Ctrlk
linkedinx-twitter
For the complete documentation index, see llms.txt. This page is also available as Markdown.

General Configuration

To allow SCEPman to handle incoming SOAP requests successfully, we need to take a few steps:

1

Custom Domain

For successful authentication with SCEPman, ensure that a custom domain using an A record is pointed to the App Service. Otherwise, the client will fail to request a valid Kerberos ticket from the domain controller.

The custom domain does not have to resemble the FQDN of your AD domain. So having a domain ad.contoso.local does not mean you need an identical or similar custom domain for SCEPman.

See the known issue below regarding WS_E_ENDPOINT_ACCESS_DENIED for more information.

Ensure that SCEPman is configured to be accessible using a custom domain:

Custom Domain
2

BaseUrl

To allow successful authentications, make sure the AppConfig:BaseUrl variable matches your custom domain.

Setting
Value

AppConfig:BaseUrl

Example: scepman.contoso.com

Alternatively, if you prefer accessing the AD Endpoint using a different URL from your other SCEPman endpoints, use the dedicated AppConfig:ActiveDirectory:BaseUrl setting.

Setting
Value

AppConfig:ActiveDirectory:BaseUrl

Example: adendpoint.contoso.com

3

Create Service Principal

Use the New-SCEPmanADPrincipal Cmdlet of the SCEPman PowerShell module to create the service principal in your on-prem Active Directory domain. It will also export a keytab from this account and encrypt it to SCEPman's CA certificate.

You can execute this command on a domain controller or domain-joined server that has installed the RSAT-AD-Tools feature. You will also need the following permissions in the OU that you want to create the principal in:

On OU itself:

  • Create computer objects

On descendant computer objects:

  • Reset password

  • Write msDS-SupportedEncryptionTypes

  • Write servicePrincipalName

  • Write userPrincipalName

The variant below also requires outgoing HTTPS network access to your SCEPman instance.

If your computer with access to a Domain Controller doesn't have network access, there are variants of the CMDlet that work without it, but require some additional preparation, such as downloading the SCEPman CA certificate and copying the CA to the machine that runs the CMDlet.

Install-Module SCEPman -Force
New-SCEPmanADPrincipal -Name "SCEPmanAD" -AppServiceUrl "scepman.contoso.com" -OU
"OU=Example,DC=contoso,DC=local"

Running this command will perform the following:

  1. Create a computer object in the OU=Example,DC=contoso,DC=local Organizational Unit.

  2. Download SCEPman's CA certificate to encrypt the keytab in step 5.

  3. Add a service principal name (SPN) to the computer object.

  4. Create a keytab for the computer account containing the encryption key based on the computer's password.

  5. Encrypt the keytab with the CA certificate of SCEPman, so only SCEPman can decrypt it again using the CA private key.

  6. Output the encrypted keytab, so it can be transferred to SCEPman's configuration.

The Base64 encoded output must then be added to the environment variable AppConfig:ActiveDirectory:Keytab on your SCEPman App Service.

4

Add Keytab to SCEPman

The integration can easily be enabled by adding the following environment variables in the SCEPman App Service. Depending on your use case, enable one or more of the available certificate templates:

Example with all certificate templates enabled:

Setting
Value

AppConfig:ActiveDirectory:Keytab

Base64 encoded keytab for the service principal created in Step 3

AppConfig:ActiveDirectory:Computer:Enabled

true

AppConfig:ActiveDirectory:User:Enabled

true

AppConfig:ActiveDirectory:DC:Enabled

true

AppConfig:ActiveDirectory:RdpServer:Enabled

true

Known Issues

WS_E_ENDPOINT_ACCESS_DENIED

Error: WS_E_ENDPOINT_ACCESS_DENIED 
Hex: 0x803d0005
Dec: -2143485947

This error is known to occur during the validation of the CEP server when you are using the default URIs of the Azure App Service. This error is caused by the Kerberos protocol asking for a service principal name of the A record of the service that is to be accessed. In the case of the default app service domains, for example contoso.azurewebsites.net is a CNAME and points to an A record similar to:

waws-prod-ab1-234-c56d.westeurope.cloudapp.azure.com

As this A record of an infrastructure host is not guaranteed to be consistent in the future, adding a service principal name for this host is not recommended.

Make sure to add a custom domain to your app service and use an A record within your DNS provider to point it to the app service instead of a CNAME.

Custom Domain

ERROR_INVALID_PARAMETER

Error: ERROR_INVALID_PARAMETER
Hex: 0x80070057
Dec: -2147024809

This error occurs during the CEP server registration if you enter an URI that begins with http://. Make sure to only register a CEP server using https:// .

ERROR_ACCESS_DENIED

When registering a CEP server in machine context, the acting user (the account that started gpmc.msc) needs to be a member of the local Administrators group on the computer while editing the GPO.

Make sure to start gpmc.msc with elevated permissions in this case.

Last updated

Was this helpful?