libre.sh/keycloak-scim
3
0
Fork 0
Code Issues 15 Pull requests Releases Packages Activity Actions

[KEYCLOAK-5471] X.509 Auth - email mapping doesn't work when 'Login with email' is disabled in the Realm

Browse source 
This change only documents the behavior of certificate authentication
when *Login with email* is disabled. In this way people don't get
confused about it.
This commit is contained in:
Bruno Oliveira 2017-11-24 10:23:43 -02:00 committed by Stian Thorgersen
parent 6de9d59d6f
commit dda00ae299
1 changed files with 3 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
server_admin/topics/authentication/x509.adoc
View file

@ -38,7 +38,9 @@ The regular expression filtering is applicable only if the `Identity Source` is
#### Mapping certificate identity to an existing user #### Mapping certificate identity to an existing user
The certificate identity mapping can be configured to map the extracted user identity to an existing user's username or e-mail or to a custom attribute which value matches the certificate identity. For example, setting the `Identity source` to _Subject's e-mail_ and `User mapping method` to _Username or email_ will have the X.509 client certificate authenticator use the e-mail attribute in the certificate's Subject DN as a search criteria to look up an existing user by username or by e-mail. The certificate identity mapping can be configured to map the extracted user identity to an existing user's username or e-mail or to a custom attribute which value matches the certificate identity. For example, setting the `Identity source` to _Subject's e-mail_ and `User mapping method` to _Username or email_ will have the X.509 client certificate authenticator use the e-mail attribute in the certificate's Subject DN as a search criteria to look up an existing user by username or by e-mail.
IMPORTANT: Please notice that if we disable `Login with email` at realm settings, the same rules will be applied to certificate authentication. In other words, users won't be able to log in using e-mail attribute.
#### Other Features: Extended Certificate Validation #### Other Features: Extended Certificate Validation
- Revocation status checking using CRL - Revocation status checking using CRL