How to perform modifications for the Custom Field Mapping for Certificate Authentication

Products

• CA Privileged Access Manager (PAM)

Issue/Introduction

Default attribute mappings to the certificate for the imported LDAP object into PAM are:

Subject Name: distinguishedName

Subject Alternative Name: userPrincipalName

This works fine for Active Directory and MS Certificate Authority which is integrated in AD.

How to modify these mappings?

Environment

Release : All supported CA PAM versions as of October 2023

Component : PRIVILEGED ACCESS MANAGEMENT

Resolution

Do modifications in Config / ... / LDAP / ... / Custom Field Mapping according to your needs.

For the changes to become effective it is required to best delete the previously imported LDAP group, alternatively it might be sufficient to refresh the LDAP group.

You should see various warnings (confirmations) "PAM-LDAP-022 User was moved ..." indicating the new mappings have become effective.