AWS privateca high security documentation change
Summary
Corrected configuration steps for SCEP connector with Microsoft Intune, fixing parameter values for OpenID subject and audience fields.
Security assessment
Fixes misconfiguration steps that previously swapped OpenID 'Subject' and 'Audience' values. Incorrect configuration could lead to authentication failures or unauthorized certificate issuance, addressing a potential security risk.
Diff
diff --git a/privateca/latest/userguide/connector-for-scep-intune.md b/privateca/latest/userguide/connector-for-scep-intune.md index a975688e6..f938dcb3f 100644 --- a//privateca/latest/userguide/connector-for-scep-intune.md +++ b//privateca/latest/userguide/connector-for-scep-intune.md @@ -54 +54 @@ After you create a Connector for SCEP for Microsoft Intune, you must create a fe - 8. Copy and paste the **OpenID Audience** value from your Connector for SCEP for Microsoft Intune details into the **Audience** field. To view a connector's details, choose the connector from the [Connectors for SCEP](https://console.aws.amazon.com/pca-connector-scep/home#/connectors) list in the AWS console. Alternatively, you can get the URL by calling [GetConnector](https://docs.aws.amazon.com/pca-connector-scep/latest/APIReference/API_GetConnector.html) and then copy the `Subject` value from the response. + 8. For **Type** , select **Explicit subject identifier**. @@ -56 +56 @@ After you create a Connector for SCEP for Microsoft Intune, you must create a fe - 9. (Optional) Enter the name of the instance in the **Name** field. For example, you can name it **AWS Private CA**. + 9. Copy and paste **OpenID subject** value from your connector into the **Value** field. You can view the OpenID issuer value in the connector details page in the AWS console. Alternatively, you can get the URL by calling [GetConnector](https://docs.aws.amazon.com/pca-connector-scep/latest/APIReference/API_GetConnector.html) and then copy the `Audience` value from the response. @@ -58 +58 @@ After you create a Connector for SCEP for Microsoft Intune, you must create a fe - 10. (Optional) Enter a description into the **Description** field. + 10. (Optional) Enter the name of the instance in the **Name** field. For example, you can name it **AWS Private CA**. @@ -60 +60 @@ After you create a Connector for SCEP for Microsoft Intune, you must create a fe - 11. Select **Edit (optional)** under the **Audience** field. Copy and paste **OpenID subject** value from your connector into the **Subject** field. You can view the OpenID issuer value in the connector details page in the AWS console. Alternatively, you can get the URL by calling [GetConnector](https://docs.aws.amazon.com/pca-connector-scep/latest/APIReference/API_GetConnector.html) and then copy the `Audience` value from the response. + 11. (Optional) Enter a description into the **Description** field. @@ -62 +62,3 @@ After you create a Connector for SCEP for Microsoft Intune, you must create a fe - 12. Select **Add**. + 12. Copy and paste the **OpenID Audience** value from your Connector for SCEP for Microsoft Intune details into the **Audience** field. To view a connector's details, choose the connector from the [Connectors for SCEP](https://console.aws.amazon.com/pca-connector-scep/home#/connectors) list in the AWS console. Alternatively, you can get the URL by calling [GetConnector](https://docs.aws.amazon.com/pca-connector-scep/latest/APIReference/API_GetConnector.html) and then copy the `Subject` value from the response. + + 13. Select **Add**.