Revision Summary Date Revision History Revision Class Comments 6/30/2015 1.0 New Released new document. 10/16/2015 2.0 Significantly changed the technical content. 7/14/2016 3.0 Significantly changed the technical content. 3/16/2017 4.0 Significantly changed the technical content. 6/1/2017 4.0 None No changes to the meaning, language, or formatting of the technical content.
</s:header> <s:body> <s:fault> <s:code> <s:value>s:receiver</s:value> <s:subcode> <s:value>s:authorization</s:value> </s:subcode> </s:code> <s:reason> <s:text xml:lang="en-us">This User is not authorized to enroll</s:text> </s:reason> </s:fault> </s:body> </s:envelope> Subcode Description HRESULT s: MessageFormat Message format is bad. 80180001 s: Authentication User not recognized. 80180002 s: Authorization User not allowed to enroll. 80180003 s: CertificateRequest Failed to get certificate. 80180004 s: EnrollmentServer 80180005 a: InternalServiceFault The server hit an unexpected issue. 80180006 a: InvalidSecurity Cannot parse the security header. 80180007 Here is an example of deviceenrollmentserviceerror element: <s:envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:a="http://www.w3.org/2005/08/addressing"> <s:header> <a:action <activityid correlationid="2493ee37-beeb-4cb9-833c-cadde9067645" <a:relatesto>urn:uuid:urn:uuid:0d5a1441-5891-453b-becf-a2e5f6ea3749</a:relatesto> </s:header> <s:body> <s:fault> <s:code>
Initialization None. Message Processing Events and Sequencing Rules The WSDL operations for renewal are as specified in section . RequestSecurityToken Operation MDE2 does not modify the RequestSecurityToken operation for the renewal process. The operation is as specified in section . Messages MDE2 does not modify the set of messages for the RequestSecurityToken operation for the renewal process. The set of messages are as specified in section . RequestSecurityToken For the renewal process, MDE2 modifies the RequestSecurityToken message as follows. The remainder of the definition for the RequestSecurityToken message is as specified in section . Because the uses the existing certificate to perform client , the is not populated in the . As a result, the is required to support client TLS. Authentication MUST be implemented for this message as defined in section . In summary, the following elements and attributes MUST be specified in the SOAP header: wsse:Security: The <wsse:Security> element MUST be a child of <s:Header>. wsse:UsernameToken: The <wsse: UsernameToken> element MUST be a child of <wsse:Security> in <s:Header>. wsse:UsernameToken/attributes/u:Id: The type MUST be for on-premise authentication. wsse:UserName: The <wsse: Username> element MUST be a child of <wsse:UsernameToken> in <s:Header>and the value specifies the user name. wsse:Password: The <wsse: Password> element MUST be a child of <wsse:UsernameToken> in <s:Header> and the value specifies the user password. wsse:Password/attributes/Type: This value MUST be Namespace: The following elements and attributes are specified in the of the request message. wst:RequestType: The <wst:RequestType> element MUST be the value (see section 3.1). wsse:BinarySecurityToken/attributes/ValueType: The <wsse:BinarySecurityToken> ValueType attribute MUST be