Netscape Certificate Management System 6.1, Руководство администратора

Страница: 293 / 840

The Internal Database
Chapter 7 Administrative Basics 293
internaldb.ldapconn.port=<ldap_httpsport>
internaldb.ldapconn.secureConn=true
internaldb.ldapauth.clientCertNickname=Server-Cert
cert-<instance_name>
5.
Go to the Directory Server console.
6.
Create an entry for the suffix which matches the subject DN of the CMS
subsystem certificate for the subsystem using this internal database. For
example if your CA server certificate has a the subject name
c=jupiter.example.com,ou=marketing,o=example,l=mv,c=us then create a
suffix
o=example,l=mv,c=us
. To do this:
a.
Go to Configuration Tab.
b.
Right click and select Data.
c.
Click on New Suffix and add the suffix
7.
Go to Directory tab and Right click “
netscapeDirectoryServer
”.
8.
Add the entry created in Step 6 into the Configuration Administrators group.
9.
Click “set Access Control Permission” and then Click Add.
10.
Fill in the following information:
ACIName. clientauth
Check all the rights in the Rights tab.
Click This Entry in the Targets tab.
11.
Click OK.
Restricting Access to the Internal Database
Netscape Console displays an entry or icon for the Directory Server instance that
CMS uses as its internal database. You can distinguish an internal database
instance from other Directory Server instances. It is in this form:
slapd-<cms_instance_id>-db
Unlike the CMS console, access to which is restricted to users with CMS
administrator privileges, the Directory Server console can be accessed by the person
who has privileges to access Netscape Console. That is, this person can open the
Directory Server console for the internal database and make changes to the data
stored there. For example, this person can make changes to the CMS administrators
group, such as deleting existing users and adding entries for self.