Question about DirectoryServicesMapping

[Petah69]

Hello,

First of all let me say thank you for the Great Module you provide here - Awesome Project !

I have a question about a Configuration i would like to implement but am struggling with.

We have a Certificate Template for Offline Enrollment in Place.
Now I would like to enforce that new Certificates or Renewed Certificates
a) match an existing AD Object
b) get the SecuritIdentifierExtension added to the Certificate.

The Problem i currently face is that the Certificates can have 2 Options in their SAN

1. Subject Alternative Name -> Other Name: Principalname=xyz
2. Subject Alternative Name -> DNS Name=xyz

I am able to Map both individually:
Option 1:

userPrincipalName
CN
user
OU=abc,OU=,DC=lab,DC=internal
Option 2:

dNSName
CN
user
OU=abc,OU=,DC=lab,DC=internal

Is there a way to configure the XML File with a condition where it
First: -> check if userPrincipalname is present in Request & Search for CN in AD
Second: -> check if dNSName is present in Request & Search for CN in AD
Fail if nothing is found in AD

i tried to enter Multiple in the XML but that leads to only the first one being evaluated

If i missed that in the documentation - sorry for that :-)

Thanks again

[Sleepw4lker]

Hello @Petah69 and sorry for not responding sooner. Currently, there is just one option available for DS mapping. So you'd have to split these requirements into two distinct certificate templates, each having their own unique config. But if I understand you correctly, this won't work in your situation because the certificate request (and resulting certificate shall contain both).

I plan to include a feature to also build or extend the SAN from the mapped object's properties. So you could map e.g. by the userPrincipalName and then add the DNS name automatically (or maybe even override as it is the case with the Subject DN).

Hope that helps, and thanks a lot for the feedback!

[Petah69]

Sorry for the delay and thank you very much for the clarification !