Hi all,
Having read all the manuals and snippets I can find, I have come up with the following
certmap.conf file:
certmap default default
default:verifycert on
default:CmapLdapAttr nsCertSubjectDN
What I want the above to do is this:
- Look up the subject of the client certificate as the DN in the nsCertSubjectDN
attribute.
- Also do an exact match of the certificate in the userCertificate attribute (verifycert
on).
- Do the search across all contexts.
Does the certmap above do this?
What is not working for me is the lookup:
[18/Nov/2020:00:10:33.787682853 +0200] conn=1269 TLS1.3 128-bit AES-GCM; client
serialNumber=365[snip]a14,CN=host.example.com; issuer CN=X,O=Y,C=UK
[18/Nov/2020:00:10:33.888476161 +0200] conn=1269 TLS1.3 failed to map client certificate
to LDAP DN (No such object)
Looking at the source code, the above message is logged if we have a certificate, but we
didn’t manage to map a DN:
https://github.com/389ds/389-ds-base/blob/f9638bbd8739659057249ac43b914d1...
Something missing from the documentation is the DN format expected by the nsCertSubjectDN
attribute.
Is the format CN=X,serialNumber=Y as reported by openssl x509, or is it
serialNumber=Y,CN=X as reported by the log message above?
Regards,
Graham
—