Allowing or preventing authorization rule matches for certificate authentication using the CLI

Use the CLI commands in this section to allow or prevent specific authorization rule matches for users who were authenticated using an X.509 certificate as the only criterion for an authentication method.

Note

A user with a reject user account is automatically locked out and is not associated with a role by default.

To allow authorization rule matches based on the certificate authentication method:

Go to CLI configuration mode.

hostname > enable
hostname # configure terminal

Match all authorization rules for users who were authenticated using an X.509 certificate.
```
hostname (config) # aaa authorization rules rule append tail match-auth-method x509-cert map-local-user <role>
```
where <role> is the assigned role that allows the user to perform certain operations.

Verify the status of the new authorization rules that are matched using the X.509 certificate authentication method.

hostname (config) # show aaa authorization rules

------------------------------------------------

#         AAA Authorization Rules : Enabled

------------------------------------------------

# Rule          Statements

------------------------------------------------

# 1        Match Auth Methods                 : x509-cert

        -->Action Map Local User              : monitor

# 2        Match x509 Cert Subject            : C=US, ST=CA, L=Milpitas, O=FireEye, OU=Engineering, CN=Test Cardholder

        -->Action Map Local User              : monitor

Save your changes.
```
hostname (config) # write memory
```

To prevent authorization rule matches based on the certificate authentication method:

Go to CLI configuration mode.

hostname > enable
hostname # configure terminal

Prevent a new authorization rule from being matched for users who were authenticated using an X.509 certificate.
```
hostname (config) # aaa authorization rules rule append tail match-not-auth-method x509-cert map-local-user <role>
```
where <role> is the assigned role that allows the user to perform certain operations.

Verify the status of the new authorization rules that are matched using the X.509 certificate authentication method.

hostname (config) # show aaa authorization rules

------------------------------------------------

#         AAA Authorization Rules : Enabled

------------------------------------------------

# Rule          Statements

------------------------------------------------

# 1            Match Auth Methods                 : x509-cert

               Match x509 Cert Subject CN         : Test Cardholder

            -->Action Map Local User              : monitor

# 10           Not-Match Auth Methods             : x509-cert

            -->Action Map Local User              : monitor

Save your changes.
```
hostname (config) # write memory
```