14.2. Adding a certificate mapping rule in the IdM web UI if AD user entry contains no certificate or mapping data

Click Add.

图 14.1. Adding a new certificate mapping rule in the IdM web UI

Enter the mapping rule. To have the whole certificate that is presented to IdM for authentication compared to the certificate stored in the user ID override entry of the AD user entry in IdM:

(userCertificate;binary={cert!bin})

Enter the matching rule. For example, to only allow certificates issued by the AD-ROOT-CA of the AD.EXAMPLE.COM domain to authenticate:

<ISSUER>CN=AD-ROOT-CA,DC=ad,DC=example,DC=com

Enter the domain name. For example, to search for users in the ad.example.com domain:

图 14.2. Certificate mapping rule for a user with no certificate or mapping data stored in AD

The System Security Services Daemon (SSSD) periodically re-reads the certificate mapping rules. To force the newly-created rule to be loaded immediately, restart SSSD in the CLI:

# systemctl restart sssd