Novell ACCESS MANAGER 3.1 SP1 - IDENTITY SERVER Manual page 109

Use this page to specify attribute mappings for the X.509 authentication class. Subject name is
the default map.
Show certificate errors: Displays an error page when a certificate error occurs. This option is
disabled by default.
Auto Provision X509: Enables using X.509 authentication for automatic provisioning of
users. This option allows you to activate X.509 for increased security, while using a less secure
way of authentication, such as username/password. Extra security measures can even include
manual intervention to activate X.509 authentication by adding an extra attribute that is
checked during authentication.
An example of using this option is when a user authenticates with an X.509 certificate, a
lookup is performed for a matching SASallowableSubjectNames with the name of the user
certificate. When no match is found, and Auto Provision X509 is enabled, the user is presented
with a custom error page specifying to click a button provide additional credentials, such as a
username and password, or to start an optional Identity Manager workflow. If the
authentication is successful, then the user's SASallowableSubjectNames attribute is filled in
with the certificate name of the user certificate.
When Auto Provision X509 is enabled, and the attribute that is used for subject name mapping
is changed from the default sasAllowableSubjectNames, you need to ensure that the LDAP
attribute that is used can store string values with a length as long as the longest client certificate
subject name. For example, if you use the LDAP attribute title (which has an upper bound of 64
characters) the Auto Provision X509 fails the provisioning part of the authentication if the client
certificate subject name is longer 64 characters. The authentication works if a valid name and
password is given. However, provisioning fails.
Attributes: The list of attributes currently used for matching. If multiple attributes are
specified, the evaluation of these attributes should resolve to only one user in the user store.
Configuring Advanced Local Authentication Procedures 109