
# Optional Setup for Certificate-based Authentication to Administrative Console/API
# =================================================================================

# Root CAS
# ========
#
# The root CAs that an accepted client certificate must fall under.
# Each root CA must be specified by its Issuer DN. Multiple Issuer DNs can be specified
# by sequentially incrementing the suffix.
# The configuration values are case-sensitive.
#
# Example
# rootca.issuer.1=CN=www.example.com, OU=Marketing, O=ACME Inc., L=San Diego, ST=California, C=US
# rootca.issuer.2=CN=www.pingidentity.com, OU=Engineering, O=Ping Identity Inc., L=Denver, ST=Colorado, C=US

rootca.issuer.1=

# Username simplification flags
# =============================

# username.last.value - if true, then the username will be the value of the last part of the Subject DN.
# The configuration values are case-sensitive.
# Example:
#   Subject DN: EMAILADDRESS=jane@example.com, CN=Thawte Freemail Member
#   Last part: EMAILADDRESS=jane@example.com
#   Username: jane@example.com
username.last.value=true

# username.drop.email.domain - if true (applies only if username.last.value is also true), then the domain
# part of the username will be dropped.
# Example:
#   Subject DN: EMAILADDRESS=jane@example.com, CN=Thawte Freemail Member
#   Username with domain (from above): jane@example.com
#   Username: jane
username.drop.email.domain=true


# Subject DNs Mapping
# ===================
#
# Map client certificate Subject DNs to PingFederate roles
# You can map multiple Subject DNs to one role by sequentially incrementing the suffix.
# The configuration values are case-sensitive.
#
# Example:
# role.admin.subject.1=EMAILADDRESS=jane@example.com, CN=Thawte Freemail Member
# role.admin.subject.2=EMAILADDRESS=jack@example.com, CN=Thawte Freemail Member

role.admin.subject.1=

role.cryptoManager.subject.1=

role.auditor.subject.1=

role.userAdmin.subject.1=

# The expressionAdmin role must only be granted to the administrators with admin role.
role.expressionAdmin.subject.1=

# The dataCollectionAdmin role must only be granted to the administrators with admin role.
role.dataCollectionAdmin.subject.1=


# Header Name Values
# ==================
#
# The names of the headers that will be checked for admin certificate authentication.
# Example:
# client.certificate.header.name=pingfederate-admin-certificate
# client.certificateChain.header.name=pingfederate-admin-certificate-chain

client.certificate.header.name=
client.certificateChain.header.name=

# Header Encoding format
# ======================
#
# The encoding format of the header value.
# The allowed values are: APACHE_MOD_SSL, NGINX
# The default value is APACHE_MOD_SSL
client.certificate.header.encoding=APACHE_MOD_SSL