Red Hat CERTIFICATE 7.1 ADMINISTRATOR, Administrator'S Manual

Page: 535 / 840

Extension-Specific Policy Module Reference
Chapter 12 Policies 535
SubjectAltNameExt
The
SubjectAltNameExt
plug-in module enables you to add the Subject Alternative
Name Extension to certificates. The extension enables you to bind additional
identities—such as Internet electronic mail address, a DNS name, an IP address, and a
uniform resource indicator (URI)—to the subject of the certificate.
For general information about this extension, see “subjectAltName” on page 740.
The standard suggests that if the certificate subject field contains an empty sequence, then
the subject alternative name extension must contain the subject’s alternative name and that
the extension be marked critical.
If you’re using any of the directory-based authentication methods, you can configure CS to
retrieve values for any string and byte attributes from the directory and set them in the
certificate request during authentication—you specify these attributes by entering them in
the
ldapStringAttributes
and
ldapByteAttributes
fields defined in the automated
enrollment modules.
Note that all data related to an end entity is gathered at the servlet level and set on the
request before the request is passed to the policy subsystem.
In general, you can configure which attributes should or shouldn’t be stored in the request;
for example, you can exclude sensitive attributes such as passwords from getting stored in
the request with the help of the parameter named
dontSaveHttpParams
defined in the CS
configuration file. For details on using this parameter, see the description for
HTTP_PARAMS
in section “JavaScript Used By All Interfaces” of CS Customization Guide . You can also
distinguish the attributes based on their origin—that is, whether they originated from the
enrollment form or where added to the request during the authentication process.
Authenticated attributes have
AUTH_TOKEN
as prefix (for example,
AUTH_TOKEN.mail
)
and non-authenticated attributes such as the ones that come from the HTTP input have
HTTP_PARAMS
as prefix (for example,
HTTP_PARAMS.csrRequestorEmail
).
Table 12-38 RemoveBasicConstraintsExt Configuration Parameters
Parameter Description
enable
Specifies whether the rule is enabled or disabled. Select to enable, deselect to disable.
predicate
Specifies the predicate expression for this rule. If you want this rule to be applied to all
certificate requests, leave the field blank (default). To form a predicate expression, see
“Using Predicates in Policy Rules,” on page 465.