Table of Contents
Advertisement
LdapCaSimpleMap Plug-in Module
The
LdapCaSimpleMap
mapper enables you to configure a Certificate Manager to automatically create an
entry for the CA in an LDAP directory and then map the CA's certificate to the
directory entry by formulating the entry's DN from components specified in the
certificate request, certificate subject name, certificate extension, and attribute
variable assertion (AVA) constants. For more information on AVAs, check the
directory documentation.
The CA certificate mapper allows you to specify whether to create an entry for the
CA or to just map the certificate to an existing entry, or to do both. For example,
you can choose to manually create an entry for the CA in the directory and then
configure the CA certificate mapper to just locate the entry by using attributes from
the issuer name in the CA's signing certificate and AVA constants.
Note that if you already have one CA entry created in the publishing directory and
if you change the value assigned to the
something different, but with the same UID and O attributes, the mapper will fail
to create the second CA entry. For example, if the directory already has a CA entry
with
create another CA entry with
operation will fail.
The reason for the failure may be because you are using a directory (for example,
the configuration directory) that has the uid uniqueness plug-in set to a specific base
DN in the
two entries with the same UID under that base DN. For example, it prevents the
directory from having two entries under
If the mapper fails to create a second CA entry, be sure to check the base DN that
the uid uniqueness plug-in is set to (in the
an entry with the same UID already exists in the directory. If it's true, adjust the
mapper setting, remove the old CA entry, comment out the plug-in, or create the
entry manually using the CMS window.
During installation, the Certificate Manager automatically creates two instances
(called mappers) of the CA certificate mapper module (see Figure 5-2). The
mappers are named as follows:
•
LdapCrlMap
•
LdapCaCertMap
page 256)
plug-in module implements the CA certificate mapper. This
UID=CA,OU=Marketing,O=siroe.com
slapd.ldbm.conf
for CRLs (see "LdapCrlMap Mapper" on page 257)
for CA certificates (see "LdapCaCertMap Mapper" on
dnPattern
and if you configure the mapper to
UID=CA,OU=Engineering,O=siroe.com
file. This setting prevents the directory from having
O=siroe.com
slapd.ldbm.conf
LdapCaSimpleMap Plug-in Module
parameter of this mapper to
, the
with the same UID,
file) and also check if
Chapter 5
Mapper Plug-in Modules
.
CA
253
Advertisement
Table of Contents
