Home » GNU|Linux smartcard logon using PAM-PKCS11

X.509 user mapping

In a second phase, certificates are mapped to user accounts according to rules configured in /etc/pam_pkcs11/pam_pkcs11.conf

# Which mappers ( Cert to login ) to use?
# you can use several mappers:
#
# subject - Cert Subject to login file based mapper
# pwent - CN to getpwent() login or gecos fields mapper
# ldap - LDAP mapper
# opensc - Search certificate in ${HOME}/.eid/authorized_certificates
# openssh - Search certificate public key in ${HOME}/.ssh/authorized_keys
# mail - Compare email fields from certificate
# ms - Use Microsoft Universal Principal Name extension
# krb - Compare againts Kerberos Principal Name
# cn - Compare Common Name (CN)

# uid - Compare Unique Identifier
# digest - Certificate digest to login (mapfile based) mapper
# generic - User defined certificate contents mapped
# null - blind access/deny mapper
#
# You can select a comma-separated mapper list.
# If used null mapper should be the last in the list :-)
# Also you should select at least one mapper, otherwise
# certificate will not match :-)
use_mappers = digest, cn, pwent, uid, mail, subject, null;

use_mappers can have several values.

The most common mappers are: mail, subject, opensc and openssh.
ldap is not described here and will be described in another tutorial.

Bookmark/Search this post with