Table of Contents
Advertisement
UidPwdPinDirAuth Plug-in Module
Here's how the enrollment method works: as a part of setting up a Certificate
Manager or a Registration Manager, or both for end-user authentication, you
specify the LDAP directory that the server must use to authenticate end users. End
users enroll for a certificate by entering their user IDs, passwords, and PINs in an
HTML form that is served by the Certificate Manager or Registration Manager (see
"Enrollment Forms" on page 55). Once the server successfully authenticates an end
user, it retrieves the rest of the information required to formulate the certificate
from the directory. You can also configure the server to either retain or remove the
PIN from the directory following successful authentication.
Normally, user entries in directories do not contain PINs. In order to use the
module, you must first populate the directory that you intend
UidPwdPinDirAuth
to use for authentication with unique PINs for users; each user to whom you intend
to issue a certificate must know his or her PIN at the time of certificate enrollment,
as he or she will be required to enter it in the enrollment form. To aid you in the
process of generating unique PINs for users and adding them to the directory,
Certificate Management System provides a command-line tool called the PIN
Generator. For information about this tool, see CMS Command-Line Tools Guide.
Configuration Parameters of UidPwdPinDirAuth
In the configuration file, the
module is identified as
UidPwdPinDirAuth
auths.impl.UidPwdPinDirAuth.class=com.netscape.certsrv.
.
authentication.UidPwdPinDirAuthentication
In the CMS window, the module is identified as
. Figure 1-5
UidPwdPinDirAuth
shows how configurable parameters of the module are displayed in the CMS
window.
Chapter 1
Authentication Plug-in Modules
31
Advertisement
Table of Contents
