Search for	Example	Results
A single word	`cat`	Topics that contain the word "cat". You will also find its grammatical variations, such as "cats".
A phrase. You can specify that the search results contain a specific phrase.	`"cat food"` (quotation marks)	Topics that contain the literal phrase "cat food" and all its grammatical variations. Without the quotation marks, the query is equivalent to specifying an OR operator, which finds topics with one of the individual words instead of the phrase.

Search for	Operator	Example
Two or more words in the same topic	`AND` `and` `+` (plus symbol) `&` (ampersand)	`cat AND dog` `"cat food"+milk` `"cat food"&"dog food"`
Either word in a topic	`OR` `or` `\|` (pipe)	`cat OR dog` `cat \| dog`
Topics that do not contain a specific word or phrase	`NOT` `not` `!` (exclamation point)	`NOT cat` `! dog`
Topics that contain one string and do not contain another	`^` (caret)	`cat ^ mouse`
A combination of search types	`( )` parentheses	`cat + (dog \| mouse)` `cat \| dog + (! mouse)`

Network Node Manager i Software10.30

Administer > Configure NNMi to Support Public Key Infrastructure User Authentication > Example: Configuring NNMi to Require a Smart Card Log on

Example: Configuring NNMi to Require a Smart Card Logon

The following example illustrates how to configure NNMi to use PKI user authentication to require a smart card logon.

Note This example uses the Mixed user authentication strategy.

This example makes the following assumptions:

The organization is using smart cards for logging on to NNMi.
The smart card contains a certificate with an email address in the Subject Alternative Name field.
The organization uses CRLs to check revocation for all certificates.

To complete the example configuration, follow these steps:

In the NNMi console, create a user called myusername@example.com with guest privileges.
1. From the User Accounts view, create the myusername@example.com user.
  
  Tip On the User Account form, be sure to select the Directory Service Account check box and leave the Password field blank. For more information, see the NNMi help.
2. From the User Account Mappings view, create a new user account mapping to assign the myusername@example.com user to the NNMi Guest Users user group.
Edit the following file:

Windows: %NnmDataDir%\nmsas\NNM\conf\nms-auth-config.xml

Linux: $NnmDataDir/nmsas/NNM/conf/nms-auth-config.xml

Search for the following text block:

<realm name="console">

<mode>FORM</mode>

</realm>

To enable X.509 certificate authentication, edit the text to read as follows:
```
<realm name="console">
```
```
<mode>X509</mode>
```
```
</realm>
```
Search for the following text block:
```
<principalMapping>
```
In the <principalMapping> block, include the following line to extract the first match of type rfc822Name from the Subject Alternative Name field of the certificate:
```
<subjectAlternativeName type="rfc822Name" />
```
Within the <crl> section of the file (find the <crl> tag), search for the line that begins with the following text:
```
<enabled>
```
To enable CRL checking, change the line to read as follows:
```
<enabled>true</enabled>
```
Within the <crl> section of the file, locate the text block containing the following text:
```
<mode>
```
To require and enforce CRLs, change the line to read as follows:
```
<mode>REQUIRE</mode>
```
Locate the text block containing the following:
```
<certificateConstraints>
```

To require client authentication, edit the following section:

<!-- client authentication -->

<extKeyUsage>1.3.6.1.5.5.7.3.2</extKeyUsage>

To require users to log on using a Microsoft smart card, add the following lines:

<!-- Microsoft smart card logon -->

<extKeyUsage>1.3.6.1.4.1.311.20.2.2</extKeyUsage>

Save your changes to the nms-auth-config.xml file.
Change to the directory on the NNMi management server that contains the nnm-trust.p12 files:

Windows: %NnmDataDir%\shared\nnm\certificates

Linux: $NnmDataDir/shared/nnm/certificates
Import your trusted CA certificate into the nnm-trust.p12 file. Suppose the example_ca.cer file contains the certificate you must use. Run the following command to import the CA certificate into the NNMi nnm-trust.p12 file:

Windows: %NnmInstallDir%\bin\nnmkeytool.ovpl -import -alias myca -storetype PKCS12 -keystore nnm-trust.p12 -file example_ca.cer

Linux: $NnmInstallDir/bin/nnmkeytool.ovpl -import -alias myca -storetype PKCS12 -keystore nnm-trust.p12 -file example_ca.cer
Ensure that the user account’s name matches the user name contained in the certificate (myusername).
Restart the NNMi services:
- Run the ovstop command on the NNMi management server.
- Run the ovstart command on the NNMi management server.

NNMi is now configured to require a smart card logon.

The following text is similar to how the nms-auth-config.xml file might appear after making the configuration changes described in this example:

<methods>

   <X509>

      <principalMapping>

           <subjectAlternativeName type="rfc822Name" />

      </principalMapping>

      <certificateConstraints>

           <extKeyUsage>1.3.6.1.5.5.7.3.2</extKeyUsage>

           <extKeyUsage>1.3.6.1.4.1.311.20.2.2</extKeyUsage>

           <trustedIssuer>CN=MyIssuer, OU=MyOrgUnit, O=MyOrg, ST=CO, C=US</trustedIssuer>

      </certificateConstraints>

      <revocation>

         <ordering>CRL OCSP</ordering>

          <mode>CHECK_ALL</mode>

       </revocation>

       <crl>

          <enabled>true</enabled>

           <mode>REQUIRE</mode>

           <!-- refresh CRLs every 12 hours -->

           <refreshPeriod>12h</refreshPeriod>

            <!-- remove CRLs that have not been used for 36 hours -->

            <maxIdleTime>36h</maxIdleTime>

        </crl>

        <ocsp>

          <enabled>false</enabled>

          <mode>ENFORCE</mode>

          <nonce>false</nonce>

        </ocsp>

  </X509>

</methods>

<realms>

  <realm name="console">

  <mode>X509</mode>

   </realm>

</realms>