Red Hat DIRECTORY SERVER 7.1, Руководство администратора, Страница: 437 / 652

Configuring LDAP Clients to Use SSL
Chapter 11 Managing SSL and SASL 437
4.
Map the certificate’s distinguished name to a distinguished name known by
your directory.
This allows you to set access control for the client when it binds using this
certificate. This mapping process is described in Managing Servers with Red Hat
Console
.
Allowing/Requiring Client Authentication
If you have configured Red Hat Console to connect to your Directory Server using
SSL and your Directory Server requires client authentication, you can no longer use
Red Hat Console to manage server applications. You will have to use the
appropriate command-line utilities instead.
However, if at a later date you wish to change your directory configuration to no
longer require but allow client authentication, so that you can use Red Hat Console,
you must follow these steps:
1.
Stop Directory Server.
For information on stopping and starting the server from the command-line,
see “Starting and Stopping the Server from the Command-Line,” on page 38.
2.
Modify the
cn=encryption,cn=config
entry by changing the value of the
nsSSLClientAuth
attribute from
required
to
allowed
.
For information on modifying entries from the command-line, see chapter 2,
“Creating Directory Entries.”
3.
Start Directory Server.
You can now start Red Hat Console.
Configuring LDAP Clients to Use SSL
If you want all the users of your Directory Server to use SSL or certificate-based
authentication when they connect using LDAP client applications, you must make
sure they perform the following tasks:
• Create a certificate database.
• Trust the Certificate Authority (CA) that issues the server certificate.