Table of Contents
Advertisement
LdapDNExactMap Plug-in Module
Description of parameters defined in the LdapDNCompsMap module (Continued)
Table 5-3
Parameter
Description
Specifies components the Certificate Manager should use to filter entries from the
filterComps
search result. The server uses the filterComps values to form an LDAP search filter
for the subtree. The server constructs the filter by gathering values for these attributes
from the certificate subject name; it uses the filter to search for and match entries in
the LDAP directory.
If the server finds one or more entries in the LDAP directory that match the
information gathered from the certificate, the search is successful and the server
optionally performs a verification. For example, if filterComps is set to use the
email and user ID attributes (filterComps=e, uid), the server searches the
directory for an entry whose values for email and user ID match the information
gathered from the certificate.
Email addresses and user IDs are good filters because they are usually unique entries
in the directory. Keep in mind that email is not always included in the certificate
subject name. The filter needs to be specific enough to match one and only one entry
in the LDAP database.
Permissible values: Valid directory attributes (in the certificate DN) separated by
commas. The attribute names for the filters need to be attribute names from the
certificate, not from ones in the LDAP directory. For example, most certificates have
an E attribute for the user's email address; LDAP calls that attribute mail.
Example: UID
LdapDNExactMap Plug-in Module
The
LdapDNExactMap
mapper enables you to configure a Certificate Manager to map a certificate to an
LDAP directory entry by searching for the LDAP entry DN that matches the
certificate subject name. Note that to be able to use this mapper, each certificate
subject name must exactly match a DN in a directory entry. For example, assume
the certificate subject name is this:
When searching the directory for the entry, the Certificate Manager only searches
for an entry whose DN is this:
If no matching entries are found, the server returns an error and does not publish
the certificate.
This mapper does not require you to specify any values for any parameters because
it obtains all values from the certificate (Figure 5-5).
262
Netscape Certificate Management System Plug-ins Guide • October 2001
plug-in module implements the subject name mapper. This
UID=jdoe, O=Siroe Corporation, C=US
UID=jdoe, O=Siroe Corporation, C=US
Advertisement
Table of Contents
