Red Hat CERTIFICATE SYSTEM 8.0 - ADMINISTRATION, Руководство администратора

Страница: 90 / 564

Chapter 2. Making Rules for Issuing Certificates
68
NOTE
There is no graphical interface for performing this customization.
To customize the DN:
1. Edit the
user.vm
file. By default, this is located in the
/var/lib/pki-ra/docroot/ee/user/
directory.
2. Locate the "validate" function and formulate your preferred DN in the
var dn=
statement. For
example:
var dn = "uid="+x+".e="+e;
x
is the UID and
e
is the email.
3. Save the file.
Currently, the request form only requests UID, Site ID, and Email information. If the site requires more
information than the form provides for, then you need to modify the enrollment form to allow additional
input. The enrollment form is included at the end of the
user.vm
file. For example:
<tr>
<td>District:</td>
<td><input type=text name=district value=""></td>
</tr>
After making the appropriate changes to the enrollment form, edit the
user.vm
file to customize the
Subject DN to utilize the information collected from the user.
WARNING
The Subject DN must match the pattern specified in the
Subject Name Constraint
definition of the enrollment profile. The default user enrollment profile is specified by
/
var/lib/pki-ca/profiles/ca/caDualRAuserCert.cfg
.
For example:
policyset.userCertSet.1.constraint.name=Subject Name Constraint
policyset.userCertSet.1.constraint.params.pattern=UID=.*
policyset.userCertSet.1.constraint.params.accept=true
Using this definition, certificates are only issued if the subject name matches the pattern "UID=.*".
Otherwise, the certificate request is rejected.