Configure Certificate-Based Routing

Edit online

This scenario builds on the basic PeSIT configuration by configuring certificate-based routing. Certificate-based routing uses a routing name returned by Sterling External Authentication Server. It is associated with the subject distinguished name found in the PNODE certificate. Secure Proxy uses this routing name to determine the SNODE where the incoming Secure Proxy connection is routed. To perform certificate-based routing, modify an adapter you defined in the basic PeSIT configuration.

The following diagram illustrates the certificate-based routing function:


Certificate-Based Routing

Summary of Certificate-Based Routing

Following are the steps performed during certificate-based routing:
  1. The PNODE passes a certificate chain during an SSL/TLS session. This certificate includes several attributes, such as subject and distinguished name (DN).
  2. Secure Proxy passes the certificate chain to Sterling External Authentication Server.
  3. Using the configuration parameters in a certificate validation request, Sterling External Authentication Server attempts to match PNODE certificate attributes to the LDAP server and requests the associated routing value.
  4. LDAP returns the routing value to Sterling External Authentication Server.
  5. Sterling External Authentication Server passes the routing value to the Secure Proxy engine.
  6. Secure Proxy routes the PNODE request to the SNODE using the routing value.