FreeBSD Manual Pages
CERTMAP.CONF(5) File Formats Manual CERTMAP.CONF(5) NAME /etc/dirsrv/config/certmap.conf - Configuration file for TLS client authen- tication in 389 Directory Server. SYNOPSIS /etc/dirsrv/config/certmap.conf DESCRIPTION certmap.conf This file configures how a certificate is mapped to an LDAP entry. See the documentation for more information on this file: https://access.red- hat.com/documentation/en-us/red_hat_directory_server/10/html/configura- tion_command_and_file_reference/configuration_file_reference#certmap_conf SYNTAX The format of this file is as follows: certmap <name> <issuerDN> <name>:<prop1> [<val1>] <name>:<prop2> [<val2>] Notes: 1. Mapping can be defined per issuer of a certificate. If mapping doesn't exists for a particular 'issuerDN' then the server uses the default mapping. 2. There must be an entry for <name>=default and issuerDN "default". This mapping is the default mapping. 3. '#' can be used to comment out a line. 4. DNComps & FilterComps are used to form the base DN and filter respon- sible for performing an LDAP search while mapping the certificate to a user en- try. OPTIONS DNCompsThe DNComps parameter determines how Directory Server generates the base DN used to search for a user in the directory. This setting accepts a comma separated list of attributes to form a DN. However, the order of the attributes in the DNComps parameter must match the order in the subject of the certificate. For example, if your cer- tificate's subject is "e=user_name@example.com,cn=user_name,o=Exam- ple Inc.,c=US", and you want Directory Server to use "cn=user_name,o=Example Inc.,c=US" as the base DN when searching for the user, set the DNComps parameter to "cn, o, c". Comment out or do not set this parameter, if either the subject field of the certificate matches exactly the DN of the user in Di- rectory Server or if you want to use the setting from the CmapLdap- Attr parameter. If the value is empty, it will search the entire LDAP tree by using the FilterComps parameter. FilterComps This parameter sets which attributes from the subject field of the certificate Directory Server uses to generate the search filter to locate the user. Set this parameter to a comma-separated list of attributes used in the certificate's subject. Directory Server will use these attrib- utes in an AND operation in the filter. Note - Certificate Subjects use the e attribute for the email ad- dress, which does not exist in the default Directory Server schema. For this reason, Directory Server automatically maps this attribute to the mail attribute. This means, if you use the mail attribute in the FilterComps parameter, Directory Server reads the value of the e attribute from the subject of the certificate. For example, if the subject of a certificate is "e=user_name@exam- ple.com,cn=user_name,dc=example,dc=com,o=Example Inc.,c=US" and you want to dynamically generate the "(&(mail=username@do- main)(cn=user_name))" filter, set the FilterComps parameter to "mail, cn". If the parameter is commented out or set to an empty value, the (ob- jectclass=*) filter will be used. verifycert Directory Server always verifies if the certificate has been issued by a trusted Certificate Authority (CA). However, if you addition- ally set the verifycert parameter to on, Directory Server addition- ally verifies that the certificate matches the Distinguished Encod- ing Rules (DER)-formatted certificate stored in the userCertificate binary attribute of the user. If you do not set this parameter, verifycert is disabled CmapLdapAttr If your user entries contain an attribute that stores the subject DN of the user certificate, set the CmapLdapAttr to this attribute name. Directory Server will use this attribute and the subject DN to locate the user. In this case the no filter is generated based on the attributes in the FilterComps parameter. EXAMPLES certmap default default default:DNComps cn, o, c #default:FilterComps e, uid #default:verifycert on #default:CmapLdapAttr certSubjectDN certmap example o=Example Inc.,c=US example:DNComps AUTHOR certmap.conf was written by the 389 Project. REPORTING BUGS Report bugs to https://github.com/389ds/389-ds-base/issues/new COPYRIGHT Copyright (C) 2018 Red Hat, Inc. Jun 26, 2018 CERTMAP.CONF(5)
NAME | SYNOPSIS | DESCRIPTION | SYNTAX | OPTIONS | EXAMPLES | AUTHOR | REPORTING BUGS | COPYRIGHT
Want to link to this manual page? Use this URL:
<https://man.freebsd.org/cgi/man.cgi?query=certmap.conf&sektion=5&manpath=FreeBSD+Ports+15.1.quarterly>