Sun Microsystems Netscape Enterprise Server, Руководство администратора

Страница: 140 / 532

Using Client Certificates
140 Netscape Enterprise Server Administrator’s Guide
certmap default default
default:DNComps ou, o, c
default:FilterComps e, uid
default:verifycert on
Using this example, the server starts its search at the LDAP branch point
containing the entry
ou=<orgunit>, o=<org>, c=<country>
where the
text in
<>
is replaced with the values from the subject’s DN in the client
certificate.
The server then uses the values for email address and userid from the certificate
to search for a match in the LDAP directory. When it finds an entry, the server
verifies the certificate by comparing the one the client sent to the one stored in
the directory.
Example #2
The following example file has two mappings: a default one and another for
the US Postal Service:
certmap default default
default:DNComps
default:FilterComps e, uid
certmap usps ou=United States Postal Service, o=usps,
c=US
usps:DNComps ou,o,c
usps:FilterComps e
usps:verifycert on
When the server gets a certificate from anyone other than the US Postal Service,
it uses the default mapping, which starts at the top of the LDAP tree and
searches for an entry matching the client’s email and userid. If the certificate is
from the US Postal Service, the server starts its search at the LDAP branch
containing the organizational unit and searches for matching email addresses.
Also note that if the certificate is from the USPS, the server verifies the
certificate; other certificates are not verified.
Warning
The issuer DN (that is, the CA’s information) in the certificate must be identical
to the issuer DN listed in the first line of the mapping. In the previous example,
a certificate from an issuer DN that is
o=United States Postal
Service,c=US
won’t match because there isn’t a space between the o and
the
c
attributes.