- Access exclusive content
- Connect with peers
- Share your expertise
- Find support resources
06-29-2018 06:12 AM
I've been trying to setup this scenario. But I keep getting subject as username on GP portal.
Is there any trick? Because configuration is pretty simple.
06-29-2018 07:52 AM
I'm not sure if i fully understand what you are trying to achieve but to use ldap authentication email address on GP you will need to add "mail" to the login attribute in the authentication profile.
07-02-2018 12:13 AM - edited 07-02-2018 12:16 AM
I'm trying to setup 2 factor autehntication for GP users; client certificate and GP credentials.
I already made it work with self signed CA on PA where I'm issuing certificates with LDAP username in certificate subject. So once the user selects the correct certificate, username field is poulated with LDAP username from certificate subject field.
Now I'm trying to make the same scenario with CA i don't control and where I can't demand CA to issue certificates with LDAP usernames as certificate subject. But these certificates do have an email address as alternative subject parameter. So instead of selecting 'subject' as username field in Certificate Profile I select Subject Alt and Email for username field. However when I try to login to GP portal i'm still getting subject field (which is name and surname) in user login field. I would be expecting email in this field. I've checked the certifiate and it has email in subject alternative name field:
Then next step will be modifiying authentication profile to accept email for login imo.
07-02-2018 12:32 AM - edited 07-02-2018 12:33 AM
I did a packet capture and I can see that LDAP authentication profile is trying to send mail as login atribute but the value is still from certificate subject instead of subject alternative parmameter email as configured in certificate profile:
07-02-2018 04:22 AM
I have not used it in this way but what happens if you add the user domain in the auth profile and set modifier to :-
"%USERINPUT%@%USERDOMAIN&
i have tested part of this and my certificate alt email of mick.ball@domain.com is only adding mick.ball to the ldap authentication window.
07-02-2018 04:28 AM
Ty for your suggestion.
But I'm stuck one step before this imo. In your case PA is already taking alternative subject parameter with email address from certificate it seems. While in my case PA keeps taking subject parameter even tho I change my certificate profile to fetch Alt Subject Email from certificate.
07-02-2018 04:50 AM
although you have no control over issued certificates you could generate your own root cert on the PA and then sign user certs from this, then create a test certificate profile and play with this on a test portal.
that is what i am doing
07-02-2018 05:01 AM
to confirm . this is the settings i have.
Certificate Profile
my certificate
output on iphone GP.
07-02-2018 05:07 AM
please note that when i generated my test certificate and added the email address to email it did not work, but when i added it as alt email it did work as expected.
perhaps this is your issue.
07-02-2018 05:34 AM
What were you getting as username when you were using 'normal' email addres in certificate (instead of alt email)? Whatever was in certificate subject? Or some different error?
07-02-2018 05:38 AM
Tho looking at your client cert and mine (in post above) the field looks the same.
07-02-2018 05:39 AM
yes they do look the same but windows may be collating this information from different fields to the PA.
07-02-2018 05:43 AM - edited 07-02-2018 05:44 AM
when I added my emai to 'email' the auth failed and I was not prompted for ldap auth, the client on my iphone stated 'invalid certificate'.
it only started working when i added email to 'alt email'. this prompted me to login as michael.ball but my cn for my cert is mick ball, not michael.ball.
07-02-2018 05:46 AM
Ok, thanks so far. I'll play a bit more with local CA first and email/alt email fields.
07-02-2018 11:48 PM
I made a new cert with local CA with email and alt email properties. And "subject alternative name property" is definitelly alt email as PA understands it. Because email is expected in subject of certificate, while alt email goes in extended properties.
Cert made with CA on PA:
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!