1. A method, implemented by a computing system programmed to perform operations, comprising:
establishing a secure connection with a client computing system using an authentication protocol that uses symmetric-key cryptography;
receiving, by an identity management system of the computing system, a request from a client agent of the client computing system over the secure connection to perform a certificate operation associated with a certificate;
determining whether to approve the request from the client agent; and
sending the request to a certificate authority (CA) to perform the certificate operation when approved, wherein the identity management system is a trusted manager of the CA.
2. The method of claim 1, wherein the authentication protocol is the Kerberos authentication protocol.
3. The method of claim 1, wherein the client computing system is a service provider that provides a service to one or more clients over a network.
4. The method of claim 1, wherein the certificate operation is at least one of requesting the certificate, renewing the certificate, checking a request status of the certificate, retrieving the certificate, putting the certificate on hold, removing the certificate from being on hold, and revoking the certificate.
5. The method of claim 1, wherein the certificate operation is requesting the certificate, wherein said receiving the request comprises receiving a certificate signing request (CSR) from the client agent, wherein the CSR contains information identifying an owner of the certificate and a public key, and wherein said determining whether to approve comprises the method further comprises:
determining if the client computing system has permission to request certificates;
determining if a hostname of the client computing system matches a subject name of the certificate;
stopping the sending of the CSR to the CA when the hostname and the subject name do not match or the client computing system does not have permission; and
allowing the sending of the CSR to the CA to approve and issue the certificate when the hostname and the subject name match and when the client computing system has permission to request certificates, wherein the CSR is not authenticated by the CA.
6. The method of claim 5, wherein said determining if the client computing system has permission to request certificates comprises checking an access control instruction (ACI) that specifies whether the client computing system has permission to request certificates.
7. The method of claim 1, wherein the certificate operation is requesting the certificate, wherein said receiving the request comprises receiving a certificate signing request (CSR) from the client computing system, wherein the CSR contains information identifying an owner of the certificate and a public key, and wherein said determining whether to approve comprises the method further comprises:
retrieving a service principle record associated with the client computing system;
determining if the service principle record already has a user certificate attribute;
stopping the sending of the CSR to the CA when the service record already has the user certificate attribute; and
allowing the sending of the CSR to the CA to approve and issue the certificate when the service principle record does not already have the user certificate attribute, wherein the CSR is not authenticated by the CA.
8. The method of claim 7, further comprising:
if the service principle record associated with the CSR does not exist, determining if an add argument is received in connection with the CSR, wherein the add argument requests permission to modify the user certificate attribute;
determining if the client computing system has permission to modify the user certificate attribute, wherein the client computing system has permission to modify the user certificate attribute when the client computing system is listed in the service principal record;
stopping the sending of the CSR to the CA when the add argument is not received in connection with the CSR or when the client computing system does not have permissions to modify the user certificate attribute; and
allowing the sending of the CSR to the CA when the add argument is received in connection with the CSR and the client computing system has permission to modify the user certificate attribute, wherein the CSR is not authenticated by the CA.
9. The method of claim 1, wherein the certificate operation is retrieving the certificate, wherein said receiving the request comprises receiving the request from the client computing system, wherein the request identifies the certificate to be retrieved, and wherein said determining whether to approve comprises the method further comprises determining if a hostname of the client computing system matches a subject name of the certificate, and wherein the method further comprises delivering the certificate to the client computing system when the hostname and the subject name match, wherein said delivering the certificate comprises delivering the certificate to the client computing system without user intervention at the client computing system.
10. The method of claim 1, wherein the certificate operation is retrieving the certificate, wherein said receiving the request comprises receiving the request from the client computing system, wherein the request identifies the certificate to be retrieved, and wherein said determining whether to approve comprises the method further comprises:
determining if the client computing system has permission to retrieve the certificate;
determining if a hostname of the client computing system matches a subject name of the certificate, and wherein said sending comprises sending the certificate to the client computing system when the hostname and the subject name match and when the client computing system has permission to request certificates.
11. The method of claim 1, further comprising:
creating a host principal for the client computing system using a password;
creating a Hypertext Transfer Protocol (HTTP) service principal for the host principal;
allowing the host to manage a user certificate attribute of the HTTP service principal; and
allowing the host to manage certificates, including allowing the host to request the certificate operation.
12. The method of claim 11, further comprising:
configuring the host to use a Kerberos realm of the identity management system;
allowing the host to join the realm and to retrieve a Kerberos keytab to allow the host to authenticate to the identity management system, wherein the Kerberos keytab is a file that includes an unencrypted list of principals of the Kerberos realm and their corresponding keys; and
sending a Kerberos ticket to the host for the client computing system to establish the secure connection for receiving the request to perform the certificate operation.
13. An identity management system, comprising:
a key distribution center (KDC), wherein the KDC is configured to establish a secure connection with a client computing system using an authentication protocol that uses symmetric-key cryptography; and
a registration authority (RA) coupled to receive a request from a client agent of the client computing system over the secure connection to perform a certificate operation associated with a certificate, wherein the RA is configured to determine whether to approve the request from the client agent and to send the request to a certificate authority (CA) to perform the certificate operation when approved, wherein the RA is a trusted manager of the CA.
14. The identity management system of claim 13, wherein the certificate operation is requesting the certificate, wherein the RA is further configured receive a certificate signing request (CSR) generated by the client agent of the client computing system, wherein the CSR contains information identifying an owner of the certificate and a public key and the CSR is digitally signed by a private key.
15. The identity management system of claim 14, further comprising a directory server coupled to a data storage device, wherein the data storage device stores a service principal record associated with the client computing system, and wherein the RA is configured to retrieve the service principal record via the directory server to determine whether to approve the request of the certificate operation.
16. The identity management system of claim 13, further comprising a certificate services manager to receive a certificate signing request (CSR) from the client computing system, wherein the CSR contains information identifying an owner of the certificate and a public key, wherein the certificate services manager comprising:
a user authorization module to determine if the client computing system has permission to request certificates; and
a certificate request authorization module to determine if a hostname of the client computing system matches a subject name of the certificate, and wherein the certificate services manager sends the CSR to the CA to approve and issue the certificate when the hostname and the subject name match and when the client computing system has permission to request certificates, wherein the CSR is not authenticated by the CA.
17. The identity management system of claim 13, further comprising:
a network time protocol (NTP) server to synchronize clocks of the identity management server and the client computing system; and
a domain name system (DNS) server to resolve a machine name of the client computing system or to inversely resolve a network address of the client computing system.
18. A machine-readable storage medium having instructions, which when executed, cause a computing device to perform a method comprising:
establishing a secure connection with a client computing system using an authentication protocol that uses symmetric-key cryptography;
receiving a request from a client agent of the client computing system over the secure connection to perform a certificate operation associated with a certificate;
determining whether to approve the request from the client agent; and
sending the request to a certificate authority (CA) to perform the certificate operation when approved.
19. The machine-readable storage medium of claim 18, wherein the certificate operation is requesting the certificate, wherein said receiving the request comprises receiving a certificate signing request (CSR) from the client computing system, wherein the CSR contains information identifying an owner of the certificate and a public key, and wherein said determining whether to approve comprises the method further comprises:
determining if the client computing system has permission to request certificates;
determining if a hostname of the client computing system matches a subject name of the certificate, and wherein said sending the request comprises sending the CSR to the CA to approve and issue the certificate when the hostname and the subject name match and when the client computing system has permission to request certificates, wherein the CSR is not authenticated by the CA.
20. The machine-readable storage medium of claim 18, further comprising:
configuring the host to use a Kerberos realm of the identity management system; and
allowing the host to join the realm and retrieve a Kerberos keytab to allow the host to authenticate to the identity management system, wherein the Kerberos keytab is a file that includes an unencrypted list of principals of the Kerberos realm and their corresponding keys; and
sending a Kerberos ticket to the host for the client computing system to establish the secure connection for receiving the request to perform the certificate operation.
The claims below are in addition to those above.
All refrences to claim(s) which appear below refer to the numbering after this setence.
1-30. (canceled)
31. An addition compound of a carboxylic acid and a rare earth or gallium chloride or a rare earth or gallium halogenocarboxylate of the same carboxylic acid, said addition compound having the formula:
MXnA3\u2212n, xAH
Wherein: M represents a trivalent rare earth, or gallium, A represents the anionic portion of a carboxylic acid AH, X represents a chlorine, n satisfies the relationship 0<n<3 for (2), and x is a number being more than 0 and less than 3 inclusive.
32. The compound according to claim 31, wherein the rare earth is neodymium, praseodymium, lanthanum, gadolinium, samarium or cerium.
33. The compound according to claim 31, wherein the carboxylic acid is an acid containing at least 6 carbon atoms.
34. The compound according to claim 33, wherein the carboxylic acid has between 6 and 32 carbon atoms.
35. The compound according to claim 31, further being in solution in a solvent selected from the group consisting of alkanes, cycloalkanes, aromatic solvents and mixtures thereof.
36. An addition compound of a carboxylic acid and a halogenocarboxylate according to claim 31, having a chlorine rare earth or gallium atomic ratio of less than 3.
37. The compound according to claim 36, further in the form of a solution with a water content less than 1000 ppm.
38. A process for the preparation of a compound as defined in claim 31, comprising the step of reacting HX, wherein X representing a chlorine, with a rare earth or gallium carboxylate in a solvent selected from the group consisting of alkanes, cycloalkanes, aromatic solvents and mixtures thereof, the reaction being carried out with an Xrare earth or gallium atomic ratio of less than 3 in the case of preparation of a chlorocarboxylate.
39. The process according to claim 38, wherein the HX is reacted in the gaseous form.
40. The process according to claim 38, wherein the solvent forms an azeotrope with water.
41. A process for preparing an anhydrous addition compound of a rare earth or gallium chloride and a nitrogen or oxygen donor compound, comprising the steps of:
a) reacting a mixture rare earth or gallium carboxylate with HX, X representing a chlorine, in a solvent selected from the group consisting of alkanes, cycloalkanes, aromatic solvents and mixtures thereof, to form an addition compound of a carboxylic acid and a rare earth or gallium chloride; and
b) adding a nitrogen or oxygen donor compound to the mixture obtained in step a), said donor compound being linear or cyclic aliphatic ether-oxides, aliphatic glycol ethers, aliphatic ketones, aliphatic amides, aliphatic nitriles, aliphatic sulphoxides or hexamethylphosphotriamide, to precipitate an addition compound of a rare earth or gallium chloride and said nitrogen or oxygen donor compound.
42. A process for preparing an anhydrous addition compound of a neodymium or cerium chloride and a nitrogen or oxygen donor compound, comprising the steps of:
a) reacting a neodymium or cerium carboxylate with HX, X representing a chlorine, in a solvent selected from the group consisting of alkanes, cycloalkanes, aromatic solvents and mixtures thereof, to form a medium comprising an addition compound of a carboxylic acid and a neodymium or cerium chloride; and
b) adding ethanol to the medium obtained in step a) to precipitate the addition compound of neodymium or cerium chloride and ethanol.
43. The process according to claim 41, wherein the rare earth is neodymium, praseodymium, lanthanum, gadolinium, samarium or cerium.
44. The process according to claim 43, wherein the solvent forms an azeotrope with water.
45. The process according to claim 44, wherein the solvent is hexane, cyclohexane, toluene, benzene or xylene.
46. The process according to claim 41, wherein the nitrogen or oxygen donor compound is tetrahydrofuran, acetone, 1,4-dioxane or acetonitrile.
47. The process according to claim 42, wherein the nitrogen or oxygen donor compound is tetrahydrofuran, acetone, 1,4-dioxane or acetonitrile.
48. An anhydrous addition compound of a rare earth or gallium chloride and a nitrogen or oxygen donor compound selected from the group consisting of linear and cyclic aliphatic ether-oxides, aliphatic glycol ethers, aliphatic ketones, aliphatic amides, aliphatic nitriles, aliphatic sulphoxides and hexamethylphosphotriamide, made by the process of:
a) reacting a rare earth or gallium carboxylate with HX, X representing a chlorine, in a solvent selected from the group consisting of alkanes, cycloalkanes, aromatic solvents and mixtures thereof, to form an addition compound of a carboxylic acid and a rare earth or gallium chloride; and
b) adding a nitrogen or oxygen donor compound to the mixture obtained, said donor compound being linear or cyclic aliphatic ether-oxides, aliphatic glycol ethers, aliphatic ketones, aliphatic amides, aliphatic nitriles, aliphatic sulphoxides or hexamethylphosphotriamide, to precipitate an addition compound of a rare earth or gallium chloride and said nitrogen or oxygen donor compound, said addition compound having a rare earth or gallium oxychloride content of at most 1000 ppm.
49. The compound according to claim 48, wherein the rare earth is neodymium, praseodymium, lanthanum, gadolinium, samarium or cerium.
50. An addition compound of a neodymium or cerium chloride and ethanol having a rare earth content of at most 1000 ppm, made by the process of:
a) reacting a neodymium or cerium carboxylate with HX, X representing a halogen, in a solvent selected from the group consisting of alkanes, cycloalkanes, aromatic solvents and mixtures thereof; and
b) adding ethanol to the medium obtained to precipitate an addition compound of neodymium or cerium chloride and ethanol.
51. The compound according to claim 48, wherein the nitrogen or oxygen donor compound is tetrahydrofuran, acetone, 1,4-dioxane or acetonitrile.
52. The compound according to claim 48, having the formula: LaCl3, \xb71.5THF, CeCl3 \xb71.2THF or NdCl3 (dioxane)2.5.
53. The compound according to claim 48, having a water content of less than 5500 ppm.
54. The compound according to claim 53, having a water content of less than 500 ppm.
55. A catalyst for polymerising or copolymerising unsaturated compounds, comprising a compound as defined in claim 48.
56. A catalyst for acylating aromatic compounds comprising a compound as defined in claim 48.
57. A catalyst, obtained from the reaction of an addition compound of a carboxylic acid and a chlorocarboxylate as defined in claim 31 with an organometallic compound.
58. The catalyst according to claim 57, wherein the metallic element of the organometallic compound is aluminium, magnesium or lithium.