Bug 2087247

.IdM now supports new Active Directory certificate mapping templates Active Directory (AD) domain administrators can manually map certificates to a user in AD using the `altSecurityIdentities` attribute. There are six supported values for this attribute, though three mappings are now considered insecure. As part of link:https://support.microsoft.com/en-us/topic/kb5014754-certificate-based-authentication-changes-on-windows-domain-controllers-ad2c23b0-15d8-4340-a468-4d4f3b188f16[May 10,2022 security update], once this update is installed on a domain controller, all devices are in compatibility mode. If a certificate is weakly mapped to a user, authentication occurs as expected but a warning message is logged identifying the certificates that are not compatible with full enforcement mode. As of November 14, 2023 or later, all devices will be updated to full enforcement mode and if a certificate fails the strong mapping criteria, authentication will be denied. IdM now supports the new mapping templates, making it easier for an AD administrator to use the new rules and not maintain both. IdM now supports the following new mapping templates : * Serial Number: `LDAPU1:(altSecurityIdentities=X509:<I>{issuer_dn!ad_x500}<SR>{serial_number!hex_ur})` * Subject Key Id: `LDAPU1:(altSecurityIdentities=X509:<SKI>{subject_key_id!hex_u})` * User SID: `LDAPU1:(objectsid={sid})` If you do not want to reissue certificates with the new SID extension, you can create a manual mapping by adding the appropriate mapping string to a user's `altSecurityIdentities` attribute in AD.