Chapter 13. Configuring certificate mapping if AD is configured to map user certificates to user accounts

Procedure

1. Log into the IdM web UI as an administrator.
2. Navigate to Authentication Certificate Identity Mapping Rules Certificate Identity Mapping Rules.

3. Click Add.

   Adding a new certificate mapping rule in the IdM web UI image::new-certmaprule-add.png[Screenshot of the IdM Web UI displaying the "Certificate Identity Mapping Rules" sub-tab from the Authentication tab. The "Add" button at the right of the page is highlighted.]

4. Enter the rule name.

5. Enter the mapping rule. For example, to make AD DC search for the Issuer and Subject entries in any certificate presented, and base its decision to authenticate or not on the information found in these two entries of the presented certificate:

   (altSecurityIdentities=X509:<I>{issuer_dn!ad_x500}<S>{subject_dn!ad_x500})

   Copy to Clipboard Toggle word wrap

6. Enter the matching rule. For example, to only allow certificates issued by the AD-ROOT-CA of the AD.EXAMPLE.COM domain to authenticate users to IdM:

   <ISSUER>CN=AD-ROOT-CA,DC=ad,DC=example,DC=com

   Copy to Clipboard Toggle word wrap

7. Enter the domain:

   ad.example.com

   Copy to Clipboard Toggle word wrap

   Certificate mapping rule if AD is configured for mapping image::certmaprule-add-details-ad-map.png[Screenshot of the "Add Certificate Identity Mapping Rule" pop-up window with the following fields filled in: Rule name (which is required) - Mapping rule - Matching rule. The "Priority" field is blank and there is also an "Add" button next to the "Domain name" label.]

8. Click Add.

9. The System Security Services Daemon (SSSD) periodically re-reads the certificate mapping rules. To force the newly-created rule to be loaded immediately, restart SSSD in the CLI::

   # systemctl restart sssd

   Copy to Clipboard Toggle word wrap

Procedure

1. Obtain the administrator’s credentials:

   # kinit admin

   Copy to Clipboard Toggle word wrap

2. Enter the mapping rule and the matching rule the mapping rule is based on. For example, to make AD search for the Issuer and Subject entries in any certificate presented, and only allow certificates issued by the AD-ROOT-CA of the AD.EXAMPLE.COM domain:

   # ipa certmaprule-add ad_configured_for_mapping_rule --matchrule '<ISSUER>CN=AD-ROOT-CA,DC=ad,DC=example,DC=com' --maprule '(altSecurityIdentities=X509:<I>{issuer_dn!ad_x500}<S>{subject_dn!ad_x500})' --domain=ad.example.com

   Copy to Clipboard Toggle word wrap

   -------------------------------------------------------
   Added Certificate Identity Mapping Rule "ad_configured_for_mapping_rule"
   -------------------------------------------------------
     Rule name: ad_configured_for_mapping_rule
     Mapping rule: (altSecurityIdentities=X509:<I>{issuer_dn!ad_x500}<S>{subject_dn!ad_x500})
     Matching rule: <ISSUER>CN=AD-ROOT-CA,DC=ad,DC=example,DC=com
     Domain name: ad.example.com
     Enabled: TRUE

   Copy to Clipboard Toggle word wrap

3. The System Security Services Daemon (SSSD) periodically re-reads the certificate mapping rules. To force the newly-created rule to be loaded immediately, restart SSSD:

   # systemctl restart sssd

   Copy to Clipboard Toggle word wrap