6.5. Creating certificate mapping rules when using smart cards

You need to create certificate mapping rules in order to log in using the certificate stored on a smart card.

Prerequisites

Procedure

Create a certificate mapping configuration file, such as /etc/sssd/conf.d/sssd_certmap.conf.
Add certificate mapping rules to the sssd_certmap.conf file:
```
[certmap/shadowutils/otheruser]
matchrule = <SUBJECT>.*CN=certificate_user.*<ISSUER>^CN=Example Test CA,OU=Example Test,O=EXAMPLE$
```
Note that you must define each certificate mapping rule in separate sections. Define each section as follows:
```
[certmap/<DOMAIN_NAME>/<RULE_NAME>]
```
If SSSD is configured to use the proxy provider to allow smart card authentication for local users instead of AD, IPA, or LDAP, the <RULE_NAME> can simply be the username of the user with the card matching the data provided in the matchrule.

Verification

Note that to verify SSH access with a smart card, SSH access must be configured. For more information, see Configuring SSH access using smart card authentication.

You can verify the SSH access with the following command:
```
# ssh -I /usr/lib64/opensc-pkcs11.so -l otheruser localhost hostname
```
If the configuration is successful, you are prompted to enter the smart card PIN.