Red Hat CERTIFICATE SYSTEM 7.2 - MIGRATION GUIDE, Руководство администратора

Страница: 358 / 512

Chapter 14. Publishing
338
cn=Jane Doe, o=Example Corporation, c=US
For the
dnComps
parameter, enter those DN components that the Certificate Manager can use to form
the LDAP DN exactly. In certain situations, however, the subject name in a certificate may match more
than one entry in the directory. Then, the Certificate Manager might not get a single, distinct matching
entry from the DN. For example, the subject name
cn=Jane Doe, ou=Sales, o=Example
Corporation, c=US
might match two users with the name Jane Doe in the directory. If that occurs,
the Certificate Manager needs additional criteria to determine which entry corresponds to the subject
of the certificate.
To specify the components the Certificate Manager must use to distinguish between different entries
in the directory, use the
filterComps
parameter; for details, see
Table 14.13, “LdapDNCompsMap
Configuration Parameters”
. For example, if
cn
,
ou
,
o
, and
c
are values for the
dnComps
parameter,
enter
l
for the
filterComps
parameter only if the
l
attribute can be used to distinguish between
entries with identical
cn
,
ou
,
o
, and
c
values.
If the two Jane Doe entries are distinguished by the value of the
uid
attribute � one entry's
uid
is
janedoe1
, and the other entry's
uid
is
janedoe2
� the subject names of certificates can be set to
include the
uid
component.
NOTE
The
e
,
l
, and
st
components are not included in the standard set of certificate request
forms provided for end entities. These components can be added to the forms, or the
issuing agents can be required to insert these components when editing the subject name
in the certificate issuance forms.
14.12.2.5.1. Configuration Parameters of LdapDNCompsMap
With this configuration, a Certificate Manager maps its certificates with the ones in the LDAP directory
by using the
dnComps
values to form a DN and the
filterComps
values to form a search filter for
the subtree.
• If the formed DN is null, the server uses the
baseDN
value for the subtree. If both the formed DN
and base DN are null, the server logs an error.
• If the filter is null, the server uses the
baseDN
value for the search. If both the filter and base DN are
null, the server logs an error.
Table 14.13, “LdapDNCompsMap Configuration Parameters”
describes these parameters.
Parameter Description
baseDN
Specifies the DN to start searching for an entry
in the publishing directory. If the
dnComps
field is
blank, the server uses the base DN value to start
its search in the directory.
dnComps
Specifies where in the publishing directory the
Certificate Manager should start searching for
an LDAP entry that matches the CA's or the end
entity's information.