
>
> This is more than is needed. CLM_I only needs the same permissions as those
> on the SCP.
>
> >
> > Profile Template obj(in AD): CLM_S (Read); CLM_A (Read); CLM_I (Full
> > Control); clmEnrollAgent (Read, CLM Enroll)
>
> clmEnrollAgent doesn't need anything here. CLM_S and CLM_I need both Read
> and CLM Enroll.
>
> >
> > Certificate template (in AD): CLM_I (Read & Enroll); nothing specific for
> > CLM_S but Auth Users have Read.
> >
> > Profile Template in CLM Web App, Enroll Policy, Init Enroll Requests: CLM_I,
> > Approve Enroll Requests: CLM_A; Enroll Agent for Enroll Requests: CLM_I
> >
> > I see no errors in the App, System or CLM event logs on CLM server with one
> > exception, my CLM service account is getting login failed accessing the CLM
> > DB, not sure why. I don't get any consistent errors and no errors from the
> > CA. I have been able to issue a soft cert (using self service) to CLM_S on
> > the CLM client machine.
> >
> > I cannot get the CLM Client to log as described in the Troubleshooting
> > Guide. Suggestions to address this would be appreciated.
> >
> > The order of events are (once we get to the point of the bar graph): Init
> > card -> Generating Key & Cert -> Requesting... -> then I get the processing
> > error as described in my original post.
> >
> > Thanks,
> >
> > -Wes
>
>
> --
> Paul Adare
>
http://www.identit.ca
> Death is a nonmaskable interrupt.
>