Configuring certificate-based user authentication

The following steps describe how to configure certificate-based user authentication:

No.	Task	Description
1	Create user identity certificate.	The certificate must represent a user identity. The certificate can be a self-signed certificate or signed by a third-party CA. The following certificate characteristics are preferred: 2048-bits long public key and private key SHA256 Signature Algorithm X509 V3 extension— Extended Key Usage: clientAuth
2	Import user identity certificate to the web browser or web service client.	Web browser When accessing the EPM administration webpages through a browser, you must install and configure the client certificates on the browser. When the user tries to access the EPM webpages, the browser sends the certificates to the EPM for authentication. You must import a whole chain of certificates and the private key to the web browser. Different web browsers have different ways to import the user identity certificate. For example, Internet Explorer 11 or Chrome have a tab named Personal on the Certificates page. Firefox has a tab named Your Certificates on the Certificate Manager page. Web service client When calling the EPM web services, the web service clients must send the appropriate certificates to the EPM server to use client-based authentication. To configure SSL for Axis2 web service client, see the Axis2 open sources documentation. The Application Interface test client VPAppIntfClient.sh has been enhanced to include certificate-based authentication. For more information, see the Running the Application Interface test client VPAppIntfClient.sh topic in the Upgrading to Avaya Experience Portal 8.1 guide.
3	Import user certificate to EPM.	You must select the Certificate type of User when you upload or import the user identity certificate. For more information about how to upload or import the user identity certificate, see Trusted Certificates tab on the Certificates page field descriptions.
4	Configure a user for certificate-based authentication.	The administrator can select an authentication method on the enhanced Add User page and Change User page. The options are: Password: To authenticate the user by password. Password Longevity applies. Certificate: To authenticate the user by certificate. The administrator can select a certificate that has been imported to EPM and assign the certificate to the user. The type of user certificate cannot be shared among users. Password Longevity does not apply. Password and Certificate: To authenticate the user by a two-factor authentication, password and certificate. If one factor fails, the user cannot log in to the EPM. For information about how to configure the authentication type for the user, see the online document section of Add User page field descriptions and Change User page field descriptions.
5	Send user identity certificate to EPM from web browser.	The EPM URL is received from the web browser. The web browser usually prompts the user to select a user identity certificate to send to EPM for authentication. If the user is configured as a Certificate type of User with a valid user identity certificate, the user will arrive at the EPM main page without needing a password. However, it is mandatory that the user is enabled and not locked. If the user is configured as a Password and Certificate type of User, and if the user identity certificate is valid, EPM presents the login page. The user must then enter valid user credentials to pass the authentication. .