Configuring a Certificate Manager to Publish Certificates and CRLs
Chapter
19
Setting Up LDAP Publishing
613
The second and subsequent lines in the named mapping match properties with
values. The
certmap.conf
file has six default properties, but the ones that should
be of use to you are explained below. For in depth detail about the
certmap.conf
file, see Managing Servers with Netscape Console.
•
DNComps
—This is a list of comma-separated DN attribute tags used to
determine where in the directory the server should start searching for directory
entries that match the Certificate Manager’s information (that is, the owner of
the client certificate). The Directory Server gathers values for these tags from
the certificate presented by the Certificate Manager during client
authentication and uses the values to form an LDAP DN, which then
determines where the server starts its search in the directory. For example, if
you set
DNComps
to use the
<O=org>
and
<C=country>
DN attribute tags
(
DNComps=O,C
) the server starts the search from the
O=<org>
,
C=<country>
entry in the directory, where
<org>
and
<country>
are replaced with values
from the values specified in the subject DN of the certificate presented for
client authentication.
❍
If the
DNComps
entry is present but has no value, the server searches the
entire LDAP tree for entries matching the filter.
❍
If there isn’t a
DNComps
entry in the mapping, the server uses either the
CmapLdapAttr
setting (if present) or the entire subject DN in the Certificate
Manager’s certificate.
The following component tags are supported for
DNComps
:
CN
,
OU
,
O
,
C
,
L
,
ST
,
E
,
and
. Case is ignored. You can use
E
or
, but not both.
•
FilterComp
—This is a list of comma-separated DN attribute tags used to
create a filter by gathering information from the subject DN in the certificate
presented during client authentication. Directory Server uses the values for
these tags to form the search criteria for matching entries in the directory. If
Directory Server finds one or more entries in the directory that match the
Certificate Manager’s information gathered from the certificate, the search is
successful and the server optionally performs a verification. For example, if
FilterComps
is set to use the attribute tags
E
and
UID
(
FilterComps=E,UID
),
the server searches the directory for an entry whose values for
E
and
UID
match
the Certificate Manager’s information gathered from the client certificate.
Email addresses and user IDs are good filters because they are usually unique
entries in the directory.
Note that the filter needs to be specific enough to match only the Certificate
Manager’s entry in the LDAP directory. The following component tags are
supported for
FilterComps
:
CN
,
OU
,
O
,
C
,
L
,
ST
,
E
, and
. Case is ignored.
You can use
E
or
, but not both.
Summary of Contents for NETSCAPE MANAGEMENT SYSTEM 6.0
Page 1: ...Installation and Setup Guide Netscape Certificate Management System Version6 0 March 2002...
Page 22: ...22 Netscape Certificate Management System Installation and Setup Guide March 2002...
Page 32: ...32 Netscape Certificate Management System Installation and Setup Guide March 2002...
Page 160: ...160 Netscape Certificate Management System Installation and Setup Guide March 2002...
Page 776: ...776 Netscape Certificate Management System Installation and Setup Guide March 2002...
Page 807: ...807 Part 5 Appendix Appendix A Certificate Download Specification...
Page 808: ...808 Netscape Certificate Management System Installation and Setup Guide March 2002...
Page 830: ...830 Netscape Certificate Management System Installation and Setup Guide March 2002...
