主页
产品
Red Hat Enterprise Linux
10
Managing certificates in IdM
12.2. Adding a certificate mapping rule in the IdM web UI for users whose AD entry contains the whole certificate

12.2. Adding a certificate mapping rule in the IdM web UI for users whose AD entry contains the whole certificate

Log into the IdM web UI as an administrator.
Navigate to Authentication Certificate Identity Mapping Rules Certificate Identity Mapping Rules.
Click Add.
图 12.1. Adding a new certificate mapping rule in the IdM web UI
Enter the rule name.
Enter the mapping rule. To have the whole certificate that is presented to IdM for authentication compared to what is available in AD:
```
(userCertificate;binary={cert!bin})
```
注意
If mapping using the full certificate, if you renew the certificate, you must ensure that you add the new certificate to the AD user object.
Enter the matching rule. For example, to only allow certificates issued by the AD-ROOT-CA of the AD.EXAMPLE.COM domain to authenticate:
```
<ISSUER>CN=AD-ROOT-CA,DC=ad,DC=example,DC=com
```
图 12.2. Certificate mapping rule for a user with a certificate stored in AD
Click Add.
The System Security Services Daemon (SSSD) periodically re-reads the certificate mapping rules. To force the newly-created rule to be loaded immediately, restart SSSD in the CLI::
```
# systemctl restart sssd
```