Certificate Attributes

The Enterprise Gateway can authorize access to a Web Service based on the X.509 attributes of an authenticated client's certificate. For example, a simple Certificate Attributes filter might only authorize clients whose certificates have a Distinguished Name (DName) containing the following attribute: O=oracle. In other words, only "oracle" users are authorized to access the Web Service.

An X.509 certificate consists of a number of fields. The Subject field is the one of most relevance to this tutorial. It gives the DName of the client to which the certificate belongs. A DName is a unique name given to an X.500 directory object. It consists of a number of attribute-value pairs called Relative Distinguished Names (RDNs). Some of the most common RDNs and their explanations are as follows:

• CN: CommonName
• OU: OrganizationalUnit
• O: Organization
• L: Locality
• S: StateOrProvinceName
• C: CountryName

For example, the following is the DName of the sample.p12 client certificate supplied with the Enterprise Gateway:

CN=Sample Cert, OU=R&D, O=Company Ltd., L=Dublin 4, S=Dublin, C=IE

Using the Certificate Attributes filter, it is possible to authorize clients based on, for example, the "CN", "OU", or "C" in the DName.