Netscape Certificate Management System 6.1, Administrator'S Manual

Page: 497 / 840

Constraints-Specific Policy Module Reference
Chapter 11 Policies 497
ldap.ldapconn.
version
Specifies the LDAP protocol version:
•
2
specifies LDAP version 2. If your directory is based on Netscape Directory
Server 1.x, choose
2
.
•
3
specifies LDAP version 3. For Directory Server versions 3.x and later, choose
3
(default).
ldap.ldapauth.
bindDN
Specifies the user entry to bind as for checking the attribute in the LDAP directory.
Example:
CN=pinmanager
password
Specifies the password associated with the DN specified by the
ldap.ldapauth.bindDN
parameter.
ldap.ldapauth.
clientCertNick
name
Specifies the nickname or the friendly name of the certificate to be used for SSL client
authentication to the LDAP directory in order to check attributes. Make sure that the
certificate is valid and has been signed by a CA that is trusted in the directory’s
certificate database, and that the directory’s
certmap.conf
file has been configured
to correctly map the certificate to a DN in the directory. (This is needed for PIN
removal only.)
Example:
Server-Cert
ldap.ldapauth.
authtype
Specifies how to bind to the directory or the authentication type—basic
authentication or SSL client authentication—required in order to check attributes in
the LDAP directory:
•
BasicAuth
specifies basic authentication (default). If you choose this option, be
sure to enter the correct values for
ldap.ldapauth.bindDN
and
password
parameters; the plug-in uses the DN from the ldap
.ldapauth.bindDN
attribute
to bind to the directory.
•
SslClientAuth
specifies SSL client authentication. If you choose this option, be
sure to select the
ldap.ldapconn.secureConn
parameter and set the value of
the
ldap.ldapauth.clientCertNickname
parameter to the nickname of the
certificate to be used for SSL client authentication.
ldap.ldapconn.
basedn
Specifies the base DN for searching the LDAP directory—the plug-in uses the value
of the
uid
field from the HTTP input (what a user enters in the enrollment from) and
the base DN to construct an LDAP search filter.
Permissible values: Any valid DN string of up to 255 characters. (If your user’s DN is
uid=jdoe, o=company,
you might want to use
o=company
here.)
Example:
O=example.com
ldap.ldapconn.
minConns
Specifies the minimum number of connections permitted (or to keep open) to the
LDAP directory. Permissible values:
1
to
3
; the default value is
1
.
Table 11-3 AttributePresentConstraints Configuration Parameters (Continued)
Parameter Description