[id='configuring-client-certificate-authorization_{context}']
= Configuring Authorization with Client Certificates
Enabling client certificate authentication means you do not need to specify {brandname} user credentials in client configuration, which means you must associate roles with the Common Name (CN) field in the client certificate(s).

.Prerequisites

* Provide clients with a Java keystore that contains either their public certificates or part of the certificate chain, typically a public CA certificate.
* Configure {brandname} Server to perform client certificate authentication.

.Procedure

. Enable the `common-name-role-mapper` in the security authorization configuration.
. Assign the Common Name (`CN`) from the client certificate a role with the appropriate permissions.
+
[source,xml,options="nowrap",subs=attributes+]
----
include::config_examples/infinispan_authz_cn_role_mapper.xml[]
----
