Netscape Certificate Management System 6.2, Administrator'S Manual

Page: 640 / 874

Mappers
640 Netscape Certificate Management System Administrator’s Guide • June 2003
LdapDNCompsMap
The
LdapDNCompsMap
plug-in module implements the DN components mapper.
This mapper enables you to configure a Certificate Manager to map a certificate to
an LDAP directory entry by constructing the entry’s distinguished name from
components (such as
CN
,
OU
,
O
, and
C
) specified in the certificate subject name, and
then using it as the search DN to locate the entry in the directory. You can use this
mapper to locate the following:
• The CA’s entry in the directory for publishing the CA certificate and the CRL.
• End-entity entries in the directory for publishing end-entity certificates.
In general, the mapper takes DN components to build the search DN. The mapper
also takes an optional root search DN. The server uses the DN components to form
an LDAP entry to begin a subtree search and the filter components to form a search
filter for the subtree. If none of the DN components are configured, the server uses
the base DN for the subtree. If the base DN is null and none of the DN components
match, an error is returned. If none of the DN components and filter components
match, an error is returned. If the filter components are null, a base search is
performed.
Note that both
DNComps
and
filterComps
parameters accept valid DN
components or attributes separated by commas. The parameters don’t accept
multiple entries of an attribute; for example, you can set
filterComps
to
CN,OU
,
but not to
CN,OU2,OU1
. If there’s a need for you to support such a filter, for
example, if your directory entries contain multiple
OU
s and you want to use
multiple
OU
s in your
filterComps
for filtering entries, you can modify the source
code for the
LdapDNCompsMap
module. The java class for the module is in this
directory:
<server_root>/cms_sdk/cms_jdk/samples/mappers
The discussion below explains how mapping by DN components works. It is
recommended that you read this before configuring a Certificate Manager to use
this mapper.
Subject names in certificates are in distinguished-name format. A distinguished name
(DN) uniquely identifies an entry in an LDAP directory. The DN consists of
components that help identify the entry; for details, see Appendix I,
“Distinguished Names
The following components are commonly used in DNs:
•
UID
, which represents the user ID of a user in the directory
•
CN
, which represents the common name of a user in the directory
•
OU
, which represents an organizational unit in the directory