Certificates scripts

The certificate script class is instantiated the first time a certificate is requested. The process() method is called every time a certificate is requested.

• Scripts are executed in the following working directory on the OMi gateway server:

  hpbsm_opr-scripting-host

• Logging information is written to the following log file:

  <OMi_HOME>/log/opr-scripting-host/opr-scripting-host.log

Scripts are stored in the database, and can be accessed from the OMi console.

To configure a certificate script:

1. In OMi, navigate to the Certificate Requests manager:

   Administration > Setup and Maintenance > Certificate Requests

   Alternatively, click Certificate Requests.

   The Certificate Requests tab lists all certificate requests that have been received during the time range selected in the drop-down list.

2. Click the Autogrant Script tab. The default Autogrant Script is shown, which grants or denies certificates based on the value of the request's nodeName attribute. The default script is not activated by default.

   • To customize the script, click  Edit Item, or double-click the script window, and make the required changes.

   • To activate the script, click  Activate Item.

Only one script can be configured as certificate script. The script is activated as soon as it is configured. If no certificate scripts is needed, deactivate the Autogrant Script script by clicking  Deactivate Item.

The following example grants or denies certificate request based on the requester's subnet.

import java.net.InetAddress;
import java.util.Date;
import java.util.List;
import com.hp.opr.api.scripting.CertificateRequest;

class AutoGrantTest
{
  def init()
  {
  }

  def destroy()
  {
  }

  Boolean boolInSubnet( String IPAddress )
  {
    // Check if the passed IP address
    // is in the allowed subnet.
    String stringAllowedSubnet = "128.0";

    ByteOne = IPAddress.indexOf('.');
    ByteTwo = IPAddress.indexOf('.', ByteOne + 1 );

    String stringSubnet;
    stringSubnet = IPAddress.substring( 0, ByteTwo );

    return( stringSubnet.equals( stringAllowedSubnet ) );
  }

  def process(List<CertificateRequest> requests)
  {
    // Retrieve the first request object.
    def request = requests.get(0);
	
    if ( boolInSubnet( request.getIpAddress() ) )
    {
      request.deny();
    }
    else
    {
      request.grant();
    }
  }
}