Netscape Certificate Management System 6.0, Руководство пользователя

Страница: 256 / 377

LdapDNCompsMap Plug-in Module
256 Netscape Certificate Management System Plug-Ins Guide • March 2002
The Certificate Manager uses the components in subject names to construct a DN
that it can use as the base for searching specific directory entries in order to publish
the corresponding certificate information.
For example, suppose the subject name in the certificate is in this form:
CN=Jane Doe, OU=Sales, O=Example Corporation, L=Mountain View,
ST=California, C=US
The Certificate Manager can use some or all of these components (
CN
,
OU
,
O
,
L
,
ST
,
and
C
) to build a DN for searching the directory. When creating a mapper rule, you
can specify the components the server should use to build a DN (that is,
components to match attributes in the directory). You do this by configuring the
dnComps
parameter; for details, see Table 5-3 on page 258.
For example, assume you entered components
CN
,
E
,
OU
,
O
, and
C
as values for the
dnComps
parameter. For locating Jane Doe’s entry in the directory, the Certificate
Manager constructs the following DN by reading the DN attribute values from the
certificate, and uses the DN as the base for searching the directory:
CN=Jane Doe, OU=Sales, O=Example Corporation, C=US
Note the following:
• A subject name does not need to have all of the components that you specify
for the
dnComps
parameter. The server ignores any components that are not
part of the subject name (such as
L
,
ST
, and
E
in this example).
• Unspecified components are not used to build the DN. In the example, if you
did not include the
OU
component, the server would use this DN as the base for
searching the directory:
CN=Jane Doe, O=Example Corporation, C=US
In general, for the
dnComps
parameter, you should enter those DN components that
the Certificate Manager can use to form the LDAP DN exactly. In certain situations,
however, the subject name in a certificate may match more than one entry in the
directory. Then, the Certificate Manager might not get a single, distinct matching
entry from the DN. For example, the subject name
CN=Jane Doe, OU=Sales, O=Example Corporation, C=US
might match two users with the name Jane Doe in the directory. If that occurred,
the Certificate Manager would need additional criteria to determine which entry
corresponds to the subject of the certificate.