(v24) Configure Client Certificate Authentication

Configure Client Certificate Authentication

This applies to: Visual Data Discovery

Symphony supports X.509 client certificate authentication. However, note that auto-provisioning of user accounts is not available for client certificate authentication.

To use the X.509 authorization you need to:

• Enable the X.509 option in the Security Services section

• Configure the required properties in the zoomdata.properties file

Caveat

Symphony does not support auto-provisioning of user accounts for client certificate authentication.

Configuration Steps

For guidance on accessing and editing a Symphony property file, refer to the topic Configure Symphony.

Add the following settings to your zoomdata.properties file:

server.port= 8443 server.ssl.enabled= true server.ssl.client-auth= want server.ssl.key-store= .../server.jks server.ssl.key-store-password= <Your_password> server.ssl.key-store-type= <use_either_jks_or_pkcs12> server.ssl.trust-store= .../truststore.jks server.ssl.trust-store-password=<Your_password> server.ssl.trust-store-type= <use_either_jks_or pkcs12>

For each user, create an user account in Symphony with the username set to the 'CN' in the user's certificate.

Troubleshooting

Challenges you may run into:

• User is never prompted to select a certificate:

  • Make sure you have added at least one CA to the trust-store file.

  • Verify server.ssl.client-auth is set to want.

• Selecting login brings me back to the login page:

  • Make sure the username matches the CN of the certificate being used.

  • Make sure the client certificate is signed by a CA in the trust-store.

For further troubleshooting assistance, contact Technical Support.