Netscape Certificate Management System 6.2, Administrator'S Manual

Page: 642 / 874

Mappers
642 Netscape Certificate Management System Administrator’s Guide • June 2003
In general, for the
dnComps
parameter, you should enter those DN components that
the Certificate Manager can use to form the LDAP DN exactly. In certain situations,
however, the subject name in a certificate may match more than one entry in the
directory. Then, the Certificate Manager might not get a single, distinct matching
entry from the DN. For example, the subject name
CN=Jane Doe, OU=Sales, O=Example Corporation, C=US
might match two users with the name Jane Doe in the directory. If that occurred,
the Certificate Manager would need additional criteria to determine which entry
corresponds to the subject of the certificate.
To specify the components the Certificate Manager must use to distinguish
between different entries in the directory, use the
filterComps
parameter; for
details, see Table 15-10 on page 643. For example, if you entered
CN
,
OU
,
O
, and
C
as
values for the
dnComps
parameter, enter
L
for the
filterComps
parameter only if
the
L
attribute can be used to distinguish between entries with identical
CN
,
OU
,
O
,
and
C
values.
Consider another example that shows how two directory entries with similar DNs
can be differentiated by the value of the
UID
attribute:
Assume that the two Jane Doe entries are distinguished by the value of the
UID
attribute. One entry’s
UID
value is
janedoe1
and the other entry’s
UID
value is
janedoe2
. Because the
UID
attribute corresponds to the
UID
component in a DN,
you can set up the subject names of certificates to include the
UID
component.
Configuration Parameters of LdapDNCompsMap
With this configuration, a Certificate Manager maps its certificates with the ones in
the LDAP directory by using the
dnComps
values to form a DN and the
filterComps
values to form a search filter for the subtree.
• If the formed DN is null, the server uses the
baseDN
value for the subtree. If
both the formed DN and base DN are null, the server logs an error.
• If the filter is null, the server uses the
baseDN
value for the search. If both the
filter and base DN are null, the server logs an error.
Table 15-10 describes these parameters.
NOTE Generally, the
E
,
L
, and
ST
components are not included in the
standard set of certificate request forms provided for end entities.
You can add these components to the forms, or you can have the
issuing agents insert these components when editing the subject
name in the certificate issuance forms.