Netscape NETSCAPE CONSOLE 6.0 - MANAGING SERVERS, Manual

Page: 204 / 302

Using Client Authentication
204 Managing Servers with Netscape Console • December 2001
organizational unit specified in the subject DN and searches for email addresses (
e
)
that match the one specified in the certificate. If the certificate is from MyCA, the
server verifies the certificate. If the certificate is from another CA, the server does
not verify it.
Example of a Mapping with an Attribute Search
This example uses the
CmapLdapAttr
property to search the directory for an
attribute called
certSubjectDN
whose value exactly matches the entire subject DN
in the client certificate:
certmap MyCo ou=My Company Inc, o=MyCo, c=US
MyCo:CmapLdapAttr certSubjectDN
MyCo:DNComps o, c
MyCo:FilterComps mail, uid
MyCo:verifycert on
If the subject DN in the client certificate is
uid=Henry Jones Junior, o=example
Inc, c=US
, then the server searches for entries that have
certSubjectDN=uid=Henry Jones Junior, o=example Inc, c=US
.
If one or more matching entries are found, the server proceeds to verify the entries.
If no matching entries are found, the server uses
DNComps
and
FilterComps
to
search for matching entries. For the client certificate described above, the server
would search for
uid=Henry Jones Junior
in all entries under
o=example Inc,
c=US
.
Using Client Authentication Between Servers
If both servers support it, you can use client authentication when establishing a
connection from one Netscape server to another. Typically, you use this feature to
authenticate an instance of Administration Server to another Netscape server
instance. In these cases, the instance of Administration Server acts as the client.
The following procedure tells you how to set up client authentication between a
Netscape server and an instance of Administration Server.