Sun Microsystems Netscape Enterprise Server, Руководство администратора

Страница: 138 / 532

Using Client Certificates
138 Netscape Enterprise Server Administrator’s Guide
Note that the attribute names for the filters need to be attribute names from
the certificate, not from the LDAP directory. For example, some certificates
have an
e
attribute for the user’s email address; whereas LDAP calls that
attribute
mail
.
•
verifycert
tells the server whether it should compare the client’s
certificate with the certificate found in the LDAP directory. It takes two
values: on, and off. You should only use this property if your LDAP
directory contains certificates. This feature is useful to ensure your end-
users have a valid, unrevoked certificate.
•
CmapLdapAttr
is a name for the attribute in the LDAP directory that
contains subject DNs from all certificates belonging to the user. The default
for this property is
certSubjectDN
. This attribute isn’t a standard LDAP
attribute, so to use this property, you have to extend the LDAP schema. For
more information, see
Managing Servers with Netscape Console .
If this property exists in the
certmap.conf
file, the server searches the
entire LDAP directory for an entry whose attribute (named with this
property) matches the subject’s full DN (taken from the certificate). If the
search doesn’t find any entries, the server retries the search using the
DNComps
and
FilterComps
mappings.
This approach to matching a certificate to an LDAP entry is useful when it’s
difficult to match entries using
DNComps
and
FilterComps
.
Table 5.2 Attributes for x509v3 Certificates
Attribute Description
c
Country
o
Organization
cn
Common name
l
Location
st
State
ou
Organizational unit
uid
Unix userid
e|mail
Email address