Configuring the user attributes for certificate authentication using the configuration menu

Prev Next

Use the menu options in this section to configure the user attributes for certificate authentication.

To configure the user attributes for certificate authentication:

  1. Log in to the NDR as npadmin using the NDR IP address or FQDN. For example:

    $ ssh npadmin@10.1.0.1

    or

    $ ssh npadmin@exampleFQDN

  2. Enter privileged mode:

    npadmin@ia> enable

  3. Enter the npadmin password. The password can be 5 to 24 characters long.

    [sudo] password for npadmin: <password>

  4. Enter configuration mode:

    npadmin@ia# configure system

  5. Enter configuration CAC menu.

    npadmin@ia(config)# authentication

  6. In the CAC/PIV configuration menu, select 1 to access the Authentication Mechanism menu.

    CAC_PIV_Certificate1.JPG
  7. Select 2 to select LDAP.

  8. Select Q to save your changes and exit to the configure system menu.

  9. Enter the CAC/PIV configuration menu.

    npadmin@ia(config)# authentication

  10. Select 2 to configure LDAP.

    CAC_PIV_Certificate2.JPG
  11. Make configuration changes to one of the following user attributes. Press Q to save your changes and exit the LDAP configuration menu.

    • x509-cert-subject—Specifies the name in the subject field in the certificate.

    • x509-cert-subject-cn—Specifies the Common Name (CN) from the DN attribute in the certificate.

    • x509-cert-san-email—Specifies an email address in the Subject Alternative Name (SAN) field of the certificate. You are allowed to have multiple subfields for SAN.

    • x509-cert-san-email-username—Specifies the user name of the email address without the domain name in the certificate.

    • x509-cert-san-upn—Specifies the User Principal Name (UPN) that is encoded in the "Other Name" field of the SAN field in the certificate.