IBM Verify

 View Only

 How to configurate client certificate authentication

Tokai Teio's profile image
Tokai Teio posted 06/29/26 04:20 AM

How to configurate client certificate authentication

Aki Virtanen's profile image
Aki Virtanen

Greetings,

The CDAS configuration is explained in here: IVIA 11.0.0 Client Certificate User Mapping

Stephen Swann's profile image
Stephen Swann IBM Champion

The CDAS approach is listed as being deprecated and will be removed in future releases. In any case - the documentation isn't really helpful when it comes to explaining how this works - a lot of words are used, but very little meaning can be gleaned from those words. It would be worth popping over to Philip Nye's blog for some insight.

Like almost everything you may want to achieve in the world of IVIA, there are probably multiple ways to deal with your use case. I've previously enabled client certificate authentication by writing an Infomap and, in effect, using the EAI approach. Again, Philip's blog probably details how you can do this - but be careful, later versions of IVIA (i.e., v11) require some additional configuration.

Personally? I like the Infomap approach - I can understand the code! But I've never executed a performance test to see if EAI is better than CDAS (or vice versa). It might be interesting to hear the thoughts from Product Management on that?

I think your question, however, is interesting. It highlights that there is a fundamental problem with the product documentation. As an example, the following text is lifted straight from the product documentation explaining client certificate mapping:

When data is requested from a resource manager, the granularity of the XML data returned is at the level of a single container of information. The container is normally also the smallest data element (for example, elements that might be considered for billing purposes). This convention also applies to the UMI XML model. The UMI that is used in user mapping rules is also defined and manipulated as containers of XML data. For example, the stsuuser:STSUniversalUser XML object defined in XML certificate model is an example of a UMI container.

For most mere mortals, they will be able to read this and understand the individual words. Beyond that, though, they will struggle because the documentation fundamentally excludes context. In fact, if you read the documentation from Introduction through to "Configuring WebSEAL", you may end up more confused than you were prior to even asking the question.

I've mentioned it before, but the best bet is to look up some previous example within the Community web pages; or take a look at Philip's excellent blog. Just be careful - many of the configuration examples are "version" specific.

Scott Exton's profile image
Scott Exton

If you are running a more recent version of IVIA I would suggest that you implement the client certificate authentication using Lua.  An example of how to do this has been included in the product documentation: https://www.ibm.com/docs/en/sva/11.0.3?topic=SSRN3F_11.0.3/com-ibm-isva-doc/wrp_config/task/tsk_cre_lua_cert_mod.htm

I hope that this helps,

Scott.