Red Hat CERTIFICATE SYSTEM 7.2 - MIGRATION GUIDE, Administration Manual

Page: 299 / 512

Token Supplied Subject Name Default
279
12.7.21. Token Supplied Subject Name Default
This default profile populates subject names based on the attribute values in the authentication token
(AuthToken) object.
This default plug-in works with the directory-based authentication manager. The Directory-Based User
Dual-Use Certificate Enrollment certificate profile has two input parameters, UID and password. The
directory-based authentication manager checks if the given UID and password are correct.
In addition, the directory-based authentication manager formulates the subject name of the issuing
certificate. It forms the subject name by using the user's DN value from
AuthToken
.
This default is responsible for reading the subject name from the
AuthToken
and placing it in the
certificate request so that the final certificate contains the subject name.
The following constraints can be defined with this default:
• No Constraints; see
Section 12.8.6, “No Constraint”
.
12.7.22. User Supplied Extension Default
The User Supplied Extension Default class populates a certificate with any certificate extension
defined by the user in the certificate request. This requires users to submit certificate requests which
meet certain standards or give certain information because the profile can require specific extensions
before enrolling a certificate.
The user-defined extension is validated against whatever constraint is set, so it is possible to restrict
the kind of extension (through the Extension Constraint) or to set rules for the key and other basic
constraints, such as whether this is a CA certificate.
NOTE
If this extension is set on a profile with a corresponding OID (Extension Constraint), then
any certificate request processed through that profile
must
carry the specified extension or
the request is rejected.
If a certificate profile was enabled with the User Supplied Extension Default
before
the errata RHSA 2008:0500, then this profile must be edited to support user supplied
extensions in certificate requests. Apply the
userExtensionDefaultImpl
default, as
shown in the example. The given OID is for the Basic Constraints Extension Constraint.
policyset.set1.p6.default.class_id=userExtensionDefaultImpl
policyset.set1.p6.default.name=User Supplied Extension Default
policyset.set1.p6.default.userExtOID=2.5.29.19
The CA handles an enrollment with the User Supplied Extension Default in one of three ways:
• If the OID of the extension is specified in both the certificate request and the default, then the
extension is validated by the constraints and applied to the certificate.
• If an OID of an extension is given in the request but is not specified in the User Supplied Extension
Default in the profile, then the user-specified extension is ignored, and the certificate is successfully
enrolled without that extension.