Certificate based authentication with Anyconnect

Dears,
         i successfully configured ASA to be used as VPN gateway with anyconnect using certificate in authentication , my issue my be not realted to Cisco directly.
i am using CA server installed on Windows 2008 R2 , when i checked the issued certicate i found that all certicates requester name is "CAadmin" .
i need to differeniate between users certificate using thier domain users as requester name.
Thanks,
Ibrahim

John,
Reference the RFC for TLS (in this case 1.0)
http://www.ietf.org/rfc/rfc2246.txt
Server send certificate_list and certificate request, containing certificate_authorities, which is the key info here.
when client responds it can send a certificate
Client certificates are sent
       using the Certificate structure defined in Section 7.4.2.
same section describing server certificate.
Server sends its certificate, certificate_list and list of acceptable signers of certificates it will accept (certificate_authorities), client responds with a (one) corresponding cert and certificate_list.
If server has client's signer certificate I do not believe it needed a whole chain sent.
Client still needs to send certificate list but can ommit signing root.
About CRL, you authenticate root and subCA, i.e. implicitly trust.
AFAIR you only perform revocation check of certs you do not implicitly trust.
(My PKI is a bit rusty, feel free to challange)
HTH,
M.
Message was edited by: Marcin Latosiewicz, re-read parts of RFC and adapted my answer.

Similar Messages

  • Certificate based authentication with sender SOAP adapter. Please help!

    Hi Experts,
       I have a scenario where first a .Net application makes a webservice call to XI via SOAP Adapter. Then the input from the .Net application is sent to the R/3 system via RFC adapter.
    .Net --->SOAP -
    >XI -
    >RFC -
    R/3 System
    Now as per client requirement I have to implement certificate based authentication in the sender side for the webservice call. In this case the .Net application is the "client" and XI is the "server". In other words the client has to be authenticated by XI server. In order to accomplish this I have setup the security level in the SOAP sender channel as "HTTPS  with client authentication". Additionally I have assigned a .Net userid in the sender agreement under "Assigned users" tab.
    I have also installed the SSL certificate in the client side. Then generated the public key and loaded it into the XI server's keystore.
    When I test the webservice via SOAPUI tool I am always getting the "401 Unauthorized" error. However if I give the userid/password for XI login in the properties option in the SOAPUI tool then it works fine. But my understanding is that in certificate based authentication, the authentication should happen based on the certificate and hence there is no need for the user to enter userid/password. Is my understanding correct? How to exactly test  certificate based authentication?
    Am I missing any steps for certificate based authentication?
    Please help
    Thanks
    Gopal
    Edited by: gopalkrishna baliga on Feb 5, 2008 10:51 AM

    Hi!
    Although soapUI is a very goot SOAP testing tool, you can't test certificate based authentication with it. There is no way (since I know) how to import certificat into soapUI.
    So, try to find other tool, which can use certificates or tey it directly with the sender system.
    Peter

  • X.509 certificate based authentication with load balancer

    I've been asked to implement certificate-based authentication (CBA)
    on a weblogic cluster serving up web services. I've read through
    Chapter 10 (security) and understand the "Identity Assertion" concept.
    Environment:
    Weblogic 8.1 cluster fronted by a load-balancer that handles SSL and
    uses sticky-sessions.
    Question:
    If the load balancer is used to handle SSL, do I still need to turn
    on SSL on the weblogic cluster in order to use CBA? Is there another
    way to request the client's certificate?
    If the above is yes, what is the minnimal level of SSL? Does it have
    to be two-way?
    If SSL has to be turned on is there any reason to use the load
    balancer's SSL? Is there still a performance benefit?

    Hi George,
    If you want the client's cert, the server has to ask for it and this
    implies two-way SSL. Normal one-way SSL the server provides the cert to
    the client and the client decides if it wants to continue the handshake.
    If the client is OK with the server certs and two-way SSL is configured
    on the server, then the server will request the client send it's certs.
    If the client certs are OK, then the pipe is established.
    Concerning the load balancer I'm assuming it is simply providing a
    tunnel, but I don't have the experience to comment and it is something I
    would suggest that you that you seek guidance from our outstanding
    support team [1] or drop a note in the security newsgroup [2] for the
    experts to review.
    Regards,
    Bruce
    [1]
    http://support.bea.com
    [email protected]
    [2]
    http://newsgroups.bea.com/cgi-bin/dnewsweb?cmd=xover&group=weblogic.developer.interest.security
    George Coller wrote:
    >
    I've been asked to implement certificate-based authentication (CBA)
    on a weblogic cluster serving up web services. I've read through
    Chapter 10 (security) and understand the "Identity Assertion" concept.
    Environment:
    Weblogic 8.1 cluster fronted by a load-balancer that handles SSL and
    uses sticky-sessions.
    Question:
    If the load balancer is used to handle SSL, do I still need to turn
    on SSL on the weblogic cluster in order to use CBA? Is there another
    way to request the client's certificate?
    If the above is yes, what is the minnimal level of SSL? Does it have
    to be two-way?
    If SSL has to be turned on is there any reason to use the load
    balancer's SSL? Is there still a performance benefit?

  • Certificate based authentication with iOS Client

    Hello experts,
    I have a question regarding the certificate based authentication in SAP Mobile Documents. With the Android Client it is "easy" possible to use certificate based authentication by just sending the user certificate to the Android device (using mail, MDM or whatever).
    For the iOS App it is written that the user has to sync the certificate to the device using iTunes sync. Is this really the only possibility to bring the certificate to the iOS device so that the App can use it? I have successfully tested by adding the certificate using iTunes, but I cannot make it working using MDM to push the certificate to the device. SAP Mobile Documents just cant see the installed certificate.
    Am I doing something wrong here?
    Thanks for your help.
    Ernst

    Hi, I don't think this is supported on iOS right now. Something for future ....

  • DPS attempting certificate based authentication with Directory Servers

    I'm running DPS 6.3 and DS 6.3.
    I have DPS configured to always connect to the directory servers over SSL. This is working, however, all of the Direectory server error logs are showing certificate based bind attempts originating from the DPS. This results in err=32, since the certificate isn't stored in the ldap server. Anyone else seeing this type of behavior?
    I checked the DPS Security config, and under the "Certificate to use with Data Sources" I have it set to 'None'.
    Thanks.

    Hello,
    Certificate-based authentication cannot be proxied (it was designed to prevent man-in-the-middle attacks).
    When the proxy receives a certificate-based bind (SASL EXTERNAL authentication method), it first validates the client certificate (signature, validity,trust etc), and map the certificate identity (subject) onto a LDAP identity. This is done by doing some LDAP lookups against the directory server. Then, that LDAP identity is used for subsequent LDAP requests to the directory servers. As the password is not available, the proxy must be configured to contact the directory server using proxied authorization method or using fixed credentials (used in conjunction with acis set on the proxy)
    DPS 6.3 never uses the SASL/EXTERNAL (certificate-based) authentication method when it contacts directory servers.
    When SSL is used between the proxy and the server, the proxy may present its own certificate to the directory server (controlled by the DPS security property you mentioned). It is possible to check if DPS stashes its own certificate when it establish a SSL channel to the directory server by using the ssltap tool [http://www.mozilla.org/projects/security/pki/nss/tools/ssltap.html] . If a certificate is passed, the No-Such-Object error you see might be generated during certificate validation by the directory server.
    Hope this helps
    -Sylvain

  • Certificate based authentication with SSL load balancer

    I've been asked to implement certificate-based authentication (CBA)
    on a weblogic cluster serving up web services. I've read through
    Chapter 10 (security) and understand the "Identity Assertion" concept.
    Environment:
    Weblogic 8.1 cluster fronted by a load-balancer that handles SSL and
    uses sticky-sessions.
    Question:
    If the load balancer is used to handle SSL, do I still need to turn
    on SSL on the weblogic cluster in order to use CBA? Is there another
    way to request the client's certificate?
    If the above is yes, what is the minnimal level of SSL? Does it have
    to be two-way?
    If SSL has to be turned on is there any reason to use the load
    balancer's SSL? Is there still a performance benefit?

    I think the simplest and most secure way is to have the servers configured for
    2-way ssl, since this would ensure that the certificate they receive and use for
    authentication has been validated during the ssl handshake. In this case the load
    balancer itself does not need to and cannot do the handshaking, and would need
    to pass the entire SSL connection through to the WLS server (ie: act similar to
    a router)
    Pavel.
    "George Coller" <[email protected]> wrote:
    >
    I've been asked to implement certificate-based authentication (CBA)
    on a weblogic cluster serving up web services. I've read through
    Chapter 10 (security) and understand the "Identity Assertion" concept.
    Environment:
    Weblogic 8.1 cluster fronted by a load-balancer that handles SSL and
    uses sticky-sessions.
    Question:
    If the load balancer is used to handle SSL, do I still need to turn
    on SSL on the weblogic cluster in order to use CBA? Is there another
    way to request the client's certificate?
    If the above is yes, what is the minnimal level of SSL? Does it have
    to be two-way?
    If SSL has to be turned on is there any reason to use the load
    balancer's SSL? Is there still a performance benefit?

  • User Certificate based Authentication Using Anyconnect (DTLS)

    Hello,
    I believe it is possible to set up an ASA to enforce the need for anyconnect users to have a USER certficate installed on their machine before the VPN grants them access.  However, I`ve been trying to get this to work but I`m always allowed to connect with only a password.  Would appreciate any guidance on how to get this working with user based certificate authenitcation.  Are there any documents around specific to the full process of setting up anyconnect with user certfificate authentication??
    Thank you

    Hi,
    I don’t believe that this functionality exists at this time on the ISA.
    http://www.cisco.com/en/US/docs/security/small_business_security/isa500/administration/guide/ISA500_AG_OL-23370.pdf
    From the admin guide for the ISA.  “According to the user authentication settings specified on the security appliance, the SSL VPN users can be authenticated by the local database or external AAA server (such as Active Directory, LDAP, or RADIUS). For information on configuring the user authentication settings, see Configuring User Authentication Settings, page 346.
    Thanks,
    Jason Nickle

  • Certificate based authentication with Cisco WLC and Juniper IC

    Hi
    I have a cisco WLC 4400 and Juniper IC which works as the external Radius server.
    I want the wireless clients to be authenticated using certificates. I know the Juniper IC can understand certificates.
    My question is can cisco WLC understand that the information being presented to it by the client is not username/pwd but a user certificate.
    i have also looked at this article :
    http://www.cisco.com/c/en/us/support/docs/wireless/4400-series-wireless-lan-controllers/100590-ldap-eapfast-config.html
    What i don't understand here is the need of WLC authenticating the user with his credentials by LDAP when it has authenticated the user cert.
    All your help is appreciated.

    Hi,
    Since you use an external radius server you don't have to worry for this.
    The only config that you need to do on WLC is to define the radius server under Security-AAA-Radius-Authentication and on your WLAN-Security-AAA.
    The doc you refer is only for Local Radius on WLC.
    Hope this helps
    Regards,
    Christos

  • NPS and Cisco ASA 5510 - AnyConnect Certificate based authentication

    Hi everyone,
    Hoping someone can help please.
    We're trying to go for a single VPN solution at our company, as we currently have a few through, when buying other companies.
    We're currently running a 2008 R2 domain, so we're looking at NPS and we have Cisco ASA 5510 devices for the VPN side.
    What we would like to achieve, is certificate based authentication. So, user laptop has certificate applied via group policy based on domain membership and group settings, then user goes home. They connect via Cisco AnyConnect via the Cisco ASA 5510 and
    then that talks to MS 2008 R2 NPS and authenticates for VPN access and following that, network connectivity.
    Has anyone implemented this before and if so, are there any guides available please?
    Many Thanks,
    Dean.

    Hi Dean,
    Thanks for posting here.
    Yes, this is possible . But we have guide about a sample that using Windows based server (RRAS) to act as VPN server and working with Windows RADIUS/NPS server and use certificate based authentication method (Extensible Authentication Protocol-Transport
    Layer Security (EAP-TLS) or PEAP-TLS without smart cards) for reference :
    Checklist: Configure NPS for Dial-Up and VPN Access
    http://technet.microsoft.com/en-us/library/cc754114.aspx
    Thanks.
    Tiger Li
    Tiger Li
    TechNet Community Support

  • MfE with Certificate Based Authentication on E6

    Hello,
    I've been trying to setup MfE on my E6 but I can't find a way to configure it to use a personal certificate, I even tried using "Nokia Configuration Tool" but it tells me that my device does not support MfE with Certificate Based Authentication, I get "Invalid Credentials" when using a username & password.
    I get the same error on both Anna and Belle.
    Any help would be appreciated.
    Thanks

    Better give the MfE configuration in detail.
    Also please advise the if the server is a real Microsoft Exchange Server or a third-party mail service such as Gmail or Live.
    bbao
    * If this post helped you, please click the white Kudo star.
    * If this post has solved your issue, please click Accept as Solution.

  • ActiveSync with Certificate-Based Authentication

    We are trying to setup ActiveSync with certificate-based authentication against Exchange 2010 SP2, but with no luck.
    What has been done so far:
    OWA over https works fine. A public, trusted certificate is in place.
    Setup ActiveSync against this Exchange server: works fine, using user name/password.
    Issued a user cert, signed with an internal CA, CA-cert successfully imported into al client devices.
    Created a new OWA-site with cert-based authentication (just to make sure it works), imported user certificate into a mac, visit this OWA site - cert-based authentication works fine.
    Now, with the configuration utility, created configuration profile with that user cert and an ActiveSync account, left password blank and chose the imported cert (p12) as authentication means.
    After installing that last profile the device keeps asking for a password and refuses to synchronize. Logs on the server show error 401.2, so I assume iPhone is ignoring the cert and is trying to use password-authentication instead.
    The devices tested were iPhone 3G with IOS 4 and iPad 2 with IOS 5.
    Any help will be greatly appreciated.
    Roman.

    No-one with this experience?
    We've done some network analysis (as much as was possible to decrypt) and could see, that the server sends an SSL-Alert (rejection?) to the client after the client presents the certificate.
    That explains why the client falls back to password-authentication, but it does not tell us why the server rejects the cert (that is accepted perfectly when accessed from a browser) in first place.

  • Exchange 2010 SP3 OWA with certificate based authentication

    Hi,
    I have a bizarre problem in my customer’s environment. Maybe someone has an idea.
    Exchange 2010 with SP3, latest cumulative Update installed.
    The problem I’m having is that when I enable Certificate based authentication (require client certificate option in IIS) on OWA and ECP virtual directories in conjunction with forms based authentication (this is the requirement – the user
    must have a client certificate and type in username and password to log in to OWA), the result is that after the user selects the certificate he wants to use, he is logged into OWA automatically, but cannot use the website, because it’s being constantly automatically
    refreshed (or redirected to itself or something like that). The behavior occurs with all users, with any browser. If client certificate is on required, forms based authentication works just fine. If I switch to “Basic Authentication” and enable client certificate
    requirement, then OWA act’s as it should be – so no problems. The problem only occurs when authentication type is forms based and client certificates are required.
    I have tried the exact same settings (as far as I can tell) on one other production server and one test server, and encountered no such problems.
    Anyone – any ideas?

    Hi McWax,
    According to your description and test, I understand that all accounts cannot login OWA when select require client certificate.
    Is there any error message when open OWA or login? For example, return error ”HTTP error: 403 - Forbidden”. Please post relative error for further troubleshooting.
    I want to confirm which authentication methods are used for OWA, Integrated Windows authentication or Digest authentication? More details about it, for your reference:
    http://technet.microsoft.com/en-us/library/bb430796(v=exchg.141).aspx
    If you select another authentication method, please check whether Client Certificate Mapping Authentication services is installed, and also enabled in IIS, please refer to:
    http://www.iis.net/configreference/system.webserver/security/authentication/clientcertificatemappingauthentication
    To prevent firewall factor, please try to sign in OWA at CAS server. Besides, I find a FAQ about certificate:
    http://technet.microsoft.com/en-us/library/aa998424(v=exchg.80).aspx
    Best Regards,
    Allen Wang

  • Certificate based authentication for Exchange ActiveSync in Windows 8.* Mail app

    I have a Surface Pro and want to setup access to my company's Exchange server that accepts only Exchange ActiveSync certificate-based authentication.
    I've installed server certificates to trusted pool and my certificate as personal.
    Then I can connect thru Internet Explorer, but this is not comfortable to use.
    I don't have a password because of security politics of our company. When I'm setting up this account on my Android phone I'm using any digit for password and it works perfectly.
    Can someone help to setup Windows 8 metro-style Mail application? Does it supports this type of auth? When I'm trying to add account with type Outlook, entering server name, domain name, username, 1 as a password then I've got a message like "Can't
    connect. Check your settings."
    Is there any plans to implement this feature?

    For what it's worth we have CBA working with Windows 8.1 Pro.  In our case we have a MobileIron Sentry server acting as an ActiveSync reverse-proxy, so it verifies the client cert then uses Kerberos Constrained Delegation back to the Exchange CAS, however
    it should work exactly the same to the Exchange server directly.  I just used the CA to issue a User Certificate, exported the cert, private key and root CA cert, copied to the WinPro8.1 device and into the Personal Store.  Configured the Mail app
    to point at the ActiveSync gateway, Mail asked if I would like to allow it access the certificate (it chose it automatically) and mail synced down immediately...
    So it definitely works with Windows Pro 8.1.

  • Need Help about Certificate based Authentication

    Hi friends..
    Currently, i'm trying to develop an applet that using Certificate Based Authentication..
    i have looked at this thread : http://forums.sun.com/thread.jspa?threadID=5433603
    these is what Safarmer says about steps to generate CSR :
    0. Generate key pair on the card.
    1. Get public key from card
    2. Build CSR off card from the details you have, the CSR will not have a signature
    3. Decide on the signature you want to use (the rest assumes SHA1 with RSA Encryption)
    4. Generate a SHA1 hash of the CSR (without the signature section)
    5. Build a DigestInfo structure (BER encoded TLV that you can get from the PKCS#1 standard) that contains the message digest generated in the previous step
    6. Send DigestInfo to the card
    7. On the card, the matching private key to encrypt the DigestInfo
    8. Return the encrypted digest info to the host
    9. Insert the response into the CSR as the signature
    Sorry, i'm a little bit confused about those steps.. (Sorry i'm pretty new in X509Certificate)..
    on step 4,
    Generate a SHA1 hash of the CSR (without the signature section)
    Does it mean we have to "build" CSR looks like :
    Data:
    Version: 0 (0x0)
    Subject: C=US, ST=California, L=West Hollywood, O=ITDivision, OU=Mysys, CN=leonardo.office/[email protected]
    Subject Public Key Info:
    Public Key Algorithm: rsaEncryption
    RSA Public Key: (1024 bit)
    Modulus (1024 bit):
    00:be:a0:5e:35:99:1c:d3:49:ba:fb:2f:87:6f:d8:
    ed:e4:61:f2:ae:6e:87:d0:e2:c0:fd:c1:0f:ed:d7:
    84:04:b5:c5:66:cd:6b:f0:27:a2:cb:aa:3b:d7:ad:
    fa:f4:72:10:08:84:88:19:24:d0:b0:0b:a0:71:6d:
    23:5e:53:4f:1b:43:07:98:4d:d1:ea:00:d1:e2:29:
    ea:be:a9:c5:3e:78:f3:5e:30:1b:6c:98:16:60:ba:
    61:57:63:5e:6a:b5:99:17:1c:ae:a2:86:fb:5b:8b:
    24:46:59:3f:e9:84:06:e2:91:b9:2f:9f:98:04:01:
    db:38:2f:5b:1f:85:c1:20:eb
    Exponent: 65537 (0x10001)
    Attributes:
    a0:00
    on step 5, Build a DigestInfo structure (BER encoded TLV that you can get from the PKCS#1 standard) that contains the message digest generated in the previous step
    How DigestInfo structure (BER encoded TLV that you can get from the PKCS#1 standard) looks like?
    And what is the DigestInfo Contains, and what is TAG for DigestInfo?..
    Please help me regarding this..
    Thanks in advance..
    Leonardo Carreira

    Hi,
    Leonardo Carreira wrote:
    Sorry, Encode the Public Key is handled by On Card Application or Off Card Application?..
    I think its' easier to encode the public key by Off Card app..
    Could you guide me how to achieve this?, i think Bouncy Castle can do this, but sorry, i don't know how to write code for it.. :( All you need to do is extract the modulus and exponent of the public key. These will be in a byte array (response from your card) that you can use to create a public key object in your host application. You can then use this key to create a CSR with bouncycastle.
    I have several some questions :
    1. Does Javacard provide API to deal with DER data format?JC 2.2.1 does not buy JC 2.2.2 does, however I believe this is an optional package though. You can implement this in your applet though.
    2. Regarding the Certificate Based Authentication, what stuff that need to be stored in the Applet?..
    - I think Applet must holds :
    - its Private Key,
    - its Public Key Modulus and its Public Key Exponent,
    - its Certificate,
    - Host Certificate
    i think this requires too much EEPROM to store only the key..This depends on what you mean by Certificate Based Authentication. If you want your applet to validate certificates it is sent against a certificate authority (CA) then you need the public keys for each trust point to the root CA. To use the certificate for the card, you need the certificate and corresponding private key. You would not need to use the public key on the card so this is not needed. You definitely need the private key.
    Here is a rough estimate of data storage requirements for a 2048 bit key (this is done off the top of my head so is very rough):
    ~800 bytes for your private key
    ~260 bytes per public key for PKI hierarchy (CA trust points)
    ~1 - 4KB for the certificate. This depends on the amount of data you put in your cert
    3. What is the appropriate RSA key length that appropriate, because we have to take into account that the buffer, is only 255 bytes (assume i don't use Extended Length)..You should not base your key size on your card capabilities. You can always use APDU chaining to get more data onto the card. Your certificate is guaranteed to be larger than 256 bytes anyway. You should look at the NIST recommendations for key strengths. These are documented in NIST SP 800-57 [http://csrc.nist.gov/publications/PubsSPs.html]. You need to ensure that the key is strong enough to protect the data for a long enough period. If the key is a transport key, it needs to be stronger than the key you are transporting. As you can see there are a lot of factors to consider when deciding on key size. I would suggest you use the strongest key your card supports unless performance is not acceptable. Then you would need to analyse your key requirements to ensure your key is strong enough.
    Cheers,
    Shane

  • Certificate based authentication

    I have a client application that requires certificate based authentication.
    I could not find any instructions on how to set this up in the 11g manuals. So I reverted to the 5.2 manual (http://docs.oracle.com/cd/E19850-01/816-6698-10/ssl.html#18500), and followed some instructions found online.
    I have completed the setup, and the client is able to authenticate using his certificate, and I have verified this in the logs.
    [22/Mar/2012:13:13:33 -0500] conn=34347 op=-1 msgId=-1 - SSL 128-bit RC4; client CN=userid,OU=company,L=city,ST=state,C=US; issuer CN=issuing,DC=corp,DC=company,DC=lan
    [22/Mar/2012:13:13:33 -0500] conn=34347 op=-1 msgId=-1 - SSL client bound as uid=userid,ou=employees,o=company
    [22/Mar/2012:13:13:33 -0500] conn=34347 op=0 msgId=1 - BIND dn="" method=sasl version=3 mech=EXTERNAL
    When adding the usercertificate attribute to the ID I used the following LDIF:
    version: 1
    dn: uid=userid,ou=employees,o=company
    changetype: modify
    replace: userCertificate
    usercertificate: < file:///home/user/Certs/usercert.bin
    the file was a binary encoded certificate file.
    Here is the part that I don't understand when I do a search (or LDIF export) of the user object with the certificate it just returns a short base64 encoded string. when I decode this string, it is just the literal string of "< file:///home/user/Certs/usercert.bin".
    So it appears that the certificate has not been stored on the user object in binary, and yet the certificate authentication still works. The file mentioned, does not exist on the LDAP server (the cert was loaded from another server), so there is no way that it is reading the cert from the file.
    Anyone have any idea what is going on here? And why certificate auth works, when there appears to be not cert stored in LDAP?
    If by chance this is how it is all suppose to work, then how do I go about backing up the usercertificate attribute when I do my LDAP data backups?
    Thanks
    Brian

    Cyril,
    Thanks for the reply.
    I believe I am doing both types of certificate authentication, you are describing. My issue is that when I perform the steps to store the PEM formatted cert into the directory server, rather than storing a binary value of the cert, it appears to be storing the path to the file I attempted to import. The odd part is that I can still authenticate even after this is done.
    I tried to post as much info as I could before without posting any sensitive data, I'll try and expand on that below.
    Here is my documentation of the steps taken to configure the server and setup a user, for what I believe to be certificate based authentication, where the user is authenticated solely on the certificate that they provide (no password is sent).
    1. Server must be running SSL, all connections for Certificate Auth are done over SSL (just a note)
    2. From the DSCC
    ----a. Directory Servers Tab -> Servers Tab -> Click Server Name
    ----b. Security Tab -> General Tab
    ----c. In "Client Authentication" section, select:
    --------i. LDAP Settings: "Allow Certificate-Based Client Authentication"
    --------ii. This should be the default setting.
    3. On the directory server setup the /ldap/dsInst/alias/certmap.conf file:
    ----a. certmap default default
    ----default:DNComps
    ----default:FilterComps uid,cn
    4. restart the directory server
    5. Do the following to setup the user who will be connecting. On their unix account (or similar)
    ----a. Create a directory to hold the certDB
    --------i. mkdir certdb
    ----b. Create a CertDB
    --------i. /ldap/dsee7/bin/certutil -N -d certdb
    ------------1) Enter a password when prompted
    ----c. Import the CA cert
    --------i. /ldap/dsee7/bin/certutil -A -n "OurRootCA" -t "C,," -a -I ~/OurRootCA.cer -d certdb
    ----d. Create a cert request
    --------i. /ldap/dsee7/bin/certutil -R -s "cn=userid,ou=company,l=city,st=state,c=US" -a -g 2048 -d certdb
    ----e. Send the cert request to the PKI Team to generate a user cert
    ----f. Take the text of the generated cert & save it to a file
    ----g. Import the new cert into your certdb
    --------i. /ldap/dsee7/bin/certutil -A -n "certname" -t "u,," -a -i certfile.cer -d certdb
    ----h. Create a binary version of cert
    --------i. /ldap/dsee7/bin/certutil -L -n "certname" -d certdb -r > userid.bin
    ----i. Add the binary cert to the user's LDAP entry (version: 1 must be included - I read this in a doc somewhere, but it doesn't seem to matter)
    --------i. ldapmodify
    ------------1) ldapmodify -h host -D "cn=directory manager" -w password -ac
    ------------2)
    ------------version: 1
    ------------dn: uid=userid,ou=employees,o=company
    ------------sn: Service Account
    ------------givenName: userid
    ------------uid: userid
    ------------description: Service Account for LDAP
    ------------objectClass: top
    ------------objectClass: person
    ------------objectClass: organizationalPerson
    ------------objectClass: inetorgperson
    ------------cn: Service Account
    ------------userpassword: password
    ------------usercertificate: < file:///home/userid/Certs/userid.bin
    ------------nsLookThroughLimit: -1
    ------------nsSizeLimit: -1
    ------------nsTimeLimit: 180
    After doing this setup I am able to perform a search using the certificate:
    ldapsearch -h host -p 1636 -b "o=company" -N "certname" -Z -W CERTDBPASSWORD -P certdb/cert8.db "(uid=anotherID)"
    This search is successful, and I can see it logged, as having been a certificate based authentication:
    [23/Mar/2012:13:25:20 -0500] conn=44605 op=-1 msgId=-1 - fd=136 slot=136 LDAPS connection from x.x.x.x:53574 to x.x.x.x
    [23/Mar/2012:13:25:20 -0500] conn=44605 op=-1 msgId=-1 - SSL 128-bit RC4; client CN=userid,OU=company,L=city,ST=state,C=US; issuer CN=issuer,DC=corp,DC=company,DC=lan
    [23/Mar/2012:13:25:20 -0500] conn=44605 op=-1 msgId=-1 - SSL client bound as uid=userid,ou=employees,o=company
    [23/Mar/2012:13:25:20 -0500] conn=44605 op=0 msgId=1 - BIND dn="" method=sasl version=3 mech=EXTERNAL
    If I understand correctly that would be using the part 2 of your explanation as using the binary encoded PEM to authenticate the user. If I am not understanding that corretly please let me know.
    Now the part that I am really not getting is that the usercertificate that is stored on the ID is as below:
    dn: uid=userid,ou=employees,o=company
    usercertificate;binary:: PCBmaWxlOi8vL2hvbWUvdXNlcmlkL0NlcnRzL3VzZXJpZC5iaW4
    which decodes as: < file:///home/userid/Certs/userid.bin
    So I'm still unclear as to what is going on here, or what I've done wrong. Have I set this up incorrectly such that Part 2 as you described it is not what I have setup above? Or am I missunderstanding part 2 entirely?
    Thanks
    Brian
    Edited by: BrianS on Mar 23, 2012 12:14 PM
    Just adding ---- to keep my instruction steps indented.

Maybe you are looking for