Red Hat CERTIFICATE SYSTEM 7.2 - MIGRATION GUIDE, Administration Manual, Page: 356 / 512

Chapter 14. Publishing
336
14.12.2.3.1. Configuration Parameters of LdapSimpleMap
The simple mapper requires one parameter,
dnPattern
. The value of
dnPattern
can be a list of
AVAs separated by commas. An AVA can be a variable, such as
uid=$subj.UID
, or a constant, such
as
o=Example Corporation
.
• Example 1:
uid=CertMgr, o=Example Corporation
• Example 2:
cn=$subj.cn,ou=$subj.ou,o=$subj.o,c=US
• Example 3: uid=
$req.HTTP_PARAMS.uid, e=
$ext.SubjectAlternativeName.RFC822Name,ou=$subj.ou
In the examples,
$req
takes the attribute from the certificate request,
$subj
takes the attribute from
the certificate subject name, and
$ext
takes the attribute from the certificate extension.
14.12.2.4. LdapSubjAttrMap
The
LdapSubjAttrMap
plug-in module configures a Certificate Manager to map a certificate to an
LDAP directory entry using a configurable LDAP attribute. To use this mapper, the directory entries
must include the specified LDAP attribute.
This mapper requires the exact pattern of the subject DN because the Certificate Manager searches
the directory for the attribute with a value that exactly matches the entire subject DN. For example,
if the specified LDAP attribute is
certSubjectDN
and the certificate subject name is
uid=jdoe,
o=Example Corporation, c=US
, the Certificate Manager searches the directory for entries that
have the attribute
certSubjectDN=uid=jdoe, o=Example Corporation, c=US
.
If no matching entries are found, the server returns an error and writes it to the log.
14.12.2.4.1. Configuration Parameters of LdapSubjAttrMap
Table 14.12, “LdapSubjAttrMap Parameters”
describes these parameters.
Parameter Description
certSubjNameAttr
Specifies the name of the LDAP attribute that
contains a certificate subject name as its value.
The default is
certSubjectName
, but this can
be configured to any LDAP attribute.
searchBase
Specifies the base DN for starting the attribute
search. The permissible value is a valid DN of an
LDAP entry, such as
o=example.com, c=US
.
Table 14.12. LdapSubjAttrMap Parameters
14.12.2.5. LdapDNCompsMap
The
LdapDNCompsMap
plug-in module implements the DN components mapper. This mapper maps
a certificate to an LDAP directory entry by constructing the entry's DN from components, such as
cn
,
ou
,
o
, and
c
, specified in the certificate subject name, and then uses it as the search DN to locate the
entry in the directory. The mapper locates the following entries:
• The CA's entry in the directory for publishing the CA certificate and the CRL.