Netscape NETSCAPE CONSOLE 6.0 - MANAGING SERVERS, Manual

Page: 197 / 302

Using Client Authentication
Chapter 10 Using SSL and TLS with Netscape Servers 197
Using Client Authentication
You can configure some Netscape servers to require that clients present certificates
when logging in. This allows a server to verify a client’s authenticity and to
determine if a user has access to the server. The process of presenting and verifying
a client certificate is called client authentication.
This section tells you how to set up and use client authentication on your Netscape
server. Before reading this section, check your server’s documentation to verify
that the server supports client authentication.
How Client Authentication Works
When a server receives a request from a client, it can ask for the client’s certificate
before proceeding. A Netscape client, such as Navigator or Communicator, is
programmed to respond by sending a client certificate to the server.
After checking that a client certificate chain ends with a trusted CA, a Netscape
server can optionally determine which user is identified by the client certificate and
then look up that user’s entry in the directory. The server authenticates the user by
comparing the information in the certificate with the data in the user’s directory
entry.
In order to locate user entries in the directory, a server must know how to interpret
certificates from different CAs. You provide the server with interpretation
information by editing a file called
certmap.conf
. This file provides three kinds of
information for each listed CA:
• It maps the distinguished name (DN) in the certificate to a branch point in the
LDAP directory.
• It specifies which DN values from the certificate (user name, email address,
and so on) the server should use for the purpose of searching the directory.
• It specifies whether the server should go through an additional verification
process. This process involves comparing the certificate presented for
authentication with the certificate stored in the user’s directory entry. By
comparing the certificate, the server determines whether to allow access or
whether to revoke a certificate by removing it from the user’s entry.