Configuring the certificate fields to match the LDAP field for authorization using the CLI

Use the CLI commands in this section to configure the certificate fields to match the LDAP field for authorization. For details about user attributes for the X.509 certificates, see Configuring the user attributes for certificate authentication.

Note

Use the no aaa authentication certificate map-ldap match-cert-field command to reset the certificate field for the LDAP field to use the default x509-cert-san-upn attribute.

To configure the certificate fields to match the LDAP field for authorization:

Go to CLI configuration mode.

hostname > enable
hostname # configure terminal

Specify the name of the subject field in the certificate to match the LDAP field. The subject is the Distinguished Name (DN) and is the X.509 structure. Each entry has a unique identifier.
```
hostname (config) # aaa authorization certificate map-ldap match-cert-field x509-cert-subject
```
Specify an entry for the Common Name (CN) from the DN attribute that is associated in a certificate to match the LDAP field.
```
hostname (config) #  aaa authorization certificate map-ldap match-cert-field x509-cert-subject-cn
```
Specify an email address in the Subject Alternative Name (SAN) field of the certificate to match against the LDAP field. You are allowed to have multiple subfields for the SAN.
```
hostname (config) #  aaa authorization certificate map-ldap match-cert-field x509-cert-san-email
```
Specify the user name of the email address without the domain name in the certificate to match against the LDAP field.
```
hostname (config) # aaa authorization certificate map-ldap match-cert-field x509-cert-san-email-username
```
Specify the User Principal Name (UPN) that is encoded in the Other Name field of the Subject Alternative Name to match against the LDAP field.
```
hostname (config) # aaa authorization certificate map-ldap match-cert-field x509-cert-san-upn
```
Specify the user name of the UPN field without the domain name in the certificate to match against the LDAP field.
```
hostname (config) # aaa authorization certificate map-ldap match-cert-field x509-cert-san-upn-username
```

Verify the setting of the certificate field to match the LDAP field.

hostname (config) # show aaa authorization certificate

Certificate based authorization settings:

  LDAP enabled               : yes

  LDAP Match Attribute       : uid

 Certificate field to match : x509-cert-san-email-username

  LDAP Search Filter         : Not configured

  Username override          : no

Save your changes.
```
hostname (config) # write memory
```