Certificate-based authentication

Configure public key infrastructure (PKI) so users can authenticate to Cloud Management Platform (CMP) with client certificates

Configure PKI in the Cloud Management Platform (CMP) web interface

  1. Turn on the Database Browser: add ENABLE_DB_BROWSER = True to /var/opt/cloudbolt/proserv/customer_settings.py, then run systemctl restart httpd.
  2. Log in to CMP as an admin user.
  3. Go to Admin > Database Browser. On that page, find the Utilities section and select Add in the PKIUtilities row.
  4. Enter regex expressions that evaluate to the username, first, last, and email fields based on the Subject (or DN) field in the user certificates your company uses.
  5. Optionally, determine which groups the new users should have requestor, approver, and other roles in.
  6. Save the form.

Configure PKI in CMP’s server settings

Edit /var/opt/cloudbolt/proserv/customer_settings.py and append the following section:

# Enable PKI section
LOGIN_URL="/pki/login/"

Configure Apache to require client certificates for the /pki/login URL

  1. Use scp to copy the root CA certificate to the CMP server. This article uses /var/opt/cloudbolt/proserv/ca.crt as the certificate path.

  2. Edit /etc/httpd/conf/httpd.conf, adding the following section:

    <Location /pki/login>
    SSLCACertificateFile /var/opt/cloudbolt/proserv/ca.crt
    SSLVerifyClient require
    SSLVerifyDepth 5
    SSLOptions +StdEnvVars
</Location>

    If you are using an intermediate CA certificate, use the SSLCertificateChainFile directive instead of SSLCACertificateFile.

  3. Restart httpd.