Red Hat CERTIFICATE SYSTEM 7.3 - ADMINISTRATION, Administration Manual

Page: 220 / 554

Chapter 8. Token Processing System
198
auth.instance.1.baseDN=o=qa
auth.instance.1.ui.title.en=LDAP Authentication
auth.instance.1.ui.description.en=This authenticates user against the QA
LDAP directory.
auth.instance.1.ui.id.UID.name.en=LDAP User ID
auth.instance.1.ui.id.PASSWORD.name.en=LDAP Password
auth.instance.1.ui.id.UID.description.en=QA LDAP User ID
auth.instance.1.ui.id.PASSWORD.description.en=QA LDAP Password
##########################################################################
• The two format operation profiles are
devKey
and
qaKey
.
• The two mapping order 0 refers to the
devKey
and 1 refers to the
qaKey
.
• The two authentication instances 0 and 1 correspond to
ldap-dev
and
ldap-qa
, respectively.
The format operation is very simple, with the user inserting a token and clicking a button, then the rest
of the process occurring in the backend:
1. The user inserts the token. The token is recognized by its CUID in the Enterprise Security Client.
2. The user selects the token and clicks
Format
.
3. The Enterprise Security Client prompts for LDAP authentication.
4. The format operation completes.
When the token is selected in the Enterprise Security Client, the Enterprise Security Client sends in
the applet version, CUID, ATR, and other information about the token to the TPS server. TPS server
checks the
op.format.mapping..
section in the
CS.cfg
file and figures out which
tokenType
to
use for the token, either
devKey
or
qaKey
. It then uses the appropriate
op.format...
section to
perform LDAP authentication to the appropriate server and to the corresponding TKS for generating
session keys.
Example 8.1. Configuring Two Different Token Types
8.6. Configuring LDAP Authentication
The TPS can be configured to require the user to authenticate to an LDAP directory when a smart
card operation request is received. There are three parameters for this which can be set for the format,
reset PIN, or enrollment operation:
op. operation.key_type .auth.enable
op. operation.key_type .auth.id
op. operation.key_type .loginRequest.enable
Setting these parameters set whether LDAP authentication is required, the LDAP directory to use for
the authentication, and to send the login request to the smart card.
NOTE
The user must have an existing LDAP user entry in the LDAP server instance specified in
the TPS's
CS.cfg
file in order to complete the operation.