Red Hat CERTIFICATE SYSTEM 7.3 - ADMINISTRATION, Руководство администратора

Страница: 391 / 554

Mapper Plug-in Modules
369
This mapper creates an entry for the CA in the directory and maps the CA certificate to the CA's entry
in the directory.
By default, the mapper is configured to create an entry for the CA in the directory, The default DN
pattern for locating the CA's entry is as follows:
uid=$subj.cn,ou=people,o=$subj.o
15.13.2.1.2. LdapCrlMap
The
LdapCrlMap
mapper is an instance of the
LdapCaSimpleMap
module. The Certificate Manager
automatically creates this mapper during installation.
This mapper creates an entry for the CA in the directory and maps the CRL to the CA's entry in the
directory.
By default, the mapper is configured to create an entry for the CA in the directory. The default DN
pattern for locating the CA's entry is as follows:
uid=$subj.cn,ou=people,o=$subj.o
15.13.2.2. LdapDNExactMap
The
LdapDNExactMap
plug-in module configures a Certificate Manager to map a certificate to an
LDAP directory entry by searching for the LDAP entry DN that matches the certificate subject name.
To use this mapper, each certificate subject name must exactly match a DN in a directory entry. For
example, if the certificate subject name is
uid=jdoe, o=Example Corporation, c=US
, when
searching the directory for the entry, the Certificate Manager only searches for an entry with the DN
uid=jdoe, o=Example Corporation, c=US
.
If no matching entries are found, the server returns an error and does not publish the certificate.
This mapper does not require any values for any parameters because it obtains all values from the
certificate.
15.13.2.3. LdapSimpleMap
The
LdapSimpleMap
plug-in module configures a Certificate Manager to map a certificate to an
LDAP directory entry by deriving the entry's DN from components specified in the certificate request,
certificate's subject name, certificate extension, and attribute variable assertion (AVA) constants. For
more information on AVAs, see the directory documentation.
By default, the Certificate Manager uses mapper rules that are based on the simple mapper. During
installation, the Certificate Manager automatically creates an instance of the simple mapper module,
named
LdapUserCertMap
. The default mapper maps various types of end-entity certificates to their
corresponding directory entries.
15.13.2.3.1. Configuration Parameters of LdapSimpleMap
The simple mapper requires one parameter,
dnPattern
. The value of
dnPattern
can be a list of
AVAs separated by commas. An AVA can be a variable, such as
uid=$subj.UID
, or a constant, such
as
o=Example Corporation
.