Configuring authorization rules to match the certificate fields using the CLI

Use the CLI commands in this section to configure a specific authorization rule to match against the fields in the X.509 certificate. The administrator must configure one separate rule for each authorized user. For details about how to configure rules in a local configuration and about user roles, see Local authentication.

Note

Only one subject is allowed per authorization rule.

A user with a reject user account is automatically locked out and is not associated with a role by default.

To configure authorization rules to match the certificate fields:

Go to CLI configuration mode.

hostname > enable
hostname # configure terminal

Specify an authorization rule to match against the name of the subject field in the X.509 certificate. The subject is the Distinguished Name (DN) and is the X.509 structure. Each entry has a unique identifier.
```
hostname (config) # aaa authorization rules rule append tail match-x509-cert-subject "<string>" map-local-user <role>
```
where <string> is extracted from the subject field of the certificate and is matched against the string that is in the rule. For example, C=US, ST=CA, L=Milpitas, O=FireEye, OU=Engineering, CN=Test Cardholder.
<role> is the assigned role that allows the user to perform certain operations.
Specify an authorization rule to match against an entry for the Common Name (CN) from the DN attribute of an X.509 certificate.
```
hostname (config) # aaa authorization rules rule append tail match-x509-cert-subject-cn "<string>" map-local-user <role>
```
where <string> is extracted from the subject field of the certificate and is matched against the string that is in the rule. For example, CN=Test Cardholder.
<role> is the assigned role that allows the user to perform certain operations.
Specify an authorization rule to match against an email address in the Subject Alternative Name (SAN) field of an X.509 certificate. You are allowed to have multiple subfields for the SAN.
```
hostname (config) #  aaa authorization rules rule append tail match-x509-cert-san-email "<string>" map-local-user <role>
```
where <string> is extracted from the Subject Alternative Name field of the certificate and is matched against the string that is in the rule. For example, email:test.cardholder@fireeye.com.
<role> is the assigned role that allows the user to perform certain operations.
Specify an authorization rule to match against the username of an email address without the domain name of an X.509 certificate.
```
hostname (config) # aaa authorization rules rule append tail match-x509-cert-san-email-username "<string>" map-local-user <role>
```
where <string> is extracted from the Subject Alternative Name field without the domain name of the X.509 certificate and is matched against the string that is in the rule. For example, test.cardholder.
<role> is the assigned role that allows the user to perform certain operations.
Specify an authorization rule to match against the User Principal Name (UPN) that is encoded in the "Other Name" field of an X.509 certificate.
```
hostname (config) # aaa authorization rules rule append tail match-x509-cert-san-upn "<string>" map-local-user <role>
```
where <string> is extracted from the Subject Alternative Name field for the "Other Name" value of the X.509 certificate and is matched against the string that is in the rule. For example, Principal Name:test.cardholder@fireeye.com.
<role> is the assigned role that allows the user to perform certain operations.
Specify an authorization rule to match against the username of the UPN field of an X.509 certificate.
```
hostname (config) # aaa authorization rules rule append tail match-x509-cert-san-upn-username <string> map-local-user <role>
```
where <string> is extracted from the certificate and is matched against the string that is in the rule. For example, test.cardholder.
<role> is the assigned role that allows the user to perform certain operations.

Verify the settings of all the matched authorization rules.

hostname (config) # show aaa authorization rules

------------------------------------------------

#         AAA Authorization Rules : Enabled

------------------------------------------------

# Rule          Statements

------------------------------------------------

# 1             Match x509 Cert Subject      : C=US, ST=CA, L=Milpitas, O=FireEye, OU=Engineering, CN=Test Cardholder

             -->Action Map Local User        : monitor

# 2            Match x509 Cert Subject CN    : Test Cardholder

            -->Action Map Local User         : monitor

# 3            Match x509 Cert SAN email     : test.cardholder@fireeye.com

            -->Action Map Local User         : monitor

# 4            Match x509 Cert SAN email username : test.cardholder

            -->Action Map Local User              : monitor

# 5           Match x509 Cert SAN UPN             : test.cardholder@fireeye.com

            -->Action Map Local User              : monitor

# 6            Match x509 Cert SAN UPN username   : test.cardholder

            -->Action Map Local User              : monitor

Save your changes.
```
hostname (config) # write memory
```