Sun Microsystems Netscape Enterprise Server, Руководство администратора

Страница: 136 / 532

Using Client Certificates
136 Netscape Enterprise Server Administrator’s Guide
After the server finds a matching entry and certificate in the LDAP directory, it
can use that information to process the transaction. For example, some servers
use certificate-to-LDAP mapping to determine access to a server.
The following section describes the
certmap.conf
file. You need to edit this
file to fit the entries in your LDAP directory and to match the certificates you
expect your users to have.
Using the certmap.conf File
The certificate mapping file determines how a server should look up a user
entry in the LDAP directory. You edit this file and add entries to match the
organization of your LDAP directory and to list the certificates you want your
users to have. Specifically, the mapping file defines the following information:
• where in the LDAP tree the server should begin its search
• what certificate attributes the server should use as search criteria when
searching for the entry in the LDAP directory
• whether or not the server goes through an additional verification process
The certificate mapping file is located in the following location:
server_root/userdb/certmap.conf
The file contains one or more named mappings, each applying to a different
CA. A mapping has the following syntax:
certmap <name> <issuerDN>
<name>:<property> [<value>]
The first line specifies a name for the entry and the attributes that form the
distinguished name found in the CA certificate. The name is arbitrary; you can
define it to be whatever you want. However,
issuerDN
must
exactly
match
the issuer DN of the CA who issued the client certificate. For example, the
following two
issuerDN
lines differ only in the spaces separating the
attributes, but the server treats these two entries as different:
certmap moz1 ou=Mozilla Certificate Authority,o=Netscape,c=US
certmap moz2 ou=Mozilla Certificate Authority, o=Netscape, c=US