Default certificate based client authentication
This feature enables to get the certificate based client authentication using SASL EXTERNAL mechanism with simple mapping.
When the LDAP server receives an LDAP bind request using SASL EXTERNAL mechanism from a client,
it processes the request in the following order:
- The request must be coming on a secure connection where the TLS protocol handshake is successfully completed.
- If the method of authentication is SASL, the server determines whether or not the SASL mechanism (specified in the request) is supported. If the SASL mechanism is not supported by the server, the server sends an error return code to the client and ends the bind process.
- If the SASL mechanism is supported (=EXTERNAL) and the SSL authentication type is server and
client authentication, the server verifies that the client's certificate is valid, issued by a known
CA, and that none of the certificates on the client's certificate chain are invalid or revoked. If
the client DN and password, as specified in the
ldap_sasl_bind, are NULL, then the DN contained within the client's x.509v3 certificate is used as the authenticated identity on subsequent LDAP operations. - If the client has not bound beforehand, and does not present a certificate during the bind operation, the connection is refused.
For client authentication using SASL EXTERNAL mechanism, modify the ibmslapd.conf file under the cn=SSL, cn=Configuration entry. To use the Web Administration Tool, see Using Web Administration.
To
use the command line:
idsldapmodify -D <adminDN> -w <adminPW> -i <filename>dn: cn=SSL,cn=Configuration
cn: SSL
changetype: modify
replace: ibm-slapdSSLAuth
ibm-slapdSSLAuth: serverClientAuth