Netscape NETSCAPE MANAGEMENT SYSTEM 4.5, Installation And Setup Manual

Page: 524 / 866

Configuring Authentication for End-User Enrollment
524 Netscape Certificate Management System Installation and Setup Guide • October 2001
Step B. Update the Directory
By default, the PIN Generator modifies the
pin
attribute in a directory’s user entry.
Because this attribute is not part of the standard
organizationalPerson
, it’s likely
that the user entries in your directory do not contain the
pin
attribute. This means,
before you run the PIN Generator, you’ll need to add the
pin
attribute to the user
entries in your directory—that is, you’ll need to create a new object class (named
pinPerson
) in your authentication directory’s schema.
In general, you’ll need to update the
slapd.user_at.conf
file to include the
pin
attribute and the
slapd.user_oc.conf
file to include the object-class definition.
The modified schema should look similar to this:
attribute pin bin
objectclass pinPerson
superior organizationalPerson
allows
pin
In addition, if you want to make use of the PIN-removal feature—that is, remove a
user’s PIN from the directory after Certificate Management System successfully
authenticates that user and thus prevents the user from enrolling for another
certificate—ACIs must be set up on the directory to prevent end users from
creating new PINs for themselves. To do this, you’ll need to create an entry for a
PIN manager user with read-write permission to the
pin
attribute.
For your convenience, the PIN Generator tool comes with a configuration file,
named
setpin.conf
, which enables you to automate the process of updating the
authentication directory with changes required for setting up PIN-based
authentication. The configuration file is located in this directory:
<server_root>/bin/cert/tools
To make the required schema changes and add an entry for the PIN manager user
(using the configuration file):
1.
Go to this directory:
<server_root>/bin/cert/tools
2.
Open the
setpin.conf
file in a text editor.
3.
Follow the instructions outlined in the file and make the appropriate changes.
Typically, you will need to update the Directory Server’s host name, Directory
Manager’s bind password, and PIN manager’s password.
4.
Run the
setpin
command with its
optfile
option pointing to the
setpin.conf
file (
setpin optfile=setpin.conf
).