Certificate based client authentication

This feature enables to get the certificate based client authentication.

Client authentication based on SASL EXTERNAL mechanism provides for two-way authentication between the LDAP client and the LDAP server.

With client authentication, the LDAP client must have a digital certificate (based on the X.509 standard). This digital certificate is used to authenticate the LDAP client to IBM® Verify Directory using a lower level TLS protocol.

The Simple Authentication and Security Layer (SASL) can be used to add authentication support to connection protocols. A protocol includes a request for identifying and authenticating a user to a server. It can optionally negotiate a security layer for subsequent protocol interactions.

After a server receives the authentication request or any client response, it may issue a challenge or indicate failure or completion. If a client receives a challenge it may issue a response or end the exchange, depending on the profile of the protocol.

During the authentication protocol exchange, the SASL EXTERNAL mechanism performs authentication, transmits an authorization identity (known as userid) from the client to the server, and negotiates the use of a mechanism-specific security layer.