public interface X509CertificateMapper
myLibrary.jar -- com/acme/CustomLdapMapper.class -- com/acme/AnotherCustomCertificateMapper.class -- META-INF/services/com.ibm.websphere.security.X509CertificateMapperThe provider-configuration file lists all the X509CertificateMapper implementations to be provided as an OSGi service. For example, for myLibrary.jar, the META-INF/services/com.ibm.websphere.security.X509CertificateMapper provider-configuration file has a list of services, with each service on its own line. It *must* also specify the ID for each instance by inserting a comment line prior to each implementing class that contains a key value pair where the key is 'x509.certificate.mapper.id' and the value is a unique ID that can be used to reference the instance from a user registry in the server.xml.
# x509.certificate.mapper.id=mapper1 com.acme.CustomMapper # x509.certificate.mapper.id=mapper2 com.acme.AnotherCustomMapperOnce the JAR has been packaged, update the server.xml configuration to include the "bells-1.0" feature, the library that points to the JAR and the BELL configuration that points to the library. Finally, associate the user registry to a X509CertificateMapper implementation by changing the "certificateMapMode" to "CUSTOM" and setting the "certificateMapperId" to the value of the 'x509.certificate.mapper.id' of the instance of the mapper to use. Below is an example of associating 'mapper1' to and LDAP registry using the BELL feature.
<server> <featureManager> <feature>ldapRegistry-3.0</feature> <feature>bells-1.0</feature> </featureManager> <!-- Create a library for the JAR file that contains the CertificateMapper implementation. --> <library id="mylibrary"> <file name="${shared.resource.dir}/libs/MyLibrary.jar"> </library> <!-- Load the library in a BELL. --> <bell libraryRef="mylibrary" /> <!-- Configure the registry with the custom X509CertificateMapper. --> <ldapRegistry ... certificateMapMode="CUSTOM" certificateMapperId="mapper1" ... /> </server>
<server> <featureManager> <feature>ldapRegistry-3.0</feature> <feature>user:myFeature-1.0</feature> </featureManager> <!-- Configure the registry with the custom X509CertificateMapper. --> <ldapRegistry ... certificateMapMode="CUSTOM" certificateMapperId="mapper1" ... /> </server>
Modifier and Type | Method and Description |
---|---|
java.lang.String |
mapCertificate(java.security.cert.X509Certificate[] certificates)
Map the X.509 certificate.
|
java.lang.String mapCertificate(java.security.cert.X509Certificate[] certificates) throws CertificateMapNotSupportedException, CertificateMapFailedException
X509CertificateMapper
for an LDAP registry should return a string that is one of either:
X509CertificateMapper
for a basic registry should return a string that corresponds
to the user's name in the registry. For example: user1certificates
- The certificate chain containing the certificate to map.CertificateMapNotSupportedException
- If certificate mapping is not supported.CertificateMapFailedException
- If the certificate could not be mapped.