Netscape Certificate Management System 6.01, Manual

Page: 251 / 377

LdapCaSimpleMap Plug-in Module
Chapter 5 Mapper Plug-in Modules 251
Note that if you already have one CA entry created in the publishing directory and
if you change the value assigned to the
dnPattern
parameter of this mapper to
something different, but with the same UID and O attributes, the mapper will fail
to create the second CA entry. For example, if the directory already has a CA entry
with
UID=CA,OU=Marketing,O=example.com
and if you configure the mapper to
create another CA entry with
UID=CA,OU=Engineering,O=example.com
, the
operation will fail.
The reason for the failure may be because you are using a directory (for example,
the configuration directory) that has the uid uniqueness plug-in set to a specific base
DN in the
slapd.ldbm.conf
file. This setting prevents the directory from having
two entries with the same UID under that base DN. For example, it prevents the
directory from having two entries under
O=example.com
with the same UID,
CA
.
If the mapper fails to create a second CA entry, be sure to check the base DN that
the uid uniqueness plug-in is set to (in the
slapd.ldbm.conf
file) and also check if
an entry with the same UID already exists in the directory. If it’s true, adjust the
mapper setting, remove the old CA entry, comment out the plug-in, or create the
entry manually using the CMS window.
During installation, the Certificate Manager automatically creates two instances
(called mappers) of the CA certificate mapper module (see Figure 5-2). The
mappers are named as follows:
•
LdapCrlMap
for CRLs (see “LdapCrlMap Mapper” on page 254)
•
LdapCaCertMap
for CA certificates (see “LdapCaCertMap Mapper” on
page 254)
Figure 5-2 Default mappers created during installation