Novell EDIRECTORY 8.8 SP3, Administration Manual, Page: 365 / 634

Configuring LDAP Services for Novell eDirectory 365
n
ov
do
cx (e
n)
11
Ju
ly 20
08
14.6.6 Authenticating with a Client Certificate
Mutual Authentication requires a TLS session and a client certificate. Both the server and the client
must verify that they are the objects that they claim to be. The client certificate was validated at the
Transport layer. However, at the LDAP protocol layer, the client is anonymous until the client issues
an LDAP bind request.
Up to this point, the client has proven its authenticity to the server but not to LDAP. If a client wants
to authenticate as the identity contained in the client certificate, the client binds by using the SASL
EXTERNAL mechanism.
1 In Novell iManager, click the Roles and Tasks button Description: Roles and Tasks button .
2 Click LDAP > LDAP Overview .
3 Click View LDAP Servers , then click the name of an LDAP server object.
4 Click Connections .
5 In the Transport Layer Security section, select the drop-down menu for Client Certificate , then
select Required .
This enables Mutual Authentication.
6 Click Apply , then click OK .
14.6.7 Using Certificate Authorities from Third-Party Providers
During the eDirectory installation, the LDAP server receives a tree Certificate Authority (CA). The
LDAP Key Material object is based on that CA. Any certificate that a client sends to the LDAP
server must be able to be validated through that tree CA.
LDAP Services for eDirectory 8.8 supports multiple certificate authorities. Novell's tree CA is just
one certificate authority. The LDAP server might have other CAs (for example, from VeriSign*, an
external company.) This additional CA is also a trusted root.
To configure the LDAP server to use multiple certificate authorities, set the
ldapTLSTrustedRootContainer attribute on the LDAP server object. By referencing multiple
certificate authorities, the LDAP server allows a client to use a certificate from an external authority.
14.6.8 Creating and Using LDAP Proxy Users
Novell eDirectory assigns a [Public] identity to users who are not authenticated. In the LDAP
protocol, an unauthenticated user is an Anonymous user. By default, the LDAP server grants
Anonymous users the rights of the [Public] identity. These rights enable unauthenticated eDirectory
and Anonymous LDAP users to browse eDirectory by using [Public] rights.
The LDAP server also allows Anonymous users to use the rights of a different proxy user. That
value is located on the LDAP Group object. In Novell iManager, the value is named the Proxy User
field. In ConsoleOne, the value is named the Proxy Username field. The following figure illustrates
this field in Novell iManager.