If you configured an LDAP server to authenticate users, you can configure LDAP mappings for authorization by using the appliance CLI:
Enabling or disabling the LDAP server for certificate-based authorization using the CLI
Configuring an LDAP attribute to match a certificate authorization field using the CLI
Removing an LDAP attribute for certificate authorization using the CLI
Configuring the certificate fields to match the LDAP field for authorization using the CLI
Defining LDAP search filters for certificate-based authorization using the CLI
Removing LDAP search filters for certificate authorization using the CLI
Enabling or disabling the LDAP override for certificate-based authorization using the CLI
When the appliance needs to determine the identity of the user, the Subject Alternative Name (SAN) extension with the User Principal Name (UPN) extension in the certificate can be used as an identifier when matching the certificate to an entry in the Active Directory (AD), which is supported by the LDAP protocol.
When the certificate is validated, the AD server uses the Principal Name field (Principal Name=user@fully.qualified.domain.name) in the SAN with the UPN of the certificate to search for the user in the Active Directory. The server permits or denies access to the Web UI based on the matched fields.
The user schema name and login name for the LDAP attribute are used to match the configured certificate authorization field. An administrator can configure the LDAP record to map the login name. An administrator can define an LDAP search filter in the configuration that controls which users can log in using a certificate and then can be authorized using LDAP.
Admin access to the appliance.
LDAP servers have been configured to authorize users. For details about how to configure an LDAP server, see LDAP server configuration.
A Certificate Authority (CA) certificate bundle has been downloaded, and an imported certificate has been added to an existing bundle from a specified URL. For details about how to download CA certificate bundle, see Downloading a CA certificate bundle using the CLI.
Policy settings of the Web UI for certificate-based authentication have been enabled. For details about how to enable policy settings of the Web UI, see Enabling or disabling the policy settings of the Web UI for certificate-based authentication.
User attributes for certificate authentication have been configured. For details about how to configure the user attributes for certificate authentication, see Configuring the user attributes for certificate authentication.
Online Certificate Status Protocol (OCSP) has been enabled and configured so that the appliance can validate certificate revocation. For details about how to enable and configure OCSP for certificate revocation, see Enabling or disabling OCSP using the CLI and Adding or removing the OCSP URL using the CLI.