Netscape Certificate Management System 6.0, Manual

Page: 35 / 377

NISAuth Plug-in Module
Chapter 1 Authentication Plug-in Modules 35
NISAuth Plug-in Module
The
NISAuth
module implements the NIS server-based authentication. You can
use the module for authenticating unprivileged users in the NIS domain during
certificate enrollment. The module enables you to deploy Public Key Infrastructure
(PKI) leveraging an existing NIS server installation—it enables you to configure a
Certificate Manager or Registration Manager to authenticate end users, based on
their user IDs and passwords stored in an existing NIS server, and to issue
certificates.
Optionally, you can configure the authentication module to do an LDAP
correlation—that is, use the NIS directory to authenticate users based on the user ID
and password they enter in the enrollment form, but compose certificate subject
names from an LDAP-compliant directory, such as Netscape Directory Server.
When using an LDAP directory to compose subject names, you can configure the
module to search for and retrieve specific LDAP attribute values from the
directory. The ability of the module to use an LDAP directory to form certificate
subject names is useful in cases where the NIS server only stores user IDs and
passwords and you don’t want to formulate subject names using just common
names and user IDs.
In the absence of an LDAP directory, subject names of all certificates issued by the
server will be of the form
CN=<FirstName LastName>,UID=<UserID>
, where
First Name
and
Last Name
is a user’s first and last names as specified in the NIS
directory, and
UserID
is the user’s NIS ID. To accommodate scenarios where the
default subject-name form isn’t adequate, the module supports a parameter named
extendedDN
. This parameter enables you to specify a suffix that the server should
use for extending the default subject DN pattern.
Figure 1-6 illustrates how the NIS authentication module works during certificate
enrollment.
ldap.maxConns
Specifies the maximum number of connections permitted to the
authentication directory.
Permissible values:
3
to
10
.
Example:
9
Table 1-3
Description of parameters defined in the UidPwdPinDirAuth module (Continued)
Parameter Description