13.4. Checking certificate mapping data on the AD side

Prerequisites

• The user account must have user administration access.

Procedure

• To check that AD contains the right information for the user stored in AD, use the ldapsearch command. For example, enter the command below to check with the adserver.ad.example.com server that the following conditions apply:

  • The altSecurityIdentities attribute is set in the user entry of ad_user.

  • The matchrule stipulates that the following conditions apply:

    • The certificate that ad_user uses to authenticate to AD was issued by AD-ROOT-CA of the ad.example.com domain.
    • The subject is <S>DC=com,DC=example,DC=ad,CN=Users,CN=ad_user:

  $ ldapsearch -o ldif-wrap=no -LLL -h adserver.ad.example.com \
  -p 389 -D cn=Administrator,cn=users,dc=ad,dc=example,dc=com \
  -W -b cn=users,dc=ad,dc=example,dc=com "(cn=ad_user)" \
  altSecurityIdentities
  Enter LDAP Password:
  dn: CN=ad_user,CN=Users,DC=ad,DC=example,DC=com
  altSecurityIdentities: X509:<I>DC=com,DC=example,DC=ad,CN=AD-ROOT-CA<S>DC=com,DC=example,DC=ad,CN=Users,CN=ad_user