IBM WebSphere V5.0 Security - CGISecurity

Configuring WebSphere to use certificate mapping
The following steps will show you how to configure WebSphere Application
Server to use the certificate filter as required.
1. Log in to the WebSphere Administration Console.
2. Select Security -> User Registries -> LDAP.
3. Select the Advanced LDAP Settings at the bottom of the LDAP page.
4. Set the following fields in the Configuration panel:
Certificate Map Mode: CERTIFICATE_FILTER
Certificate Filter: uniqueIdentifier=${SubjectDN}
5. Click OK, then save the configuration for WebSphere.
6. You have to stop and start the application server to implement the advanced
LDAP modifications.
Configuring the directory server to use certifcate mapping
The directory server store in your user registry has to be updated to reflect the
new values to use certificate mapping. Basically the uniqueIdentifier field has to
contain the SubjectDN for each user; the SubjectDN value can be extracted from
the public certificate of the user.
In the following steps, we will use the IBM SecureWay LDAP Directory.
1. Launch the SecureWay Directory Management Tool.
2. Rebind as an Authenticated User with adequate privileges to modify user
credentials.
3. Expand the directory tree and select the user entity against which you wish to
authenticate the personal client certificate. In this example, let us use the
user: manager.
4. Click Edit, switch to the Other tab and find the uniqueIdentifier field.
5. Enter the SubjectDN value for the uniqueIdentifier from the certificate. Use
the value returned by the Java keytool utility, in this case:
EmailAddress=testwebclient@yahoo.com, CN=Thawte Freemail Member
294 IBM WebSphere V5.0 Security Handbook