NAE Client Registration

For registering a NAE client, a certificate is required. The certificate facilitates authentication and communication between CipherTrust Manager and the client.

You can register NAE clients using the following methods:

1. Using Auto Registration (using an existing certificate)

   Auto registration is useful when the clients are having certificates from the Classic KeySecure, or from older versions of the CipherTrust Manager, or certificates issued by External CAs.

   If you are already having one of the above certificate, you can utilize it to register your NAE client. For detailed steps, refer to the section NAE Client Registration using existing Certificates on CipherTrust Manager.

2. Using Manual Registration

   Before proceeding to manual registration, make sure that a client profile is created on the CipherTrust Manager. The client profile contains a set of properties, on the basis of which, the NAE client gets registered.

   NAE clients can be registered manually by creating a new certificate using local CA on the CipherTrust Manager.

   Refer to To Register a new NAE Client for details.

   Warning

   The client validation will be mandatory for all NAE clients in the future release leading to deprecation of the following interface modes:

   • TLS, ignore client cert, allow anonymous logins

   • TLS, ignore client cert, user must supply password

   Therefore, it is recommended not to use the above mentioned modes.

NAE Client Registration using existing Certificates on CipherTrust Manager

1. Create a registration token to register NAE clients.

   Request

   ksctl clientmgmt tokens create --configfile config_example.yaml
   

   Response

   {
       "id": "dd8289f4-adbe-412f-9191-320bf2bac847",
       "uri": "kylo:kylo:munshi:tokens:dd8289f4-adbe-412f-9191-320bf2bac847",
       "account": "kylo:kylo:admin:accounts:kylo",
       "application": "ncryptify:gemalto:admin:apps:kylo",
       "devAccount": "ncryptify:gemalto:admin:accounts:gemalto",
       "createdAt": "2019-12-19T05:52:36.590956451Z",
       "updatedAt": "2019-12-19T05:52:36.590956451Z",
       "token": "RwIgd6RfXd7kzri12ydzoeFXsA2R9ju2YDxMv2xM9duQbqAhcKcyMQO2OpqZesti",
       "valid_until": "0001-01-01T00:00:00Z",
       "max_clients": -1,
       "cert_duration": 730,
       "clients_registered": 0,
       "ca_id": "713172e0-02be-48c2-be60-6aae964ce943",
       "label": null
   }
   

2. Update the NAE Interface for which you want to allow the Auto registration of NAE clients. For auto registration, the client certificate to be registered should be signed by the trusted CA for the interface. To update the NAE interface, run the ksctl interfaces modify command with the following parameters.

   • -a (true | false) is for enabling or disabling auto registration

   • -r is for providing registration token as input

   If -a is set to true, then providing registration token in -r is mandatory.

   Note

   A new NAE interface can also be created with the -a and -r parameters.

   Request to update interface with auto registration on:

   ksctl interfaces modify -n nae -a true -r RwIgd6RfXd7kzri12ydzoeFXsA2R9ju2YDxMv2xM9duQbqAhcKcyMQO2OpqZesti --configfile config_example.yaml
   

   Response

   {
       "id": "54523325-62d0-40d4-a45e-f45b9e1679e7",
       "name": "nae",
       "mode": "tls-cert-pw-opt",
       "cert_user_field": "CN",
       "auto_gen_ca_id": "kylo:kylo:naboo:localca:713172e0-02be-48c2-be60-6aae964ce943",
       "trusted_cas": {
           "local": [
               "kylo:kylo:naboo:localca:713172e0-02be-48c2-be60-6aae964ce943"
           ]
       },
       "createdAt": "2019-12-13T03:27:28.767622Z",
       "updatedAt": "2019-12-19T05:55:26.362558Z",
       "default_connection": "local_account",
       "port": 5696,
       "network_interface": "all",
       "interface_type": "nae",
       "minimum_tls_version": "tls_1_2",
       "local_auto_gen_attributes": {
           "cn": "nae.keysecure.local",
           "email_addresses": [
               "support@gemalto.com"
           ],
           "names": [
               {
                   "C": "US",
                   "ST": "MD",
                   "L": "Belcamp",
                   "O": "Gemalto",
                   "OU": ""
               }
           ],
           "generated": false
       },
       "auto_registration": true,
       "registration_token": "RwIgd6RfXd7kzri12ydzoeFXsA2R9ju2YDxMv2xM9duQbqAhcKcyMQO2OpqZesti"
   }
   

   Note

   The cert_user_field specifies how the user name is extracted from the client certificate. The default value is CN. This parameter must be one of the following:

   • CN: common name

   • OU: organizational unit

   • SN: surname

   • E: Email address

   • UID: User ID

   • E_ND: Email without domain; the data to the left of the @ sign in the email address is taken as the user name

3. Connect to the NAE interface using the client certificate you want to register. It will automatically register the NAE client corresponding to that certificate.

   Note

   The auto registration is only supported for the following interface modes:

   • TLS, verify client cert, allow anonymous logins

   • TLS, verify client cert, user must supply password

   • TLS, verify client cert, user name taken from client cert, auth request is optional

   • TLS, verify client cert, password is needed, user name in cert must match user name in authentication request

To Register a new NAE Client

1. Create a json file to specify properties. You can create a NAE client profile using:

   • Ingrian Properties

   • csr parameters

   profile.json: This file is a user input to CLI for providing profile parameters.

   Note

   The profile.json is just a place holder for name of file, user can choose any name for this file.

   ** Ingrian Properties Explanation**

   • Symmetric Cache Enabled: Determines if the symmetric key caching is enabled. If set to true, the client can use the symmetric keys locally. The default value is false.

   • Symmetric Cache Expiry(in msec): The minimum amount of time that a key will remain in the client key cache. Time period after which a cached symmetric key can be removed from the cache. If set to 0, the keys will never purged from the client cache. The default value is 43200 msec.

   • Persistent Cache Expiry(in msec): Duration after which a key will expire from the persistent cache. The default value is 43200 msec.

   • Connection Timeout(in msec): Determines how long the client will wait for the connection to be established with the CipherTrust Manager before time out. The default value is 10000msec.

   • Read Timeout(in msec):

   ** CSR Parameters Explanation**

   • cert_user_field: Specifies how the user name is extracted from the client certificate. The default value is CN. For more information, click here.

     Note

     After registering the new nae client, the cert_user_field setting of profile is used instead of the setting present in the interface.

   • csr_cn: Common Name used to create CSR.

   • csr_org_name: Organization name to be used in CSR.

   • csr_uid: User ID used to create CSR.

   • csr_org_unit: Organizational unit to be used in CSR.

   • csr_email: Email address to be used in CSR.

   • csr_city: City name to be used in CSR.

   • csr_state: State name to be used in CSR.

   • csr_country: Country name to be used in CSR.

   • csr_sn: Surname to be used in CSR.

2. Create the nae profile using the json file created in step 1.

   Request

   ksctl protectapp profiles create --profile-name 123 --profile-prop ~/profile.json
   

   Response

   {
       "id": "fb882a85-0e92-4c6f-8503-75c7d48d8a90",
       "uri": "kylo:kylo:nae:profile:123",
       "account": "kylo:kylo:admin:accounts:kylo",
       "application": "ncryptify:gemalto:admin:apps:kylo",
       "devAccount": "ncryptify:gemalto:admin:accounts:gemalto",
       "createdAt": "2022-11-28T07:07:10.833729699Z",
       "name": "123",
       "updatedAt": "2022-11-28T07:07:10.833729699Z",
       "nae_iface_name": "",
       "owner": "ncryptify:gemalto:admin:users:admin",
       "properties": {
           "cert_user_field": "CN",
           "csr_email": "",
           "csr_sn": "",
           "csr_state": "",
           "csr_org_name": "",
           "csr_org_unit": "",
           "csr_country": "",
           "csr_city": "",
           "csr_cn": "admin",
           "symmetric_cache_enabled": false,
           "verify_ssl_certificate": false,
           "syslog_server_ip": "",
           "syslog_server_port": 514,
           "syslog_server_protocol": "tcp_ok",
           "syslog_no_of_retries": 3,
           "syslog_retry_interval": 1,
           "syslog_retry_limit": 2,
           "use_persistent_connections": true,
           "size_of_connection_pool": 300,
           "load_balancing_algorithm": "round-robin",
           "connection_idle_timeout": 600000,
           "connection_retry_interval": 600000,
           "cluster_synchronization_delay": 170,
           "cert_file_location": "",
           "credentials_encrypted": false,
           "asymmetric_key_cache_enabled": false,
           "persistent_cache_enabled": false,
           "persistent_cache_directory": "",
           "persistent_cache_expiry_keys": 43200,
           "persistent_cache_max_size": 100,
           "log_level": "medium",
           "log_file": "",
           "log_rotation": "Daily",
           "log_size_limit": "100k",
           "key_non_exportable_policy": true,
           "symmetric_cache_expiry": 43200,
           "pcache_cache_expiry": 43200,
           "connection_timeout": 60000,
           "read_timeout": 7000,
           "impersonated_users": [
               "admin"
           ],
           "csr_uid": ""
       }
   }
   

3. Create a registration token using the profile created in the previous step.

   Note

   The client registration is not allowed through an external CA.

   Request

   ksctl clientmgmt tokens create --ca_id 679994cb-d551-425c-b46a-bda9c3d8630b --label '{"ClientProfile": "123"}'
   

   Note

   The profile_name is required and must be present in the system before creating a registration token.

   Response

   {
       "id": "b58815a7-ab0c-42b4-ae65-611c791a69f8",
       "uri": "kylo:kylo:munshi:tokens:b58815a7-ab0c-42b4-ae65-611c791a69f8",
       "account": "kylo:kylo:admin:accounts:kylo",
       "application": "ncryptify:gemalto:admin:apps:kylo",
       "devAccount": "ncryptify:gemalto:admin:accounts:gemalto",
       "createdAt": "2022-11-28T07:20:39.215478Z",
       "updatedAt": "2022-11-28T07:20:39.215478Z",
       "token": "fIsQt1gUt6tqfY5zypLkSnYpMJ0cLloPhkus9PUSSr7btPiI62yamB0QJqo23XMI",
       "valid_until": "0001-01-01T00:00:00Z",
       "max_clients": -1,
       "cert_duration": 730,
       "clients_registered": 0,
       "ca_id": "679994cb-d551-425c-b46a-bda9c3d8630b",
       "label": {
           "ClientProfile": "123"
       }
   }
   

4. Register the new nae client using the registration token generated in the previous step. Also, add the IngrianNAE.properties file in the root (/) directory.

   Request

   ksctl protectapp register --name testDemo -t v9W6l79y2ACpOSfg2xrGUVSLrb9jI36oc06zCZHRHuq6jamAcOzzGCTsRh7rVhkg -c protectappjce
   

   Response

   Client Registration Successful
   

5. Use Client Certificate and Client Private Key to connect with the server.

Click here to know about client validation on NAE interface.