Novell ACCESS MANAGER 3.1 SP2 - IDENTITY SERVER GUIDE 2010 Manual page 143

Show certificate errors: Displays an error page when a certificate error occurs. This option is
disabled by default.
Auto Provision X509: Enables using X.509 authentication for automatic provisioning of
users. This option allows you to activate X.509 for increased security, while using a less secure
way of authentication, such as username/password. Extra security measures can even include
manual intervention to activate X.509 authentication by adding an extra attribute that is
checked during authentication.
An example of using this option is when a user authenticates with an X.509 certificate, a
lookup is performed for a matching SASallowableSubjectNames with the name of the user
certificate. When no match is found, and Auto Provision X509 is enabled, the user is presented
with a custom error page specifying to click a button to provide additional credentials, such as
a username and password, or to start an optional Identity Manager workflow. If the
authentication is successful, then the user's SASallowableSubjectNames attribute is filled in
with the certificate name of the user certificate.
When Auto Provision X509 is enabled, and the attribute that is used for subject name mapping
is changed from the default sasAllowableSubjectNames, you need to ensure that the LDAP
attribute that is used can store string values with a length as long as the longest client certificate
subject name. For example, if you use the LDAP attribute title (which has an upper bound of 64
characters) the Auto Provision X509 fails the provisioning part of the authentication if the client
certificate subject name is longer 64 characters. The authentication works if a valid name and
password is given. However, provisioning fails.
Attributes: The list of attributes currently used for matching. If multiple attributes are
specified, the evaluation of these attributes should resolve to only one user in the user store.
The evaluation first does a DN lookup for subject name or directory name mapping. If this
fails, the rest of the mappings are looked up in a single LDAP query.
Available attributes: The available X.509 attributes. To use an attribute, select it and move it
to the Attributes list. When the attribute is moved to the Attributes list, you can modify the
mapping name in the Attribute Mappings section. The mapped name must match an attribute in
your LDAP user store.
Configuring Advanced Local Authentication Procedures 143