Netscape Certificate Management System 6.2, Administrator'S Manual

Page: 387 / 874

Automated Enrollment
Chapter 9 Authentication 387
You can create custom plug-in modules for other methods of authentication using
the CMS SDK. You must register and enable any custom plug-ins you create.
Setting Up Directory Based Enrollment
The
UidPwdDirAuth
and the
UdnPwdDirAuth
plug-in modules implement the
directory-based authentication method. End users enroll for a certificate by
providing their user IDs or DN, and their password for the authentication to an
LDAP directory.
To set up directory based authentication you do the following:
• Create an instance of either the
UidPwdDirAuth
or
UdnPwdDirAuth
Authentication plug-in module and then configure the instance. See “Setting
Up the UidPwdDirAuth or UdnPwdDirAuth Authentication,” on page 387 for
details.
• Set any policies for certificate extensions, or for constraints on certificates, see
Chapter 11, “Policies” for information about policies. Alternatively, you can
enroll users through the certificate profile functionality setting policies for
specific certificates in the certificate profile, see Chapter 10, “Certificate
Profiles” for information about policies.
• In the case of policy-based enrollments, customize the HTML enrollment
forms. Make sure the proper authentication method is contained in the form,
and do any other customization required.
In the enrollment form you use, be sure to include the following line, and
replace
myAuthMgr
with the name of the authentication instance you added.
<INPUT TYPE="HIDDEN" NAME="authenticator" VALUE="myAuthMgr">
For more information on customizing the enrollment forms, see the CMS
Customization Guide.
• In the case of certificate profile-based enrollments, customize the enrollment
forms by configuring the inputs in the certificate profile. Make sure you
include the information that will be needed by the plug-in to authenticate the
user. If the default inputs do not contain all of the information that needs to be
collected, you can either create an input that does using the CMS SDK, or
submit a request created with a third-party tool.
Setting Up the UidPwdDirAuth or UdnPwdDirAuth Authentication
To set up one of these two methods of authentication: