Use this command to configure a dynamically extracted username from the X.509 certificate subject field.
| attribute | Specifies the distinguished name attribute to extract from the X.509 certificate subject field. Valid values are supported long names, short names, or OID. |
| prefix prefix | Specifies a fixed string to prefix to the username. |
| match expression | Specifies a regular expression to dynamically apply to the extracted attribute. |
| suffix suffix | Specifies a fixed string to suffix to the username. |
None.
All command modes with admin privilege.
This command allows each user to have their own set of authorization credentials based upon a specified distinguished name attribute extracted from the X.509 certificate subject field. The distinguished name attribute can be specified as a long name, short name, or an OID. X.509 Subject Field Distinguished Name Attributes lists the supported distinguished name attributes.
X.509 Subject Field Distinguished Name Attributes
| Attribute | Long Name | Short Name | OID |
|---|---|---|---|
| Country Name | countryName | C | 2.5.4.6 |
| Organization Name | organizationName | O | 2.5.4.10 |
| Organizational Unit Name | organizationalUnitName | OU | 2.5.4.11 |
| Common Name | commonName | CN | 2.5.4.3 |
The username can be prefixed with a fixed string. For example, if the distinguished name attribute is Extremenetworks and the specified prefix is foo, the extracted username will be fooExtremenetworks.
In some instances it may be desirable to use only a subset of the extracted attribute, rather than the entire attribute verbatim. The match option allows for the dynamic application of a regular expression to the extracted attribute. The matching character output is used as the username.
The username can be suffixed with a fixed string. For example, if the distinguished name attribute is US, and the specified suffix is bar, the extracted username will be USbar.
This example shows how to set the username to the organizational name in the X.509 certificate subject field:
System(su)-> set pki authorization username attribute organizationName System(su)->
This example shows how to match only the final 10 digits in a dotted notation name (doe.james.m.0123456789) and append @army.mil to the extracted digits for an extracted user name of 0123456789@army.mil:
System(su)->set pki authorization username attribute commonName match “[^.]*$” suffix “@army.mil” System(su)->
Print
this page
Email this topic
Feedback
View PDF
Download EPUB