Description
Write a new integration guide in the documentation repo for the MS ADCS NG connector (ms-adcs-ng-connector), under docs/certificate-key/integration-guides/ as a new folder (matching the ejbca-ng-connector precedent).
The NG connector uses native MS-WCCE over COM/DCOM and runs as a Windows Service installed via a WiX MSI — no WinRM/PSPKI, unlike the legacy ms-adcs-connector. The guide must cover the two things that differ from the legacy connector:
- Installation — MSI install with the service-identity options (gMSA / sMSA / domain user / built-in), the
Install-Service.ps1 fallback, verification, and in-place upgrade.
- Necessary permissions to run the connector — service-account
SeServiceLogonRight (the installer auto-grants non-built-in accounts), CA-side Request/Enroll permission plus certificate-template read/enroll, DCOM/RPC access to certsrv on the CA host and the corresponding firewall ports, and optional AD read for CA/template metadata.
For all other common settings (creating the service user, CA/template configuration, authority + RA-profile creation, registering the connector in Core), refer to the existing "Active Directory Certificate Services" integration-guides section rather than duplicating them.
Source of truth for the content is the connector repo's docs/deployment.md.
Note: this is documentation-repo work; the connector itself lives in ms-adcs-ng-connector.
Definition of Done
- New
docs/certificate-key/integration-guides/ms-adcs-ng-connector/ section with overview, installation, permissions pages and a _category_.json.
- Installation page covers MSI (all four identity options),
Install-Service.ps1 fallback, verification, and in-place upgrade.
- Permissions page covers
SeServiceLogonRight, CA Request/Enroll + template read/enroll, DCOM/RPC + firewall ports, and optional AD read.
- Common settings link to the existing ADCS integration-guides section (and quick-start) instead of being duplicated.
- Delivered on a branch off
release/2.19.0.
Description
Write a new integration guide in the documentation repo for the MS ADCS NG connector (
ms-adcs-ng-connector), underdocs/certificate-key/integration-guides/as a new folder (matching theejbca-ng-connectorprecedent).The NG connector uses native MS-WCCE over COM/DCOM and runs as a Windows Service installed via a WiX MSI — no WinRM/PSPKI, unlike the legacy
ms-adcs-connector. The guide must cover the two things that differ from the legacy connector:Install-Service.ps1fallback, verification, and in-place upgrade.SeServiceLogonRight(the installer auto-grants non-built-in accounts), CA-side Request/Enroll permission plus certificate-template read/enroll, DCOM/RPC access tocertsrvon the CA host and the corresponding firewall ports, and optional AD read for CA/template metadata.For all other common settings (creating the service user, CA/template configuration, authority + RA-profile creation, registering the connector in Core), refer to the existing "Active Directory Certificate Services" integration-guides section rather than duplicating them.
Source of truth for the content is the connector repo's
docs/deployment.md.Note: this is documentation-repo work; the connector itself lives in
ms-adcs-ng-connector.Definition of Done
docs/certificate-key/integration-guides/ms-adcs-ng-connector/section withoverview,installation,permissionspages and a_category_.json.Install-Service.ps1fallback, verification, and in-place upgrade.SeServiceLogonRight, CA Request/Enroll + template read/enroll, DCOM/RPC + firewall ports, and optional AD read.release/2.19.0.