主页
产品
Red Hat Enterprise Linux
10
Managing certificates in IdM
13.2. Adding a certificate mapping rule in the IdM web UI if AD is configured to map user certificates to user accounts

13.2. Adding a certificate mapping rule in the IdM web UI if AD is configured to map user certificates to user accounts

Log into the IdM web UI as an administrator.
Navigate to Authentication Certificate Identity Mapping Rules Certificate Identity Mapping Rules.
Click Add.
图 13.1. Adding a new certificate mapping rule in the IdM web UI
Enter the rule name.
Enter the mapping rule. For example, to make AD DC search for the Issuer and Subject entries in any certificate presented, and base its decision to authenticate or not on the information found in these two entries of the presented certificate:
```
(altSecurityIdentities=X509:<I>{issuer_dn!ad_x500}<S>{subject_dn!ad_x500})
```
Enter the matching rule. For example, to only allow certificates issued by the AD-ROOT-CA of the AD.EXAMPLE.COM domain to authenticate users to IdM:
```
<ISSUER>CN=AD-ROOT-CA,DC=ad,DC=example,DC=com
```
Enter the domain:
```
ad.example.com
```
图 13.2. Certificate mapping rule if AD is configured for mapping
Click Add.
The System Security Services Daemon (SSSD) periodically re-reads the certificate mapping rules. To force the newly-created rule to be loaded immediately, restart SSSD in the CLI::
```
# systemctl restart sssd
```