Repository navigation
Request for Documentation on the Use of X.509 Certificate Serial Number and IssuerDN Identity Source
#46940
Replies: 0 comments
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Uh oh!
There was an error while loading. Please reload this page.
The server administration guide notes that:
I am looking for a little bit more of a hint on how to actually set this up. Importantly, I also want to know if there is a sensible outcome when a user has more than one certificate, possibly from different issuers (i.e., that the IssuerDN and Serial Number of each entry are tied together in some way to form the overall mapping).
Ultimately I would like to match this information against the
altSecurityIdentitiesattribute in Active Directory. Currently we're populating this attribute with theX509IssuerSerialNumbermapping format, because this is the strong mapping recommended by Microsoft. This attribute is a string of the formX509:<I>IssuerName<SR>1234567890and can have multiple values. It seems very straightforward to import these attributes into Keycloak from LDAP, but not straightforward to match the user's certificate to them in the X.509 authentication flow.All reactions