Certificate Authentication

HCL Domino Domino Forum
1

I have been investigating the use of x.509 certificates for web authentication purposes. It is working properly in the test environment as long as I import the certificate of the user into their entry in the Domino Directory and add the appropriate alias to the record as well.

My problem is that the preferred certificate is a KCA certificate with a short lived life (maximum of 7 days) and is unique per machine.

I was hoping that by adding the trusted root to the keyring file on the server and importing the CA’s certificate into the Domino Directory that importing the public key for the individual’s certificate would not be necessary.

Is it possible to enable certificate authentication without importing the user’s certificate into their person record? If so, please point me in the right direction for instructions/documentation/general help.

I am attempting to I have been investigating the use of x.509 certificates for web authentication purposes. It is working properly in the test environment as long as I import the certificate of the user into their entry in the Domino Directory and add the appropriate alias to the record as well.

My problem is that the preferred certificate is a KCA certificate with a short lived life (maximum of 7 days) and is unique per machine.

I was hoping that by adding the trusted root to the keyring file on the server and importing the CA’s certificate into the Domino Directory that importing the public key for the individual’s certificate would not be necessary.

Is it possible to enable certificate authentication without importing the user’s certificate into their person record? If so, please point me in the right direction for instructions/documentation/general help.

Just in case it matters, my server is 6.5.4x and am using a Windows OS.

Thanks - Craig

Any advice would be appreciated.

Thanks - Craig

2

Subject: Certificate Authentication

It is not possible to authenticate a user with a third party client certificate if that cert is not in their person doc. There has to be a way to map the certificate to a notes user.

Look at the admin help page titled “Publishing third-party CA client certificates in a Person record”

3

Subject: RE: Certificate Authentication

I used the admin help to get the authentication to work.

I was hoping that I could configure the system in a way to allow authentication without the certificate being loaded in the person document. I thought tht having the distguished name of the user as an alias in the person record would allow authentication to the Domino server.

A high level of my understanding of how the authentication would work is:

  1. The webserver has in its keyring file the trusted root fo CA myca.

  2. User gets certificate from CA myca.

  3. The distinguished name of the user’s certificate is added as an alias to the person record.

  4. When user accesses the webserver using certificate from myca the webserver should “trust” the identity.

The way Apache can handle authenticating all users certified by a given CA is by using the “SSLRequire” directive of the mod_ssl module. This directive allows you to specify pattern matches for various parts of the client certificate. So you can require that only client certificates from an issuing CA of “ABC” are acceptable - or that a list of DN’s is acceptable in combination with this CA requirement.

Web resources that explain this are:

http://security.fnal.gov/pki/webauthors.html

http://www.modssl.org/docs/2.8/ssl_reference.html#ToC23

Based on this it seems that the public key is not need in a directory for Apache.

I was hoping that there was a similar configuration for Domino.