diff options
Diffstat (limited to 'doc/src')
| -rw-r--r-- | doc/src/sgml/client-auth.sgml | 24 |
1 files changed, 23 insertions, 1 deletions
diff --git a/doc/src/sgml/client-auth.sgml b/doc/src/sgml/client-auth.sgml index b420486a0af..951af49e9a4 100644 --- a/doc/src/sgml/client-auth.sgml +++ b/doc/src/sgml/client-auth.sgml @@ -598,7 +598,7 @@ hostnogssenc <replaceable>database</replaceable> <replaceable>user</replaceabl </para> <para> - In addition to the method-specific options listed below, there is one + In addition to the method-specific options listed below, there is a method-independent authentication option <literal>clientcert</literal>, which can be specified in any <literal>hostssl</literal> record. This option can be set to <literal>verify-ca</literal> or @@ -612,6 +612,28 @@ hostnogssenc <replaceable>database</replaceable> <replaceable>user</replaceabl the verification of client certificates with any authentication method that supports <literal>hostssl</literal> entries. </para> + <para> + On any record using client certificate authentication (i.e. one + using the <literal>cert</literal> authentication method or one + using the <literal>clientcert</literal> option), you can specify + which part of the client certificate credentials to match using + the <literal>clientname</literal> option. This option can have one + of two values. If you specify <literal>clientname=CN</literal>, which + is the default, the username is matched against the certificate's + <literal>Common Name (CN)</literal>. If instead you specify + <literal>clientname=DN</literal> the username is matched against the + entire <literal>Distinguished Name (DN)</literal> of the certificate. + This option is probably best used in conjunction with a username map. + The comparison is done with the <literal>DN</literal> in + <ulink url="https://tools.ietf.org/html/rfc2253">RFC 2253</ulink> + format. To see the <literal>DN</literal> of a client certificate + in this format, do +<programlisting> +openssl x509 -in myclient.crt -noout --subject -nameopt RFC2253 | sed "s/^subject=//" +</programlisting> + Care needs to be taken when using this option, especially when using + regular expression matching against the <literal>DN</literal>. + </para> </listitem> </varlistentry> </variablelist> |