Certificate User Domain

A Certificate User Domain allows you to authenticate users using a client certificate, typically for unattended agents and CI/CD pipelines.

Prerequisite

Before you can assign a specific certificate to a new Certificate User as a Client Certificate Chain, you must upload it in the Client Auth Certificates section to make the certificate available for assignment. This step can be performed by a Signum Administrator.

Configure the Domain

1. In the Admin Web Console, navigate to Access > Domains and click New.

2. Set Domain Type to Certificate Users and complete the common domain options (Alias, Concurrency, User Limit). See Domains for descriptions of these fields.

3. Click Submit to create the domain.

The new domain appears in the list on the Domains tab, where you can create and manage its users.

Create a Certificate User

1. Select the new Certificate Users domain from the list of available domains in the Domains tab.

2. In the popup window for editing the domain, navigate to the Users tab.

3. Click New to begin creating a new user.

4. Under Signum Configurations, fill in:

   • Username: for example, alice@example.com

   • Name: the user's display name

   • Email: the user's email address

5. You can also set:

   • Add one or more Client Certificate Chains.

   • Optionally, define Attribute Matching Rules to enforce during authentication.

Client Certificate Chains

In the Client Certificate Chains setting, define a certificate user by either adding a specific client certificate or adding any client certificate issued by that CA.

Attribute Matching Rules

In addition to Client Certificate Chains, you can create rules for the user certificate. For example:

• Thumbprint is equal to 9AF31D5C72AE89478F9BC31277D91A6F2B449E01

• Subject DN contains CN=John Doe, OU=Engineering

To restrict a client certificate to a particular CA, you could add:

• Issuer DN is equal to CN=Example CA, O=Example Corp, C=US

A user is authenticated only if the presented certificate meets all defined Attribute Matching Rules.

The available attributes are:

• Serial number

• Subject DN

• Thumbprint

• SANs

• Issuer DN

Usage Notes

Any certificate configuration, either Specific Client Certificate or CA Chain, may be only be assigned to one user. Assigning the same configuration to more than one user results in a login error message: “The certificate matches more than one user profile. We’re unable to determine which account to use. Please reach out to your administrator.”

Both the CA certificate chain and the client authentication certificate can be used in combination with attribute matching rules.

Some example configurations and the resulting behavior are: