Grant or deny certificate requests using a script

Administration > Setup and Maintenance > Certificate Requests

Alternatively, click Certificate Requests.

Click the Autogrant Script tab.

OMi gateway servers and other HPE BTO Software applications use certificates to identify themselves and communicate securely with each other. The data processing server acts as a certificate authority. It can issue the required certificates to other computers in your environment, in response to the certificate requests that it receives.

1. In the Certificate Requests manager, click the Autogrant Script tab.

2. Click the  Edit Item button. The Certificate Autogrant Configuration dialog box opens.

3. In Script, type or paste the Groovy script that you want to use. By default, the dialog box provides a script template, which you can modify to suit your requirements.

   The basic format for a script that handles certificate requests is as follows:

   import java.net.InetAddress;
   import java.util.Date;
   import java.util.List;
   import com.hp.opr.api.scripting.CertificateRequest;
   
   def init()
   {
     // This method is called when the script is loaded (for example, 
     // when you activate it in the Autogrant Script tab).
   }
   
   def destroy()
   {
     // This method is called when the script is unloaded (for 
     // example, when you deactivate it in the Autogrant Script tab).
   }
   
   def process(List<CertificateRequest> requests)
   {
     // This method is called each time a certificate request 
     // arrives. The argument contains a list of certificate requests 
     // that have the status new. The list is of type java.util.List.
   
     // Use CertificateRequest methods to get details of the requests
     // and grant or deny them.
   }

   The following table lists the certificate management methods that you can use.

   Return Type	Function	Description
   void	deny()	Denies the certificate request. The data processing server informs the computer that its certificate request is denied.
   Stringclass in java.lang	getCommonName()	Returns the OvCoreID from the certificate request. The OvCoreID is generated by the HPE BTO Software application to uniquely identify the computer.
   Stringclass in java.lang	getContext()	Returns the context from the certificate request. The context may contain additional text that provides extra information.
   Stringclass in java.lang	getInstallation()	Returns the installation type, which can be one of the following: Manual The HPE BTO Software application was installed manually. Automatic The HPE BTO Software application was deployed from a server (for example, an Operations Management server).
   InetAddressclass in java.net	getIpAddress()	Returns the IP address that the certificate request originates from.
   Stringclass in java.lang	getNodeName()	Returns the host name of the computer that sent the certificate request.
   InetAddressclass in java.net	getPeerAddress()	Returns the IP address of a proxy or gateway, through which the data processing server can reach the certificate client that sent the certificate request.
   Stringclass in java.lang	getPlatform()	Returns the operating system and processor type of the computer that sent the certificate request.
   Dateclass in java.util	getTimeReceived()	Returns the time that the data processing server received the certificate request.
   void	grant()	Grants the certificate request. The data processing server sends certificates to the computer.

   The following example script grants certificate requests from computers that have a name that ends with example.com:

   import java.net.InetAddress;
   import java.util.Date;
   import java.util.List;
   import com.hp.opr.api.scripting.CertificateRequest;
   
   def init(){}
   
   def destroy(){}
   
   def process(List<CertificateRequest> requests)
   {
       def request = requests.get(0)
       def nodeName = request.getNodeName()
       if (nodeName.endsWith("example.com"))
       {
         request.grant()
       }
       else
       {
         request.deny()
       }
   }

4. If your script has dependencies to external functionality, you can upload class path resources that provide this functionality. It is not necessary to upload OMi resources.

   Click the Add Resource button to upload class path resource files from your computer.

   Note The maximum file size that you can upload is determined by Max file upload size in KB infrastructure setting (Infrastructure Settings > Foundations > Security > Security - File upload). For more information about this setting, see the online help.

5. Click OK to save the script and close the Certificate Autogrant Configuration dialog box.

6. The script is initially inactive. Click the Activate Item button to activate the script.