Appendix A: Token Provisioning

This section describes the token provisioning.

User Token Provisioning

Following are the functions of the user token provisioning:

• User attempts to connect to the token for the first time after the IdP service is verified with JWT.
• Service checks with the server if the user’s token exists.
• If a token does not exist, the service calls the server to create a user token.
• On the Client, an Empty Middleware Card is present.
• User goes to CMS page to self-enroll a certificate.

Admin Batch Provisioning

Following are the requirements and functions of an admin batch provisioning:

• Client is installed on the administrators PC.
• Application receives the administrators JWT after the IdP service is verified.
• Application sends the administrators JWT to the service with the name of the user and the On behalf flag enabled.
• Service calls the server to create the user token.
• If a token does not exist, the service calls the server to create a user token.
• Administrators credentials are checked on the server. If approved, the server creates a User Record for the user.
• On the Client, an Empty Middleware Card is present.
• Administrator runs a Certificate Enrollment on behalf of the user.