certmap.conf - Man Page

/etc/dirsrv/config/certmap.conf

certmap.conf

This file configures how a certificate is mapped to an LDAP entry.  See the documentation for more information on this file: https://access.redhat.com/documentation/en-us/red_hat_directory_server/10/html/configuration_command_and_file_reference/configuration_file_reference#certmap_conf

The format of this file is as follows:
certmap <name> <issuerDN>
<name>:<prop1> [<val1>]
<name>:<prop2> [<val2>]

Notes:

1.  Mapping can be defined per issuer of a certificate.  If mapping doesn't
    exists for a particular 'issuerDN' then the server uses the default
    mapping.

2.  There must be an entry for <name>=default and issuerDN "default".
    This mapping is the default mapping.

3.  '#' can be used to comment out a line.

4.  DNComps & FilterComps are used to form the base DN and filter responsible for
    performing an LDAP search while mapping the certificate to a user entry.

DNComps

The DNComps parameter determines how Directory Server generates the base DN  used to search for a user in the directory.  This setting accepts a comma  separated list of attributes to form a DN.  However, the order of the  attributes in the DNComps parameter must match the order in the subject of the certificate.  For example, if your certificate's subject is  "e=user_name@example.com,cn=user_name,o=Example Inc.,c=US", and you want  Directory Server to use "cn=user_name,o=Example Inc.,c=US" as the base DN when  searching for the user, set the DNComps parameter to "cn, o, c".
  Comment out or do not set this parameter, if either the subject field of the  certificate matches exactly the DN of the user in Directory Server or if you  want to use the setting from the CmapLdapAttr parameter.

If the value is empty, it will search the entire LDAP tree by using the  FilterComps parameter.

FilterComps

This parameter sets which attributes from the subject field of the certificate Directory Server uses to generate the search filter to locate the user.

Set this parameter to a comma-separated list of attributes used in the  certificate's subject. Directory Server will use these attributes in an AND  operation in the filter.

Note - Certificate Subjects use the e attribute for the email address, which  does not exist in the default Directory Server schema. For this reason,  Directory Server automatically maps this attribute to the mail attribute. This means, if you use the mail attribute in the FilterComps parameter, Directory  Server reads the value of the e attribute from the subject of the certificate.

For example, if the subject of a certificate is  "e=user_name@example.com,cn=user_name,dc=example,dc=com,o=Example Inc.,c=US"  and you want to dynamically generate the  "(&(mail=username@domain)(cn=user_name))" filter, set the FilterComps parameter  to "mail, cn".
 If the parameter is commented out or set to an empty value, the (objectclass=*) filter will be used.

verifycert

Directory Server always verifies if the certificate has been issued by a  trusted Certificate Authority (CA). However, if you additionally set the  verifycert parameter to on, Directory Server additionally verifies that the  certificate matches the Distinguished Encoding Rules (DER)-formatted  certificate stored in the userCertificate binary attribute of the user.

If you do not set this parameter, verifycert is disabled

CmapLdapAttr

If your user entries contain an attribute that stores the subject DN of the  user certificate, set the CmapLdapAttr to this attribute name. Directory Server will use this attribute and the subject DN to locate the user. In this case the no filter is generated based on the attributes in the FilterComps parameter.

certmap default         default
default:DNComps         cn, o, c
#default:FilterComps    e, uid
#default:verifycert     on
#default:CmapLdapAttr   certSubjectDN

certmap example         o=Example Inc.,c=US
example:DNComps

certmap.conf was written by the 389 Project.

Report bugs to https://github.com/389ds/389-ds-base/issues/new

Copyright © 2018 Red Hat, Inc.