Chat now with support
Chat with Support

We are currently experiencing issues on our phone support and are working diligently to restore services. For support, please sign in and create a case or email for assistance

Safeguard Authentication Services 5.0.1 - Administration Guide

Privileged Access Suite for Unix Introducing One Identity Safeguard Authentication Services Unix administration and configuration Identity management Migrating from NIS Managing access control Managing local file permissions Certificate Autoenrollment Integrating with other applications Managing Unix hosts with Group Policy
Safeguard Authentication Services Group Policy
Group Policy Concepts Unix policies One Identity policies
Display specifiers Troubleshooting Glossary

Processed Files List file

The Processed Files List file contains a list of files and directories for which the ownership was changed. It is produced by oat_changeowners. Backup files are saved in /var/opt/quest/oatwork.

<file_list> ::= { <full_file_name> '(' <original_permissions> ')' <CRLF> }
<full_file_name> ::= <character> { <character> }
<original_permissions> ::= <character> { <character> }

Certificate Autoenrollment

Certificate Autoenrollment is a feature of Safeguard Authentication Services based on Microsoft Open Specifications. Certificate Autoenrollment allows macOS/macOS®, UNIX, and Linux clients to take advantage of existing Microsoft infrastructure to automatically enroll for and install certificates. Certificate policy controls which certificates are enrolled and what properties those certificates will have.

With Certificate Autoenrollment, a public/private key pair is automatically generated according to certificate template parameters defined in Group Policy. The public key is sent to the Certification Authority (CA), and the CA responds with a new certificate corresponding to the public key, which is installed along with the private key into the appropriate system or user keychain on the Mac , UNIX, or Linux client.

You can use Group Policy to automatically configure which certificate enrollment policy servers to use for Certificate Autoenrollment and to periodically run Certificate Autoenrollment.

By following the instructions presented in this section, a system administrator will be able to configure new or existing systems to download certificate enrollment policy from a certificate enrollment policy server. Additionally, the systems will automatically enroll and renew certificates based on the certificate enrollment policy.

Certificate Autoenrollment is an optional package distributed with One Identity Safeguard Authentication Services. For instructions on installing this package, see the One Identity Safeguard Authentication Services Installation Guide.

Certificate Autoenrollment on UNIX and Linux

Most of the Certificate Autoenrollment code is implemented in Java. After this code has successfully requested a certificate from a CA, it invokes platform-specific code to store the private key and certificate in a suitable way for the operating system or for particular applications. This platform-specific code is implemented as a shell script,, in the /var/opt/quest/vascert/script directory.

The script is a platform-agnostic front end that chooses and loads a platform-specific back end script:

  • For macOS, the back end script is This script provides a fully functional implementation that uses the /usr/bin/security tool to integrate with macOS keychains.
  • For UNIX/Linux, the back end script is This script provides a skeletal implementation that is convenient for initial experimentation and may be used as the basis for implementation; the script itself does not provide a fully functional implementation:
    • Some of the shell functions in simply print "UNIMPLEMENTED" and return a non-zero exit status to indicate failure.
    • The following shell functions in are mock implementations designed to facilitate simple experimentation with the "vascert pulse" command for a user:
      • importIdentity()
      • exportUserCerts()
    • These mock implementations assume that the openssl command is installed and available on the default PATH.
    • The mock implementations also make some platform-specific assumptions (for example, they invoke the mv command with the --backup option), but these are not critical and can be removed.

    As a consequence, on UNIX/Linux some important Certificate Autoenrollment commands, such as "vascert pulse" for the superuser will NOT work until the necessary platform-specific functionality has been implemented in or a similar script.

See the Examples and further explanation for modifying on Linux and Unix (284711) KB article for more information on modifying and a simple example script.

Certificate Autoenrollment requirements and setup

Prior to installing One Identity Certificate Autoenrollment, ensure your system meets the following minimum hardware and software requirements.

Table 19: Certificate Autoenrollment: Minimum requirements
Component Requirements
Operating system

macOS 10.13 (or later)

Red Hat® Enterprise Linux® 6 (or later)

Oracle Solaris® 11 (or later)

SUSE® Linux Enterprise Server 11 (or later)

Ubuntu® 14.04 LTS (or later)

Java unlimited strength policy files For more information, see Java requirement: Unlimited Strength Jurisdiction Policy Files.
Authentication Services

One Identity Authentication Services version 4.1.2 (or later).

Additional software

Certificate Autoenrollment depends on services provided by a Microsoft Enterprise Certificate Authority (CA) in your environment.

In addition to Active Directory and an Enterprise CA, you must install the following software in your environment:

  • Microsoft Certificate Enrollment Web Services

In order for Certificate Autoenrollment to function on client computers, you must configure the following policies:

  • Certificate Services Client - Auto-Enrollment Group Policy
  • Certificate Services Client - Certificate Enrollment PolicyGroup Policy
  • Certificate Templates

Additionally, you must configure Java 1.6 (or later) as the default JVM for your system.

NOTE: Install JRE (Java Runtime Environment) on all platforms other than macOS; macOS requires JDK (Java Development Kit). Typing java on the command line provides instructions.

  • For Linux/UNIX operating systems, install JRE 1.6 (or later).
  • For Mac OS X (that is, your operating system tells you to get it from Apple), install what Apple provides (JRE).
  • For macOS (that is, your operating system tells you to get it from Oracle), install the JDK.


Enterprise Administrator rights to install software and configure Group Policy and Certificate Template policy (only if Certificate Autoenrollment is not already configured for Windows hosts in your environment.)

Related Documents

The document was helpful.

Select Rating

I easily found the information I needed.

Select Rating