Certificate

Configuration

Note

Authenticator type: CertificateAuth

Common Authenticator configuration can be found here.

Properties

Name	Description	Default value	Mandatory
certificate_header_name	Name of the headers containing the certificate.	N/A	true
missing_certificate_location	If the header contains no datat, where to redirect the client.	N/A	true
custom_identifier	When logging events, the custom_identifier lets you tag the event.	N/A	false

Example

{
            "id": "cert",
            "type": "CertificateAuth",
            "config": {
              "base_path": "/saml/authn",
              "certificate_header_name": "pemdata",
              "missing_certificate_location":"https://<custom_location>"
            }
}

Caution

Property base_path should not contain the full path when used in conjunction with the Selector, instead, the full URI will be handled by the selector. The full path will be base_path + / + id.

Logging

Apart from system logging, event logging is done when starting, completing, and failing a transaction.

Event ids are:

• WEB_100013("Authentication using certificate completed")
  • IDENTIFIER (user trace id)
  • SOURCE_ADDRESS (ip address of device starting transaction)
  • CUSTOMER_IDENTIFIER (if configured)
  • SOURCE_USER_NAME (subject from the certificate)
  • MESSAGE (certificate serial)

Data exposed to global state

After a user completes a transaction, the authenticator is marked as done. Data from the authentication response is then put into the global state replacing existing values:

• serial
• subject
• certificate

API

This authenticator has no user interface and therefore exposes no Web Authenticator API. It reads the certificate from the request headers and completes without any dialogue with the browser.