第 16 章 Configuring authentication with a certificate stored on the desktop of an IdM client

Procedure

1. On an IdM server, obtain administrator privileges and create a shell script to configure the server.

   1. Run the ipa-advise config-server-for-smart-card-auth command, and save its output to a file, for example server_certificate_script.sh:

      # kinit admin
      # ipa-advise config-server-for-smart-card-auth > server_certificate_script.sh

   2. Add execute permissions to the file using the chmod utility:

      # chmod +x server_certificate_script.sh

2. On all the servers in the IdM domain, run the server_certificate_script.sh script

   1. with the path of the IdM Certificate Authority certificate, /etc/ipa/ca.crt, as input if the IdM CA is the only certificate authority that has issued the certificates of the users you want to enable certificate authentication for:

      # ./server_certificate_script.sh /etc/ipa/ca.crt

   2. with the paths leading to the relevant CA certificates as input if different external CAs signed the certificates of the users who you want to enable certificate authentication for:

      # ./server_certificate_script.sh /tmp/ca1.pem /tmp/ca2.pem

   注意

   Do not forget to run the script on each new replica that you add to the system in the future if you want to have certificate authentication for users enabled in the whole topology.