Red Hat Summit Red Hat SummitSupportKonsoleEntwicklerDemo startenKontakt

Dieser Inhalt ist in der von Ihnen ausgewählten Sprache nicht verfügbar.

23.4. Configuring a User Name Hint Policy for Smart-card Authentication

As an Identity Management administrator, you can configure a user name hint policy for smart cards linked with multiple accounts.

23.4.1. User Name Hints in Identity Management
Link kopieren

The user name hint policy configures Identity Management to prompt smart card users for their user name. When a user tries to authenticate with a smart card certificate that matches multiple user accounts in Identity Management, one of the following occurs:
  • If the user name hint policy is enabled, the user is prompted for a user name and then can proceed with authentication.
  • If the user name hint policy is disabled, the authentication fails without prompting.
Identity Management adds the user name hint to applications that would by default prompt for a smart card PIN without asking for a user name. On Red Hat Enterprise Linux, this is currently only the Gnome Desktop Manager (GDM) login.

Figure 23.14. User name hint in the Gnome Desktop Manager

User name hint in the Gnome Desktop Manager
View larger image
User name hint in the Gnome Desktop Manager
Identity Management does not add the user name hint to applications that ask for a user name by default, for example:
  • The Identity Management web UI authentication, because the GUI always displays the Username field
  • ssh authentication, because ssh uses the current user’s login name or the name provided with the -l option or in the username@host format
  • Console authentication, where the login name is always supplied
In these situations, authentication with a certificate that matches multiple users is always allowed.

23.4.2. Enabling User Name Hints in Identity Management
Link kopieren

The Identity Management administrator sets the user name hint policy centrally. The policy applies to all hosts enrolled into the Identity Management domain.
Perform these steps on any Identity Management system.

Command Line: Enabling User Name Hints in Identity Management

  1. Log in as the Identity Management administrator: 
    $ kinit admin
Password for admin@IDM.EXAMPLE.COM:
    Copy to Clipboard Toggle word wrap
  2. Enable user name hints by using the ipa certmapconfig-mod command with the --promptusername=True option. 
    $ ipa certmapconfig-mod --promptusername=TRUE
Prompt for the username: TRUE
    Copy to Clipboard Toggle word wrap
    To disable user name hints, use the --promptusername=False option.

Web UI: Enabling User Name Hints in Identity Management

  1. Click Authentication Certificate Identity Mapping Rules Certificate Identity Mapping Global Configuration.
  2. Select Prompt for the username, and click Save.

    Figure 23.15. Enabling user name hints in the web UI

    Enabling user name hints in the web UI
    View larger image
    Enabling user name hints in the web UI

Additional Resources

  • For details on the ipa certmapconfig-mod command, execute it with the --help option.
Nach oben
Red Hat logoGithubredditYoutubeTwitter

Lernen

Testen, kaufen und verkaufen

Communitys

Über Red Hat Dokumentation

Wir helfen Red Hat Benutzern, mit unseren Produkten und Diensten innovativ zu sein und ihre Ziele zu erreichen – mit Inhalten, denen sie vertrauen können. Entdecken Sie unsere neuesten Updates.

Mehr Inklusion in Open Source

Red Hat hat sich verpflichtet, problematische Sprache in unserem Code, unserer Dokumentation und unseren Web-Eigenschaften zu ersetzen. Weitere Einzelheiten finden Sie in Red Hat Blog.

Über Red Hat

Wir liefern gehärtete Lösungen, die es Unternehmen leichter machen, plattform- und umgebungsübergreifend zu arbeiten, vom zentralen Rechenzentrum bis zum Netzwerkrand.

Theme

© 2026 Red Hat