Sun Microsystems Netscape Enterprise Server, Administrator'S Manual

Page: 135 / 532

Chapter 5, Working with Server Security 135
Using Client Certificates
After the server checks that the certificate’s CA is trusted, the server performs
the following steps to map the certificate to an LDAP entry:
1.
It maps the subject (user’s) DN from the user’s cert to a branch point in the
LDAP directory.
2.
It searches the LDAP directory for an entry that matches the information
about the subject (end-user) of the client certificate.
3.
It optionally verifies the client certificate with one in the LDAP entry that
corresponds to the DN.
The server uses a certificate mapping file called
certmap.conf
to determine
how to do the LDAP search. The mapping file tells the server what values to
take from the client certificate (such as the end-user’s name, email address, and
so on). The server uses these values to search for a user entry in the LDAP
directory, but first the server needs to determine where in the LDAP directory it
needs to start its search. The certificate mapping file also tells the server where
to start.
Once the server knows where to start its search and what it needs to search for
(step 1), it performs the search in the LDAP directory (step 2). If it finds no
matching entry or more than one matching entry, and the mapping is
not set to
verify the certificate, the search fails. For a complete list of the expected search
result behavior, see the following LDAP Search Results table. Note that you can
specify the expected behavior in the ACL; for example, you can specify that
Enterprise Server accepts only you if the certificate match fails. For more
information regarding how to set the ACL preferences, see “Access Control
Files,” on page 331 in Chapter 14, “Controlling Access to Your Server.”
Table 5.1 LDAP Search Results
LDAP Search Result Certificate Verification ON Certificate Verification
OFF
No entry found Authorization fails Authorization fails
Exactly one entry
found Authorization
succeeds
More than one
entry found Authorization fails