14.5. Adding a certificate to an AD user’s ID override in the IdM CLI

Obtain the administrator’s credentials:

# kinit admin

Store the certificate blob in a new variable called CERT:

# CERT=$(openssl x509 -in /path/to/certificate -outform der|base64 -w0)

Add the certificate of ad_user@ad.example.com to the user account using the ipa idoverrideuser-add-cert command:

# ipa idoverrideuser-add-cert ad_user@ad.example.com --certificate $CERT

Use the sss_cache utility to invalidate the record of ad_user@ad.example.com in the SSSD cache and force a reload of the ad_user@ad.example.com information:

# sss_cache -u ad_user@ad.example.com

Run the ipa certmap-match command with the name of the file containing the certificate of the AD user:

# ipa certmap-match ad_user_cert.pem
--------------
1 user matched
--------------
 Domain: AD.EXAMPLE.COM
 User logins: ad_user@ad.example.com
----------------------------
Number of entries returned 1
----------------------------