| type=page |
| status=published |
| title=enable-secure-admin-principal |
| next=export.html |
| prev=enable-secure-admin-internal-user.html |
| ~~~~~~ |
| enable-secure-admin-principal |
| ============================= |
| |
| [[enable-secure-admin-principal-1]][[GSRFM00131]][[enable-secure-admin-principal]] |
| |
| enable-secure-admin-principal |
| ----------------------------- |
| |
| Instructs \{product---name}, when secure admin is enabled, to accept |
| admin requests from clients identified by the specified SSL certificate. |
| |
| [[sthref1143]] |
| |
| Synopsis |
| |
| [source,oac_no_warn] |
| ---- |
| asadmin [asadmin-options] enable-secure-admin-principal [--help] |
| --alias aliasname | DN |
| ---- |
| |
| [[sthref1144]] |
| |
| Description |
| |
| The `enable-secure-admin-principal` subcommand instructs |
| \{product---name} to accept admin requests when accompanied by an SSL |
| certificate with the specified distinguished name (DN). If you use the |
| "`--alias` aliasname" form, then \{product---name} looks in its |
| truststore for a certificate with the specified alias and uses the DN |
| associated with that certificate. Otherwise, \{product---name} records |
| the value you specify as the DN. |
| |
| You must specify either the `--alias` option, or the DN. |
| |
| You can run `enable-secure-admin-principal` multiple times so that |
| \{product---name} accepts admin requests from a client sending a |
| certificate with any of the DNs you specify. |
| |
| When you run `enable-secure-admin`, \{product---name} automatically |
| records the DNs for the admin alias and the instance alias, whether you |
| specify those values or use the defaults. You do not need to run |
| `enable-secure-admin-principal` yourself for those certificates. Other |
| than these certificates, you must run `enable-secure-admin-principal` |
| for any other DN that \{product---name} should authorize to send admin |
| requests. This includes DNs corresponding to trusted certificates (those |
| with a certificate chain to a trusted authority.) |
| |
| [[sthref1145]] |
| |
| Options |
| |
| asadmin-options:: |
| Options for the `asadmin` utility. For information about these |
| options, see the link:asadmin.html#asadmin-1m[`asadmin`(1M)] help page. |
| `--help`:: |
| `-?`:: |
| Displays the help text for the subcommand. |
| `--alias`:: |
| The alias name of the certificate in the trust store. |
| \{product---name} looks up certificate in the trust store using that |
| alias and, if found, stores the corresponding DN as being valid for |
| secure administration. Because alias-name must be an alias associated |
| with a certificate currently in the trust store, you may find it most |
| useful for self-signed certificates. |
| |
| [[sthref1146]] |
| |
| Operands |
| |
| DN:: |
| The distinguished name of the certificate, specified as a |
| comma-separated list in quotes. For example, |
| `"CN=system.amer.oracle.com,OU=GlassFish,O=Oracle Corporation,L=Santa Clara,ST=California,C=US"`. |
| |
| [[sthref1147]] |
| |
| Examples |
| |
| [[GSRFM608]][[sthref1148]] |
| |
| Example 1 Trusting a DN for secure administration |
| |
| The following example shows how to specify a DN for authorizing access |
| in secure administration. |
| |
| [source,oac_no_warn] |
| ---- |
| asadmin> enable-secure-admin-principal |
| "CN=system.amer.oracle.com,OU=GlassFish, |
| O=Oracle Corporation,L=Santa Clara,ST=California,C=US" |
| |
| Command enable-secure-admin-principal executed successfully. |
| ---- |
| |
| [[sthref1149]] |
| |
| Exit Status |
| |
| 0:: |
| subcommand executed successfully |
| 1:: |
| error in executing the subcommand |
| |
| [[sthref1150]] |
| |
| See Also |
| |
| link:asadmin.html#asadmin-1m[`asadmin`(1M)] |
| |
| link:disable-secure-admin-principal.html#disable-secure-admin-principal-1[`disable-secure-admin-principal`(1)], |
| link:enable-secure-admin.html#enable-secure-admin-1[`enable-secure-admin`(1)] |
| |
| |
