Netscape NETSCAPE CONSOLE 6.0 - MANAGING SERVERS, Manual

Page: 198 / 302

Using Client Authentication
198 Managing Servers with Netscape Console • December 2001
If more than one directory entry contains the information in the user’s certificate,
the server can examine all matching entries in order to determine which user is
trying to authenticate. When examining a directory entry, the server compares the
presented certificate with the one stored in the entry. If the presented certificate
doesn’t match any certificates or if the matching entries don’t contain certificates,
client authentication fails.
After the server finds a matching entry and certificate in the directory, it can
determine the appropriate kind of authorization for the client. For example, some
servers use information from a user’s entry to determine group membership,
which in turn can be used during evaluation of ACIs to determine what resources
the user is authorized to access.
You can also configure client authentication between an instance of Administration
Server and another Netscape server. For more information see “Using Client
Authentication Between Servers.”
Preparing to Use Client Authentication
In order to accept certificates for client authentication, you must fulfill the
following requirements:
• The server must have SSL turned on. For more information, see “Activating
SSL” on page 190.
• The instance of Administration Server must trust the CA who issued the
certificate to the client. For more information, see “Changing the CA Trust
Options” on page 194.
• If you are going to search the directory for information contained in
certificates, you must map specific CAs to branches of the user directory. To do
this, you must edit a file called
certmap.conf
. The rest of this section describes
this file and tells you how to edit it.
The certmap.conf File
When a server performs client authentication, it interprets a certificate, extracts
user information, and then searches the directory for that information. In order to
process certificates from different CAs, the server uses a file called
certmap.conf
.
This file contains instructions on how to interpret different certificates and how to
search the directory for the information that those certificates contain.