Netscape Certificate Management System 6.1, Руководство администратора

Страница: 641 / 840

Mappers
Chapter 15 Publishing 641
In the above examples,
$req
means take the attribute from the certificate request,
$subj
means take the attribute from the certificate subject name, and
$ext
means
take the attribute from the certificate extension.
LdapSubjAttrMap
The
LdapSubjAttrMap
plug-in module enables you to configure a Certificate
Manager to map a certificate to an LDAP directory entry by using the LDAP
attribute named
certSubjectDN
. Note that for you to be able to use this mapper,
your directory entries must include the
certSubjectDN
attribute.
This mapper requires you to specify the exact pattern of the subject DN because the
Certificate Manager searches the directory for the
certSubjectDN
attribute whose
value exactly matches the entire subject DN specified in the mapper configuration.
For example, assume the certificate subject name is this:
UID=jdoe, O=Example Corporation, C=US
When searching the directory for the entry, the Certificate Manager first searches
for entries that have these attributes in common
certSubjectDN=UID=jdoe, O=Example Corporation, C=US
and then narrows down the search to an entry that has only this:
certSubjectDN=UID=jdoe, O=Example Corporation, C=US
If no matching entries are found, the server returns an error and writes it to the log.
Configuration Parameters of LdapSubjAttrMap
Table 15-9 describes these parameters.
Table 15-9 LdapSubjAttrMap Parameters
Parameter Description
certSubjNameAttr
Specifies the name of the LDAP attribute that contains a
certificate subject name as its value. Must be
certSubjectName
.
searchBase
Specifies the base DN for starting the attribute search.
Permissible values: A valid DN of an LDAP entry.
Example:
O=example.com, C=US