Certificate mapping in Active Directory
Use of SubjectAltName and SmartCard logon
Note: The UPN is found in the Subject Alternative Field field in PIV Certificate.
Note: The UPN is found in the Subject Alternative Field field in PIV Certificate.
The UPN attribute is seen as Principal Name in PIV certificate. The value of this attribute is typically email address of the user. However, it could be any other agreed upon value. This example is for Authentication Certificate.
For Signing Certificate the Subject Alternative Name may be the email address of the user or the RFC822 Name.
These are important for PIV Authentication. The SAN will be used as an identifier during authentication process. PIV Identifiers https://playbooks.idmanagement.gov/piv/identifiers/
Note: you can only define or configure either UPN based mapping or altSecurityIdentities mapping in Windows Active Directory domain for PIV authentication. UPN and altSecId are the two account linking attributes - you select either one of them. This becomes the default for all your domain users.
Defining the Mapping in Active Directory
You might have to define certificate mappings in Active Directory. The decision on whether to define a mapping in Active Directory is often based on the answers to the following questions:
■ Is the certificate issued by an enterprise CA in your forest? If so, the certificate contains the user's UPN in the Subject Alternative Name extension and the CA's certificate is included in the NTAuth store of Active Directory. This enables the ability to use implicit mappings.
■ Is the certificate issued by a foreign CA? If the CA is not from your forest, you must define an explicit mapping to enable certificate-based authentication. In addition, you must add the foreign CA's certificate to the NTAuth store and ensure that the certificate's Subject or Subject Alternative Name contains the user's User Principal Name (UPN).
Enabling Implicit Certificate Mappings
If you intend to use a certificate based on the User Signature Only or Smart Card Login certificate templates, you can implement implicit certificate mappings. For an implicit certificate mapping, you only have to ensure that the issuing CA is in the NTAuth store. You can verify this using the following procedure:
1. Ensure that the Windows Server 2003 Resource Kit Tools are installed.
Note The Resource Kit Tools are av ailable for download at
96ee-b18c4790cffd&displaylang=en.
2. Open the PKI Health Tool (Pkiview.msc).
3. In the PKI Health Tool, in the console tree, right-click Enterprise PKI and click Manage AD Containers.
4. In the Manage AD Containers dialog box, on the NTAuthCertificates dialog box, ensure that the issuing CA's certificate appears. If the CA certificate does not appear, click Add.
5. In the Open dialog box, in the File Name box, type the file location of the issuing CA certificate and click Open.
6. In the Manage AD Containers dialog box, click OK.
7. Close the PKI Health Tool.
Enabling Explicit Mappings
To enable an explicit mapping in Active Directory, the user holding the private key associated with a client authentication certificate must provide you with access to the certificate. He or she can do this by simply e-mailing the certificate to you or by copying the certificate to a removable device and providing access to you.
An implicit mapping takes precedence and is tried first by SChannel before trying explicit mapping when validating a client certificate.
Note Even if you define an explicit mapping for a certificate, SChannel will attempt to perform an implicit mapping based on the certificate's subject before determining whether an explicit mapping exists.
Once you obtain the certificate, you can define the explicit mapping in Active Directory, as follows:
1. Log on as a user who is delegated the permissions to modify the target user account.
2. Open Active Directory Users and Computers.
3. From the View menu, click Advanced Features.
4. In the console tree, navigate to the container or OU in which the user account you want to associate with the certificate exists. You might have to create this user account.
5. In the details pane, right-click the user account and click Name Mappings.
6. In the Security Identity Mapping dialog box, on the X.509 Certificates tab, click Add.
7. In the Add Certificate dialog box, in the File Name box, type the path and file name of the user's certificate file, and click Open.
8. In the Add Certificate dialog box, verify the subject and issuer information. In this dialog box, you can choose whether to implement a one-to-one or a many-to-one mapping:
■ If you enable the Use Subject for Alternate Security Identity check box, you are enabling a one-to-one mapping. The certificate must contain the designated subject information for the mapping to occur.
■ If you clear the Use Subject for Alternate Security Identity check box, you are enabling a many-to-one mapping. The certificate must contain the designated issuer information for the mapping to occur.
Note If you choose to implement a many-to-one mapping, a dialog box appears warning you that you cannot switch the mapping back to a one-to-one mapping without redefining the mapping. The subject information is lost once you disable the Use subject for alternate security identity check box.
9. In the Security Identity Mapping dialog box, click OK.
Important Explicit mappings cannot be used for smart card logon. Smart card logon only uses an implicit mapping by mapping the UPN in the Subject Alternative Name of the certificate to the UPN of a user account in Active Directory. Explicit mappings can be used for Web authentication, wireless authentication, and VPN authentication.
Comments
Post a Comment