Configure PKI, PKI with LDAP, or Active Directory authentication

Log in to the system as npadmin using the system's IP address or FQDN. For example:

$ ssh npadmin@10.1.0.1

Or,

$ ssh npadmin@exampleFQDN

Enter privileged mode:

npadmin@hostname > enable

Enter the admin password.

[sudo] password for npadmin: <password>

Enter configuration mode:

npadmin@hostname# configure system

Open the authentication configuration:

npadmin@hostname(config)# authentication
1: Authentication Method = pam
2: Configure Current Authentication Method
----------------------------------------
        
Q: Save changes and exit
C: Cancel changes and exit
        
Select which option you would like to change
using the index number:

Type 1 to open the authentication mechanism menu.

Authentication Mechanisms:
1: PAM
2: LDAP
3: RADIUS
4: TACACS+
5: Active Directory
6: PKI
7: PKI w/ LDAP
8: PKI w/ Active Directory

C: Cancel changes and exit

Select the authentication method to use: 7

When you have selected PKI or PKI w/ LDAP or PKI w/ Active Directory as the authentication method, the following options appear in the CLI:

1: Authentication Method = pki or pki-ldap or pki-ad
2: Configure Current Authentication Method
3: Flush AD/LDAP passwd and group cache
----------------------------------------

Q: Save changes and exit
C: Cancel changes and exit

Select which option you would like to change
using the index number:

Press 2 to select Configure Current Authentication Method.

The PKI configuration menu is displayed on the CLI:

PKI Configuration:
1. Status = disabled
2. OCSP Verification URL = <none>
3. Certificate Revocation List = <none>
4. Appliance Certificate = <none>
5. Client CA Certificate = <provided>
6. Delete Client CA Certificate
----------------------------------------
Q: Save changes and go to the next menu
C: Cancel changes and go to the next menu

Enter your choice:

Make changes to the following fields, as required:

1. Status: Type 1 CAC / PKI authentication status which can be set to disabled (selected by default), enabled, and optional. Check how to enable or disable CAC/PIV for certificate authentication and logging in to the Web UI with certificate authentication for details.

   Important

   You must upload a CA certificate to the appliance under the transfer folder before enabling Status.

2. OCSP Verification URL: Type 2 to set the URL of the OCSP server used to verify the revocation status of certificates in real time. If the certificate is part of the revocation list, it will be blocked. See how to add OCSP Verification URL for details.

3. Certificate Revocation List: A Certificate Revocation List (CRL) is a file maintained locally that lists revoked digital certificates to allow for their offline validation.

   To work on the CRL, type 3 and press Enter. The following CRL configuration options appear on CLI:

   CRL Configuration:
   1: CRL Retrieval URL = <none>
   2: CRL Retrieval interval (hours between refresh) = 1
   3: Upload CRL file = <none>
   4: View CRL contents
   5: Delete CRL file
   ----------------------------------------
   
   Q: Save changes and exit
   C: Cancel changes and exit
   Enter your choice:

   Configure the fields in the following order. Enter Q to save the changes and exit the CRL configuration menu and return to PKI authentication configuration menu, or C to cancel.

   1. Upload CRL file: Type 3 to upload a local CRL file.

   2. CRL Retrieval URL: Type 1 to enter the URL of the direct path to the certificate file for file updates.

   3. CRL Retrieval interval: Type 2 to configure a CRL retrieval interval (in hours).

   4. View CRL contents / Delete CRL file: Type 4 to review the configured CRL contents or type 5 if you want to delete a CRL file.

4. Appliance Certificate: On the PKI authentication configuration menu, type 4 to set the SSL/TLS certificate used by the appliance for secure communication.

5. Client CA Certificate: To define the trusted CA for client certificate validation, type 5 in the PKI authentication menu and provide the certificate's filename, such as ca-chain.pem.

6. Delete Client CA Certificate: On the PKI authentication configuration menu, type 6 if you want to remove the stored client CA certificate from the appliance. Type Y to confirm.

7. Enter Q to save the configuration changes. 

   You will be redirected to LDAP authentication configuration menu with the same configuration options as discussed in the Configure LDAP and Active Directory authentication section along with the following fields. When done, enter Q to save the configuration changes.

   1. Certificate Identity Field: Type 15 to specify which field from the X.509 certificate is used to identify the user (such as x509-cert-subject, x509-cert-san-email, 509-cert-subject-cn etc.) See Configuring the user attributes for certificate authentication for more details.

   2. Certificate-to-LDAP Mapping Attribute: Type 16 to define the LDAP attribute (for example, CN) that the Certificate Identity Field is matched against for user lookup.

   3. LDAP Username Attribute: Type 17 to specify the LDAP attribute (that is, sAMAccountName) used as the user’s login name during authentication.

   After the configuration, it might look like the following:

   1: LDAP Server(s) = 10.x.x.x:3xx
   2: Base DN = CN=Users,DC=piblr,DC=quality
   3: Bind DN = CN=administrator,CN=Users,DC=piblr,DC=quality
   4: Bind Password = **********
   5: Base Password = **********
   6: Base Group = CN=Users,DC=piblr,DC=qa
   7: LDAP/AD UIAPI Group = uiapigrp
   8: LDAP/AD Sudo Group = sudogrp
   9: LDAP/AD SSH Group = sshgrp
   10: LDAP Domain SID = None
   11: LDAP USE SSL = False
   12: LDAP USE STARTTLS = False
   13: Ignore Constraints = false
   14: Enable LDAP Group Traversal = True
   15: Certificate Identity Field = x509-cert-subject-cn
   16: Certificate-to-LDAP Mapping Attribute = cn
   17: LDAP Username Attribute = sAMAccountName

(Optional) If you want to clear any cached credentials or group information previously configured, press 3 (Flush AD/LDAP passwd and group cache).