Chapter 7. Configuring certificate-based authentication

Procedure

1. Create a /etc/dirsrv/slapd-instance_name/certmap.conf file to map information from the certificate to Directory Server users:

   certmap default         default
   default:DNComps         dc
   default:FilterComps     mail,cn
   default:VerifyCert      on
   
   certmap example         cn=Example CA
   example:DNComps

   With this configuration, for certificates issued by cn=Example CA, Directory Server does not generate a base DN from the subject of the certificate because the DNComps parameter is set empty for this issuer. Additionally, the settings for the FilterComps and VerifyCert are inherited from the default entry.

   Certificates that have a different issuer DN than cn=Example CA will use the settings from the default entry and generate the base DN based on the cn attributes in the subject of the certificate. This enables Directory Server to start the search under a specific DN, without searching the whole directory.

   For all certificates, Directory Server generates the search filter using the mail and the cn attribute from the certificate’s subject. However, if the mail attribute does not exist in the subject, Directory Server will automatically use the value of the certificate’s e attribute in the subject.

2. Enable certificate-based authentication. For example, to configure certificate-based authentication as optional, enter:

   # dsconf -D "cn=Directory Manager" ldap://server.example.com security set --tls-client-auth="allowed"

   Use the --tls-client-auth=required option to configure certificate-based authentication as mandatory.

3. Optional: If you configured certificate-based authentication as required, enable the nsslapd-require-secure-binds parameter:

   # dsconf -D "cn=Directory Manager" ldap://server.example.com config replace nsslapd-require-secure-binds=on

   This setting ensures that users cannot bypass the certificate-based authentication by using an unencrypted connection.

4. Optional: If Directory Server should use the identity from the certificate instead of the credentials in the bind request, configure Directory Server to use the EXTERNAL simple authentication and security layer (SASL) mechanism:

   # dsconf -D "cn=Directory Manager" ldap://server.example.com config replace nsslapd-force-sasl-external=on

   With this setting, Directory Server ignores any other bind method than the identity in the certificate.

5. Restart the instance:

   # dsctl instance_name restart

Procedure

1. If the certificate is not in DER format, convert it. For example, to convert a certificate from privacy enhanced mail (PEM) to DER, enter:

   # openssl x509 -in /home/user_name/certificate.pem -out /home/user_name/certificate.der -outform DER

2. Add the certificate to the user’s userCertificate attribute:

   # ldapmodify -D "cn=Directory Manager" -W -H ldaps://server.example.com -x
   
   dn: uid=user_name,ou=People,dc=example,dc=com
   changetype: modify
   add: userCertificate
   userCertificate:< file:///home/user_name/example.der

Verification

1. Authenticate as the user using certificate-based authentication:

   1. Set the following environment variables to the corresponding paths to the CA certificate, the user key, and the user certificate:

      LDAPTLS_CACERT=/home/user_name/CA.crt
      LDAPTLS_KEY=/home/user_name/user.key
      LDAPTLS_CERT=/home/user_name/user.der

      Alternatively, set the TLS_CACERT, TLS_KEY, and TLS_CERT parameters in the ~/.ldaprc file of the current user.

   2. Connect to the server:

      # ldapwhoami -H ldaps://server.example.com -Y EXTERNAL
      dn: uid=example,ou=people,dc=example,dc=com