Entering content frame

Background documentation Attribute Mapping for Client Certificates

When you set up an application for authentication with X.509 client certificates, each user must be associated with a certificate, so that when the user starts the application and presents his or her client certificate, the application grants access to the corresponding user.

Users’ certificates can be stored on the LDAP directory as an attribute of their user account. To allow UME to search for and store these certificates, you must ensure that the corresponding attributes are mapped correctly in your data source configuration files.

The following logical attributes of a user account are relevant:

·       certificatehash: Hash value of the client certificate.

·       javax.servlet.request.X509Certificate: Used to search for the LDAP certificate

·       certificate: Used to store the LDAP certificate

There are two places in the data source configuration files that must be set up accordingly. Firstly, you must list the above attributes in the <responsibleFor>section of the LDAP data source. This defines that these attributes are stored on the LDAP data source.

Example: ResponsibleFor section of LDAP data dource

  <dataSource id="CORP_LDAP"
        className="com.sap.security.core.persistence.datasource.imp.LDAPPersistence"
        isReadonly="false"
        isPrimary="true">
    <homeFor>
      <principal type="account"/>
      <principal type="user"/>
      <principal type="group"/>
    </homeFor>
    …
    <responsibleFor>
      <principal type="account">
        <nameSpace name="com.sap.security.core.usermanagement">
          <attributes>
            …
            <attribute name="certificatehash"/>
            <attribute name="javax.servlet.request.X509Certificate"/>
            <attribute name="certificate"/> 
          </attributes>
        </nameSpace>
      </principal>
            …
    </responsibleFor>
    …
    …
  </dataSource>

Secondly you must map the logical attributes to the corresponding physical attributes in your LDAP directory. These attributes are vendor specific.

Example: AttributeMapping section of LDAP data source

  <dataSource id="CORP_LDAP"
      className="com.sap.security.core.persistence.datasource.imp.LDAPPersistence"
      isReadonly="false"
      isPrimary="true">
    …
    <attributeMapping>
      <principals>
        <principal type="account">
          <nameSpaces>
            <nameSpace name="com.sap.security.core.usermanagement">
              <attributes>
                …
                <attribute name="certificatehash">
                  <physicalAttribute name="*null*"/>
                </attribute>
                <attribute name="javax.servlet.request.X509Certificate">
                  <physicalAttribute name="usercertificate"/>
                </attribute>
                <attribute name="certificate">
                  <physicalAttribute name="usercertificate"/>
                </attribute>
              </attributes>
            </nameSpace>
          </nameSpaces>
        </principal>
        …
      </principals>
    </attributeMapping>
    …
  </dataSource>

Note

The certificatehashattribute has to be mapped to *null*, as directory servers cannot handle hashed certificates. This prevents the hash value from being stored.

Note

You must map the logical attributes javax.servlet.request.X509Certificate and certificate to the same physical attribute on your directory server.

 

Leaving content frame