.png){kind=logo}
Enterprise
The Signed Request Authorizer requires signed signature requests and that there is a rule matching one of the fields of the client certificate in the Worker authorization list. Signed signature requests enable signature requests to be signed by a remote client allowing an end-to-end authorization mechanism for deployment scenarios with proxies or similar between the client and the server.
Fully qualified class name: AUTHTYPE=org.signserver.server.enterprise.signedrequest.SignedRequestAuthorizer
For information on how to list, add, and remove rules, see the Worker Authorization Page in the AdminWeb, or the authorizedclients command in the Administration CLI. Note that this is handled the same way as for the Client Certificate Authorizer.
Additionally, the authorizer can be configured to also require a TLS client certificate to be present. In that case, any valid client certificate, as verified by the server, will be accepted since the authorization rules for this authorizer only applies to the signed request and not the TLS client certificate. This is different from the Client Certificate Authorizer which instead uses the authorization rules for the TLS client certificate.
Available Properties
|
Required Property |
Default |
Description |
|---|---|---|
|
|
Not set |
Specifies a PEM-encoded set of trusted certificates to use when verifying the certificate chain of the signed request. |
|
Property |
Default |
Description |
|
|
|
(Optional) If Currently, only OCSP is supported. When enabled, certificates in the chain except the trusted certificates are required to have an Authority Information Access (AIA) extension with an accessible URL to the OCSP responder. |
|
|
|
If |
Request Metadata Properties
|
Property |
Description |
|---|---|
|
|
The encoded signed request signature created and included by signdocument Command with the |