The reply will be truncated in 128 bytes. Set of criteria that must all be met for the rule to apply. The criteria parameter provides details on fields of the client certificate being verified. When using map-type 'map', at least one criterion must be defined. For map-type 'extract', this is optional. Each criterion must follow the format '<tag>value' where the 'tag' defines the criteria option (certificate field, fingerprint, etc.) and 'value' defines the expected value. Format: <tag1>value1<tag2>value2 (...) All criteria must be satisfied (AND logic). The supported tags include: <C>: DN Country <CN>: Common Name <DNS>: DNS Name SAN field <FP>: Fingerprint of certificate (SHA-256 or SHA-512 in colon-separated hexadecimal form) E.g.: <FP>3A:5F:9C:12:34:56:78:90:AB:CD:EF:01:23:45:67:89:AB:CD:EF:01:23:45:67:89:AB:CD:EF:01:23:45:67:89 <I>: Full Issuer DN (RDNs must be slash-separated with most significant first, OpenSSL notation) E.g.: <I>/C=PT/ST=Lisboa/L=Carnaxide/O=Nokia Corporation/CN=Nokia Internal Intermediate CA Note: RFC 4514 format is not supported <IP>: IP address SAN field <L>: DN Locality <O>: DN Organization <OU>: DN Organizational Unit <pivFASC-N>: PIV Card Federal Agency Smart Credential Number E.g.: <pivFASC-N>99999999999999999999999999999999 <RFC822>: RFC 822 Name (e-mail address) <S>: Full Subject DN (RDNs must be slash-separated with most significant first, OpenSSL notation) E.g.: <S>/C=PT/ST=Lisboa/L=Carnaxide/O=Nokia Corporation/CN=Server Note: RFC 4514 format is not supported <SKI>: Subject Key ID E.g: <SKI>A1:B2:C3:D4:E5:F6:07:08:09:0A:0B:0C:0D:0E:0F:10:11:12:13:14 <SR>: Serial Number (specified as hexadecimal bytes, where colons are optional and case is ignored) E.g.: <SR>01:23:45:67:89:AB <ST>: DN State or Province Name <UPN>: User Principal Name SAN field <URI>: Uniform Resource ID SAN field E.g.: <URI>https://login.example.com/sso <URI>urn:ietf:params:scim:schemas:core:2.0:User <URI>ftp://ftp.example.org/pub/certs/user123 <URI>spiffe://example.org/workload/database