Configuring certificate-based authentication

Edit online

Authenticate with the Identity Management (IM) service. First, import the signer or root (CA) certificate. Then, provide a personal certificate that contains the common name (CN) as it is configured in a backend Lightweight Directory Access Protocol (LDAP) registry.

Prerequisites

Edit online
  • Your LDAP connection must be configured with IM. For more information, see Configuring LDAP connection by using IdP V3 API.
  • Create certificates for authentication. Use a root certificate authority (CA) certificate. If a root CA certificate isn't available, you can instead use a signer certificate or a personal certificate.

Creating certificates and keys

Edit online

Complete the following steps if the user does not have an existing CA or personal certificate.

Creating a CA certificate

Edit online

The following steps show an example of creating a CA certificate.

  1. Generate a self-signed certificate if you don't want to use your existing CA certificate. To create a CA certificate as an issuer certificate, provide its key and certificate so that individual LDAP users can create their own certificates to log in to the IBM Cloud Pak.

    openssl genrsa -out certAuthCA.key 4096
openssl req -x509 -new -nodes -key certAuthCA.key -sha256 -days 365 -out certAuthCA.crt -subj "/CN=CertAuthCA"

  2. Register an identity provider configuration for certificate authentication by providing a certAuthCA.crt issuer CA certificate in the configuration. For more information, see Registering with an API or Registering with the console.

    • Individual LDAP users can use their own key and certificate pair that the CA issues for certificate authentication login.
    • If a CA certificate isn't available for registration, you can instead use a personal certificate.
    • IM supports only single cert-based authentication registration.

Creating keys and certificates for LDAP users

Edit online

LDAP users create their own keys and certificates by using the CA key and certificate that the administrator provides. The following example for user1 applies if you don't have a specific personal certificate. In this example, user1 must be a valid LDAP user ID in the configured LDAP connection. The user's certificate subject CN also needs to match the LDAP user ID.

openssl genrsa -out user1.key 4096
openssl req -new -key user1.key -out user1.csr -subj "/CN=user1"
openssl x509 -req -in user1.csr -CA certAuthCA.crt -CAkey certAuthCA.key -CAcreateserial -out user1.crt -days 365 -sha256

After successful cert-based authentication, grant access to LDAP users and groups for authorization.

Importing certificates into the browser

Edit online

  1. Upload the user key and certificate pair as p12 into the browser.

    openssl pkcs12 -export -in user1.crt -inkey user1.key -out user1.p12

  2. Import the .p12 certificate into the browser.

    • To import into Firefox, complete the following steps:
      1. Open Firefox and go to Settings>Privacy & Security.
      2. Click View Certificates and select the Your Certificates tab.
      3. Click Import and locate your .p12 file.
      4. Enter your password and click OK.
    • To import into Chrome, complete the following steps:
      1. Open Chrome and go to Settings.
      2. Select Privacy and security and go to Security>Manage certificates. Certificate Manager opens.
      3. Select Installed by you and click Import.
      4. Follow the prompts to locate and import your certificate. Enter your password if prompted and click Finish.

Registering your certificate-based authentication

Edit online

You can register your certificate-based authentication through an API or with the console. Choose one of the following methods.

Registering with the console

Edit online
  1. Log on to the console as an administrator.
  2. From the navigation menu, click Administer>Identity providers.
  3. Click Create Connection. Select Certificate based authentication and click Next. New certificate connection appears.
  4. Select Connection details. Enter the following information:
    • In the Name field, enter a name for the certificate connection.
    • In the optional Description field, enter a description of the certificate connection.
  5. Select the existing LDAP connection.
  6. Click Add certificate.
  7. Enter a certificate ID, upload the certificate, and click Add.
  8. Then, create the connection.

Logging in by using certificate-based authentication

Edit online
  1. Go to the IBM Cloud Pak console login page.
  2. Select Certificate based authentication.
  3. Enter the personal certificate that you imported to the browser in one of the previous steps. If you use a shared system while you select the browser certificate, clear the Remember this decision checkbox.
  4. Log in to the IBM Cloud Pak.