7.1

Option Description
Certificate policies accepted
Create a list of object identiers that are accepted in the certicate policies
extensions.
Enter the object ID numbers (OID) for the Certicate Issuing Policy. Click
Add another value to add more OIDs.
Enable cert revocation
Select the check box to enable certicate revocation checking. Certicate
revocation checking prevents users who have revoked user certicates
from authenticating.
Use CRL from certificates
Select the check box to use the certicate revocation list (CRL) published
by the CA that issued the certicates to validate a certicate's status,
revoked or not revoked.
CRL Location
Enter the server le path or the local le path from which to retrieve the
CRL.
Enable OCSP Revocation
Select the check box to use the Online Certicate Status Protocol (OCSP)
certicate validation protocol to get the revocation status of a certicate.
Use CRL in case of OCSP failure
If you congure both CRL and OCSP. You select this check box to use CRL
if OCSP checking is not available.
Send OCSP Nonce
Select this check box if you want the unique identier of the OCSP request
to be sent in the response.
OCSP URL
If you enabled OCSP revocation, enter the OCSP server address for
revocation checking.
OCSP responder's signing
certificate
Enter the path to the OCSP certicate for the responder, /path/to/le.cer.
Enable consent form before
authentication
Select this check box to include a consent form page to appear before users
log in to their My Apps portal using certicate authentication.
Consent form content
Type the text that displays in the consent form in this text box.
5 Click Save.
What to do next
n
Add the certicate authentication method to the default access policy.Navigate to Administration >
Directories Management > Policies and click Edit Default Policy to edit the default policy rules and
add Certicate and make it the rst authentication method for the default policy. Certicate must be
rst authentication method listed in the policy rule, otherwise certicate authentication fails.
n
When Certicate Authentication is congured, and the service appliance is set up behind a load
balancer, make sure that the Directories Management connector is congured with SSL pass-through at
the load balancer and not congured to terminate SSL at the load balancer. This conguration ensures
that the SSL handshake is between the connector and the client to pass the certicate to the connector.
Configuring a Third-Party Identity Provider Instance to Authenticate Users
You can congure a third-party identity provider to be used to authenticate users in the
Directories Management service.
Complete the following tasks prior to using the administration console to add the third-party identity
provider instance.
n
Verify that the third-party instances are SAML 2.0 compliant and that the service can reach the third-
party instance.
n
Obtain the appropriate third-party metadata information to add when you congure the identity
provider in the administration console. The metadata information you obtain from the third-party
instance is either the URL to the metadata or the actual metadata.
Chapter 2 Configuring Tenant Settings
VMware, Inc. 109