Certificate based client authentication using direct mapping

Edit online

This section describes the information you need to establish a security context with certificate based client authentication using SASL EXTERNAL mechanism with direct mapping

Directly mapping the certificate request DN to the user's DN is recommended when possible, as it eliminates the need for directory searches and supports mapping to DNs corresponding to entries not maintained by the server.

Suppose the certificate request DN is written as:

uid=dpeter,cn=dept,cn=div,cn=org

and the user's actual LDAP entry is:

uid=dpeter,ou=people,dc=com

then the following entry in ibmslapd.conf would provide for direct mapping.

ibm-slapdSASLDirectMappingSource: uid=([^,]*),cn=dept,cn=div,cn=org 
ibm-slapdSASLDirectMappingTarget: uid=$1,ou=people,dc=com

An even more lenient rule could be written as

ibm-slapdSASLDirectMappingSource: uid=([^,]*),cn=[^,]*,cn=[^,]*,cn=org
ibm-slapdSASLDirectMappingTarget: uid=$1,ou=people,dc=com

Be careful about setting the search pattern too leniently, however, since it may mistakenly allow persons to become authenticated as a DN to which they should not have access.

For certificate based client authentication using direct mapping, you can modify the ibmslapd.conf file under the cn=SSL, cn=Configuration entry.

To use the command line:

idsldapmodify -D <adminDN> -w <adminPW> -i <filename>

where <filename> contains:

dn: cn=SSL,cn=Configuration
cn: SSL
changetype: modify
replace: ibm-slapdSSLAuth
ibm-slapdSSLAuth: serverClientAuth
-
add: ibm-slapdSASLDirectMappingSource
ibm-slapdSASLDirectMappingSource: uid=([^,]*),cn=example,cn=dept,cn=org
-
add: ibm-slapdSASLDirectMappingTarget
ibm-slapdSASLDirectMappingTarget: uid=$1,ou=people,dc=com

You must restart the server and the administration server for the changes to take effect.