Auth via client SSL cert problem

Question

web server:iPlanet-WebServer-Enterprise/6.0SP2 B11/13/2001 00:49
Am trying to setup ACL's to allow only certain clients access to web server via client side certificates.
The LDAP entry does NOT have a "uid" attribute for the user's entry.
Snooping show me that the LDAP server is returning the correct LDAP entry. Web server says "get_auth_user_ssl: unable to map cert to LDAP entry. Reason: ldap entry is missing the 'uid' attribute value"
ACL files looks like
version 3.0;
acl "default";
authenticate (user, group) {
prompt = "foobar";
method = "ssl";
allow (read, list, execute,info) user = "*happy*" ;
allow (write, delete) user = "all";
Client cert CN looks like
CN=happy.fmr.com test happy.fmr.com, OU=B2B, OU=Applications, O=FMR Co
rp., C=US
Any suggestions on how to allow only a user whose client CN contains a certain word? Also anyway to increse the debug level in the error logs, I know 6.1 can do more but we are limited to using 6.0
Thanks
Ashish

Answer 1

Hi Faisal -- thanks for your reply. We had an offline chat where you said:
>>>>>>>>
These are the steps that u can follow
Configure Weblogic Server for 2-way SSL
mydomain> Servers> myserver>Keystores & SSL > Advanced Options
Hostname Verification: None
Two Way Client Cert Behavior: Client Certs Requested but not enforced
mydomain> Domain Wide Security Settings> Realms> myrealm> Authentication Providers> DefaultIdentityAsserter
Trusted Client Principals: provide CN of the Client Certificate
Types: X509
Details:
Use Default User Name Mapper: Checked
Default User Name Mapper Attribute Type: CN
Base64Decoding Required: Checked
Go the security realm and create a user wih the username as CN of the certificate
Dont forget to Import the client cert's root CA in the trust store of WLS.
If you still face issues, enable SSL Debug, securityATN debug and mail me the log file.
<<<<<<
I think there are a few minor config differences and I may have a different version of WLS to you -- the DefaultIdentityAsserter did not contain some of the fields you refer to. Instead I have an LDAPX509IdentityAsserter at the top of the Providers list, and I have made the changes there. My Providers list is:
- LDAPX509IdentityAsserter
- ActiveDirectory
- DefaultAuthentictor
- DefaultIdentityAsserter
I suspect you might be thinking I don't have two-way SSL working at all, but I do, and that's not my question. I can successfully validate a client based on SSL certificate so all the trust stores etc are correct. My question is what happens when there is no client certificate presented by the client -- I want it to fall through to Basic authentication. The ActiveDirectory provider has a Control Flag="SUFFICIENT" setting and I was expecting the X.509 one to have a similar flag, but it doesn't. What controls whether the X.509 provider is REQUIRED/REQUISITE/SUFFICIENT/OPTIONAL in the chain, like the Active Directory one?
Thanks for your time.
-- Ben.