An administrator uses the information from the X.509 certificate to identify the user and assign user roles that allow the user to perform certain operations on the appliance. The following table describes the user attributes for the X.509 certificates that are used for certificate authentication.
Attribute | Description |
|---|---|
x509-cert-subject | Name of the entry for the subject field in the certificate. The subject is the Distinguished Name (DN) and is the X.509 structure. Each entry has a unique identifier. The following example shows the DN format for CAC: C=US, O=Test Government, OU=Test Department, OU=Test Agency, CN=Test Cardholder |
x509-cert-subject-cn | Common Name (CN) entry from the DN attribute that is associated in a certificate. For example, |
x509-cert-san-email | The email address in the Subject Alternative Name (SAN) field of the certificate. You are allowed to have multiple subfields for SAN. |
x509-cert-san-email-username | The user name of the email address without the domain name in the certificate. |
x509-cert-san-upn | User Principal Name (UPN) attribute that is encoded in the Other Name field of the SAN field in the certificate. |
x509-cert-san-upn-username | Username of the UPN attribute in the certificate. |
Note
You can configure the user attributes for certificate authentication only using the CLI.
Admin access to the appliance.
(Optional) LDAP servers have been configured to authorize users. For details about how to configure an LDAP server, see LDAP server configuration.
A Certificate Authority (CA) certificate bundle has been downloaded, and an imported certificate has been added to an existing bundle from a specified URL. For details about how to download CA certificate bundle, see Downloading a CA certificate bundle using the CLI.
Policy settings of the Web UI for certificate authentication have been enabled. For details about how to enable policy settings of the Web UI, see Enabling or disabling the policy settings of the Web UI for certificate-based authentication.