Red Hat CERTIFICATE SYSTEM 7.3 - ADMINISTRATION, Administration Manual

Page: 389 / 554

Mapper Plug-in Modules
367
Parameter Description
path
Specifies the path for publishing the CRL. This
must be the default path,
/ocsp/addCRL
.
Table 15.10. OCSPPublisher Parameters
15.13.2. Mapper Plug-in Modules
This section describes the mapper plug-in modules provided for the Certificate Manager. These
modules configure a Certificate Manager to enable and configure specific mapper instances.
The available mapper plug-in modules include the following:
•
Section 15.13.2.1, “LdapCaSimpleMap”
•
Section 15.13.2.2, “LdapDNExactMap”
•
Section 15.13.2.3, “LdapSimpleMap”
•
Section 15.13.2.4, “LdapSubjAttrMap”
•
Section 15.13.2.5, “LdapDNCompsMap”
15.13.2.1. LdapCaSimpleMap
The
LdapCaSimpleMap
plug-in module configures a Certificate Manager to create an entry for the
CA in an LDAP directory automatically and then map the CA's certificate to the directory entry by
formulating the entry's DN from components specified in the certificate request, certificate subject
name, certificate extension, and attribute variable assertion (AVA) constants. For more information on
AVAs, check the directory documentation.
The CA certificate mapper specifies whether to create an entry for the CA, to map the certificate to an
existing entry, or to do both.
If a CA entry already exists in the publishing directory and the value assigned to the
dnPattern
parameter of this mapper is changed, but the
uid
and
o
attributes are the same, the mapper
fails to create the second CA entry. For example, if the directory already has a CA entry for
uid=CA,ou=Marketing,o=example.com
and a mapper is configured to create another CA entry
with
uid=CA,ou=Engineering,o=example.com
, the operation fails.
The operation may fail because the directory has the
UID Uniqueness
plug-in set to a specific base
DN. This setting prevents the directory from having two entries with the same UID under that base
DN. In this example, it prevents the directory from having two entries under
o=example.com
with the
same UID,
CA
.
If the mapper fails to create a second CA entry, check the base DN to which the UID Uniqueness plug-
in is set, and check if an entry with the same UID already exists in the directory. If necessary, adjust
the mapper setting, remove the old CA entry, comment out the plug-in, or create the entry manually.
During installation, the Certificate Manager automatically creates two instances of the CA certificate
mapper module. The mappers are named as follows:
•
LdapCrlMap
for CRLs (see
Section 15.13.2.1.2, “LdapCrlMap”
)
•
LdapCaCertMap
for CA certificates (see
Section 15.13.2.1.1, “LdapCaCertMap”
).