Using The Certmap.conf File - Netscape ENTREPRISE SERVER 6.1 - 04-2002 ADMINISTRATOR Administrator's Manual

Using the certmap.conf File

Certificate mapping determines how a server looks up a user entry in the LDAP
directory. You can use
name, is mapped to an LDAP entry. You edit this file and add entries to match the
organization of your LDAP directory and to list the certificates you want your
users to have. Users can be authenticated based on userid, email, or any other value
used in the
subjectDN
information:
• Where in the LDAP tree the server should begin its search
• What certificate attributes the server should use as search criteria when
searching for the entry in the LDAP directory
• Whether or not the server goes through an additional verification process
The certificate mapping file is located in the following location:
server_root
/userdb/certmap.conf
The file contains one or more named mappings, each applying to a different CA.
A mapping has the following syntax:
certmap name issuerDN
name:property [value]
The first line specifies a name for the entry and the attributes that form the
distinguished name found in the CA certificate. The name is arbitrary; you can
define it to be whatever you want. However,
issuer DN of the CA who issued the client certificate. For example, the following
two lines differ only in the spaces separating the attributes, but the
issuerDN
server treats these two entries as different:
certmap example1 ou=Example Certificate Authority,o=example,c=US
certmap example2 ou=Example Certificate Authority,o=example, c=US
TIP If you are using Directory Server and experiencing problems in matching
the issuerDN, check the Directory Server error logs for useful
information.
The second and subsequent lines in the named mapping match properties with
values. The
certmap.conf
API to customize your own properties):
to configure how a certificate, designated by
certmap.conf
. Specifically, the mapping file defines the following
file has six default properties (you can use the certificate
Setting Client Security Requirements
must exactly match the
issuerDN
Chapter 5 Securing Your Enterprise Server 125