Netscape Certificate Management System 6.1, Руководство администратора

Страница: 640 / 840

Mappers
640 Netscape Certificate Management System Administrator’s Guide • February 2003
LdapDNExactMap
The
LdapDNExactMap
plug-in module enables you to configure a Certificate
Manager to map a certificate to an LDAP directory entry by searching for the
LDAP entry DN that matches the certificate subject name. Note that to be able to
use this mapper, each certificate subject name must exactly match a DN in a
directory entry. For example, assume the certificate subject name is this:
UID=jdoe,
O=Example Corporation, C=US
When searching the directory for the entry, the Certificate Manager only searches
for an entry whose DN is this:
UID=jdoe, O=Example Corporation, C=US
If no matching entries are found, the server returns an error and does not publish
the certificate.
This mapper does not require you to specify any values for any parameters because
it obtains all values from the certificate.
LdapSimpleMap
The
LdapSimpleMap
plug-in module enables you to configure a Certificate
Manager to map a certificate to an LDAP directory entry by deriving the entry’s
DN from components specified in the certificate request, certificate’s subject name,
certificate extension, and attribute variable assertion (AVA) constants. For more
information on AVAs, see the directory documentation.
By default, the Certificate Manager uses mapper rules that are based on the simple
mapper. During installation, the Certificate Manager automatically creates an
instance of the simple mapper module. The instance is named
LdapUserCertMap
.
You can use the default mapper to map various types of end-entity certificates the
server will issue to their corresponding directory entries.
Configuration Parameters of LdapSimpleMap
The simple mapper requires you to specify just one parameter, which is named
dnPattern
. The value of
dnPattern
can be a list of AVAs separated by commas.
An AVA can be a variable, such as
UID=$subj.UID
, or a constant, such as
O=Example Corporation
. The examples below illustrate how you can use AVAs to
form the DN pattern.
Example 1:
uid=CertMgr, o=Example Corporation
Example 2:
CN=$subj.cn,OU=$subj.ou,O=$subj.o,C=US
Example 3: uid=
$req.HTTP_PARAMS.uid,
E=$ext.SubjectAlternativeName.RFC822Name,ou=$subj.ou