ADSS Admin Guide

Items

Description

Allow Open Access

By selecting this option, any client can send request to the server from any IP and the request will be accepted for processing. 

Allow access based on TLS client certificates

This option has two sub-filters:

• The access will be allowed only to those clients whose TLS client authentication certificate's issuers are registered within the Trust Manager. 
• The access will be allowed or denied to those clients whose TLS client authentication certificate issuer is registered in the Trust Manager but additional restrictions are applied based on the client authentication certificate's DN. For example, by choosing the option to "Include following DN attributes" and set O=Ascertia. This allows access to TLS client certificates to SCVP service having the issuer is registered in Trust Manager but DN also contains "Ascertia" as its organization. Requests with TLS client certificates from any other issuer certificate will be rejected.

Allow requests based on requests being signed

This option also has two sub-filters as in above case:

• The access will be allowed only to those clients whose SCVP request signing certificate's issuer is registered in the Trust Manager. 
• The access will be allowed or denied to those clients whose SCVP request signing certificate issuer is registered in the Trust Manager but additional restrictions are applied based on the signer certificate's DN. For example, by choosing the option to "Include following DN attributes" and set O=Ascertia. This allows access to SCVP requests having the issuer is registered in Trust Manager but DN also contains "Ascertia" as its organization. Requests that does not pass the defined certeria based on the SCVP request signing certificate will be rejected.

Allow access based on IP addresses

This option allows or denies the client's access to the SCVP service based on the IP address. Wildcards “*” can also be used in the allowed or denied IP address strings. The list is processed top-down until a match is found.

• Allow Access Example: Choose the option Include IP address and entering IP address e.g. 192.168.1.1 allows SCVP service access to this IP address only. Rest of the IPs will be allowed. 
• Deny Access Example: Choose the option Exclude IP address and entering IP address e.g. 192.168.1.2 denies SCVP service access to this IP address only. Rest of the IPs will be rejected.
• Wildcard Example: Choose any option i.e. Exclude IP address or Include IP address and enter IP address e.g. 192.168.*.* to deny/allow SCVP service access to any IP address falling in this IP range.

Note that at least one include entry must be entered before an exclude entry is specified in all the above cases. The SCVP service must be restarted for the changes to take into effect.