X.509 Cert authentication fails returning the error NO_CERTMAP_OBJECT

Document ID : KB000014583
Last Modified Date : 14/02/2018
Show Technical Document Details
Question:

We are configuring X.509 certificate authentication, and after we have setup certificates and created the certificate mapping, we cannot authenticate the users as they are rejected by the Policy Server. When checking the Policy Server traces, we see the following error:

[SmAuthenticate][][][][][][-2][][NO_CERTMAP_OBJECT][][][][][][Unable to find issuer DN in certificate mapping rules][][][][][]

[SmAuthenticate][][][][][][][][][][][][][][][Authentication failed][][][][][][][][][][][][][][][][]

What does the NO_CERTMAP_OBJECT mean? How can we solve this issue?

Answer:

This error occurs when the Policy Server tries to match the certificate Issuer DN with the Certificate Mapping Issuer DN field, and does not succeed. If the mapping is not created, the same error will happen.

To solve the issue you need to ensure the Issuer DN field in the Certificate Mapping matches exactly the certificate Issuer DN, including spaces and other characters.

Additional Information:

This problem has already identified in a previous tech note : https://www.ca.com/us/services-support/ca-support/ca-support-online/knowledge-base-articles.tec529423.html. But this is more a authentication scheme issue.