Appendix B: X.509 LDAP authentication translator - Appendix B: X.509 LDAP authentication translator - The following table defines the settings for the X.509 LDAP authentication translator plugin. The plugin uses attributes to map a client X.509 certificate to an LDAP user. To map successfully, you must use unique attributes, such as an email address or user ID. If multiple LDAP entries match the X.509 client certificate, then mapping is unsuccessful. - Perceptive Content - Perceptive Integration Server on Tomcat Installation and Setup Guide - Perceptive-Content/Perceptive-Integration-Server-on-Tomcat-Installation-and-Setup-Guide/Foundation-26.1/Perceptive-Integration-Server-on-Tomcat-Installation-and-Setup-Guide/Appendix-B-X.509-LDAP-authentication-translator - Foundation 26.1 - Foundation 26.1

Perceptive Integration Server on Tomcat Installation and Setup Guide
Platform
Perceptive Content
Product
Perceptive Integration Server on Tomcat Installation and Setup Guide
Release
Foundation 26.1
License
ft:lastPublication
2026-05-11T13:40:50.414000
ft:locale
en-US

The following table defines the settings for the X.509 LDAP authentication translator plugin. The plugin uses attributes to map a client X.509 certificate to an LDAP user. To map successfully, you must use unique attributes, such as an email address or user ID. If multiple LDAP entries match the X.509 client certificate, then mapping is unsuccessful.

The sso.authenticator.class setting for this plugin is com.imagenow.authentication.translator.x509ldap.X509LDAPAuthenticationTranslator.

Note: To use this plugin, you must configure your application server to use SSL/TLS with client certificate authentication.
Setting Options Description
sso.x509ldap.ldap.server Any valid address. The LDAP server address.
sso.x509ldap.ldap.port Any valid port number.

Optional. The LDAP server port number.

If SSL is enabled, the default is 636. If SSL is not enabled, the default is 389.
sso.x509ldap.max.connections Any valid number.

Optional. The maximum number of connections that can be made to the LDAP server.

The default is 10.
sso.x509ldap.ldap.ssl

TRUE

FALSE

Optional. Specifies whether to enable SSL/TLS for connections to the LDAP server.

The default is FALSE.
sso.x509ldap.truststore.location Any valid path. Path to the truststore to use to validate the LDAP server certificates.
sso.x509ldap.truststore.password Any valid password. Optional. The password used to verify the integrity of the truststore.
sso.x509ldap.validate.server.certificates

TRUE

FALSE

Optional. Specifies whether LDAP server certificates should be validated when SSL is enabled.

The default is TRUE.
sso.x509ldap.bind.dn Any valid name. The distinguished name of an account to use for LDAP server authentication.
sso.x509ldap.bind.password Any valid password. The password to be used for LDAP server authentication.
sso.x509ldap.anonymous.bind

TRUE

FALSE

Optional. Specifies whether to use an anonymous login for LDAP server authentication.

The default is FALSE.
sso.x509ldap.base.dn Any valid name. The distinguished name of the directory tree to be searched.
sso.x509ldap.x509.mapping.attribute Any valid name. The name of the X.509 attribute to be used for mapping client certificates to LDAP users.
sso.x509ldap.ldap.mapping.attribute Any valid name. The name of the LDAP attribute to be used for mapping client certificates to LDAP users.
sso.x509ldap.ldap.user.attribute Any valid name. The name of the LDAP attribute to use as the user's principal name when a client certificate can be mapped to an LDAP user.
sso.x509ldap.log.level CONFIG, INFO, WARNING, or SEVERE.

Optional. The log level specifying which message levels are going to be logged.

The default is SEVERE.
sso.x509ldap.log.directory Any valid directory.

Optional. The directory to where log files are written.

The default is LOGS.