User certificates instead of passwords?

1

How do I issue a user certificate for the default admin user? I believe I can then use that certificate to login to the management API instead of a password.

Additionally, is there a way to disable password authentication and therefore require either:

  1. a user certificate, or
  2. an expiring session token?

If I understand correctly, this means I can use either a certificate or a password to obtain the session token for the management API and potentially share that token with another process by way of delegating temporary authority to act on my behalf, and that process will not need either the password nor certificate to use the session token until it expires.

1 Like
2

The Management API allows for the creation of authenticators directly.

You should be able to do:

POST /edge/management/v1/authenticators/
{
    "method": "cert",
    "identityId": "qNYyfJgHk>",
    "certPem": "-----BEGIN CERTIFICATE-----\n..."
}

Where certPem is a client certificate that has been signed by a known CA (1st or 3rd party). After ensuring the authenticator works, the password authenticator can be deleted via:

DELETE /authenticators/{id}

2 Likes