Red Hat CERTIFICATE 7.1 ADMINISTRATOR, Administrator'S Manual

Page: 537 / 840

Extension-Specific Policy Module Reference
Chapter 12 Policies 537
Before you edit the default rule, you should read the additional details about the attributes
that are set in the default policy rule.
The first two attributes,
AUTH_TOKEN.mail
and
AUTH_TOKEN.mailalternateaddress
,
are standard LDAP attributes typically used for storing end users’ email addresses in an
LDAP directory. These attributes enable you to include a user’s email address as an
alternative name in the certificate. Remember that you need to specify the LDAP attribute
for users’ email addresses as a part of configuring the server to use a specific directory for
authentication—which means for the default rule to set end users’ email addresses in the
subject alternative name extension, you must ensure the following:
• The server is configured for directory-based or directory- and PIN-based (using
directory attributes for forming subject names) enrollment; that is, you have created
and configured an authentication instance.
generalName<n>.
generalNameChoice
Specifies the general-name type for the request attribute.
Permissible values:
rfc822Name
,
directoryName
,
dNSName
,
ediPartyName
,
URL
,
iPAddress
,
OID
, or
otherName
.
• Select
rfc822Name
if the request-attribute value is an Internet mail address in the
local-part@domain
format (default). For example,
jdoe@example.com
.
• Select
directoryName
if the request-attribute value is an X.500 directory name,
similar to the subject name in a certificate. For example,
CN=Jane Doe, OU=Sales Dept, O=Example Corporation, C=US
.
• Select
dNSName
if the request-attribute value is a DNS name. For example,
corpDirectory.example.com
.
• Select
ediPartyName
if the request-attribute value is a EDI party name. For
example,
Example Corporation
.
• Select
URL
if the request-attribute value is a non-relative URI that includes both a
scheme (for example,
http
) and a fully qualified domain name or IP address of the
host. For example,
http://hr.example.com
.
• Select
iPAddress
if the request-attribute value is a valid IP address specified in
dot-separated numeric component notation. For example,
128.21.39.40
.
• Select
OID
if the request-attribute value is a unique, valid OID specified in the
dot-separated numeric component notation. For example,
1.2.3.4.55.6.5.99
.
• Select
otherName
if the request-attribute value is the absolute path to the file that
contains the base-64 encoded string of the subject alternative name. For example,
/usr/netscape/servers/ext/san/othername.txt
.
Table 12-39 SubjectAltNameExt Configuration Parameters (Continued)
Parameter Description