[Date Prev][Date Next]
[Chronological]
[Thread]
[Top]
Re: client certificates -- howto?
Fair enough. And googling around with random combinations of 10 or so
keywords helped me out a bit. So its in the archive I found the
following especially usefull:
http://www.opengroup.org/messaging/G260/tech11.htm
Ive sent message to the openssl users list asking this... The 'openssl
req' command will ask for components of a DN and try to assemble it
itself, clearly however I already know the exact DN to specify. How can
I do this?
On Sat, 2003-09-20 at 19:22, Dieter Kluenter wrote:
> OK. Just a simple method to authenticate against openldap:
> 1. create user certificates with a DN matching the DN in the DIT
> 2. sign this certificates with your cacert
> 3. distribute cacert.pem to your hosts
> 4. create ~/.ldaprc files with TLS entries according to man ldap.conf
> 5. start authenticating, using sasl EXTERNAL mechanism and forcing TLS
>
> dieter@marin:~> ldapwhoami -Y EXTERNAL -ZZ
> SASL/EXTERNAL authentication started
> SASL username: CN=Dieter Kluenter,OU=partner,O=avci,C=de
> SASL SSF: 0
> dn:cn=dieter kluenter,ou=partner,o=avci,c=de
>
> SASL username is extracted from the certificate.
>
> -Dieter