Chapter 12. Configuring certificate mapping for users whose AD user entry contains the whole certificate

Procedure

1. Log into the IdM web UI as an administrator.
2. Navigate to Authentication Certificate Identity Mapping Rules Certificate Identity Mapping Rules.

3. Click Add.

   Adding a new certificate mapping rule in the IdM web UI image::new-certmaprule-add.png[Screenshot of the IdM Web UI displaying the "Certificate Identity Mapping Rules" sub-page from the Authentication tab. The "Add" button to the right is highlighted.]

4. Enter the rule name.

5. Enter the mapping rule. To have the whole certificate that is presented to IdM for authentication compared to what is available in AD:

   (userCertificate;binary={cert!bin})

   Copy to Clipboard Toggle word wrap
   Note

   If mapping using the full certificate, if you renew the certificate, you must ensure that you add the new certificate to the AD user object.

6. Enter the matching rule. For example, to only allow certificates issued by the AD-ROOT-CA of the AD.EXAMPLE.COM domain to authenticate:

   <ISSUER>CN=AD-ROOT-CA,DC=ad,DC=example,DC=com

   Copy to Clipboard Toggle word wrap

   Certificate mapping rule for a user with a certificate stored in AD image::certmaprule-add-details-ad-cert.png[Screenshot of the "Add Certificate Identity Mapping Rule" pop-up window with the following fields filled in: Rule name (which is required) - Mapping rule - Matching rule. The Priority field is blank and there is also an "Add" button next to the "Domain name" label.]

7. Click Add.

8. The System Security Services Daemon (SSSD) periodically re-reads the certificate mapping rules. To force the newly-created rule to be loaded immediately, restart SSSD in the CLI::

   # systemctl restart sssd

   Copy to Clipboard Toggle word wrap

Procedure

1. Obtain the administrator’s credentials:

   # kinit admin

   Copy to Clipboard Toggle word wrap

2. Enter the mapping rule and the matching rule the mapping rule is based on. To have the whole certificate that is presented for authentication compared to what is available in AD, only allowing certificates issued by the AD-ROOT-CA of the AD.EXAMPLE.COM domain to authenticate:

   # ipa certmaprule-add simpleADrule --matchrule '<ISSUER>CN=AD-ROOT-CA,DC=ad,DC=example,DC=com' --maprule '(userCertificate;binary={cert!bin})' --domain ad.example.com

   Copy to Clipboard Toggle word wrap

   -------------------------------------------------------
   Added Certificate Identity Mapping Rule "simpleADrule"
   -------------------------------------------------------
     Rule name: simpleADrule
     Mapping rule: (userCertificate;binary={cert!bin})
     Matching rule: <ISSUER>CN=AD-ROOT-CA,DC=ad,DC=example,DC=com
     Domain name: ad.example.com
     Enabled: TRUE

   Copy to Clipboard Toggle word wrap
   Note

   If mapping using the full certificate, if you renew the certificate, you must ensure that you add the new certificate to the AD user object.

3. The System Security Services Daemon (SSSD) periodically re-reads the certificate mapping rules. To force the newly-created rule to be loaded immediately, restart SSSD:

   # systemctl restart sssd

   Copy to Clipboard Toggle word wrap