7.2

n
(Optional) A list of the Object Identifiers (OID) of valid certificate policies for certificate authentication.
n
For revocation checking, the file location of the certificate revocation list and the URL of the OCSP
server.
n
(Optional) OCSP Response Signing certificate file location.
n
Consent form content, if a consent form is required to display before authentication.
Procedure
1 As a tenant administrator, navigate to Administration > Directories Management > Connectors
2 On the Connectors page, select the Worker link for the connector that is being configured.
3 Click Auth Adapters and then click CertificateAuthAdapter.
You are redirected to the identity manager sign-in page.
4 Configure the Certificate Authentication Adapter page.
Note An asterisk indicates that the information is required.
Option Description
*Name A name is required. The default name is CertificateAuthAdapter. You can change
this name.
Enable certificate adapter Select the check box to enable certificate authentication.
*Root and intermediate CA certificates Select the certificate files to upload. You can select multiple root CA and
intermediate CA certificates that are encoded as DER or PEM.
Uploaded CA certificates The uploaded certificate files are listed in the Uploaded Ca Certificates section of
the form.
Use email if no UPN in certificate If the user principal name (UPN) does not exist in the certificate, select this check
box to use the emailAddress attribute as the Subject Alternative Name extension
to validate user accounts.
Certificate policies accepted Create a list of object identifiers that are accepted in the certificate policies
extensions.
Enter the object ID numbers (OID) for the Certificate Issuing Policy. Click Add
another value to add more OIDs.
Enable cert revocation Select the check box to enable certificate revocation checking. Certificate
revocation checking prevents users who have revoked user certificates from
authenticating.
Use CRL from certificates Select the check box to use the certificate revocation list (CRL) published by the
CA that issued the certificates to validate a certificate's status, revoked or not
revoked.
CRL Location Enter the server file path or the local file path from which to retrieve the CRL.
Enable OCSP Revocation Select the check box to use the Online Certificate Status Protocol (OCSP)
certificate validation protocol to get the revocation status of a certificate.
Use CRL in case of OCSP failure If you configure both CRL and OCSP. You select this check box to use CRL if
OCSP checking is not available.
Send OCSP Nonce Select this check box if you want the unique identifier of the OCSP request to be
sent in the response.
Configuring vRealize Automation
VMware, Inc. 131