2001-05-12 02:15:42 -04:00
|
|
|
# Copyright 1999-2000, The OpenLDAP Foundation, All Rights Reserved.
|
|
|
|
|
# COPYING RESTRICTIONS APPLY, see COPYRIGHT.
|
|
|
|
|
|
|
|
|
|
H1: Using TLS
|
|
|
|
|
|
2002-06-14 09:35:09 -04:00
|
|
|
OpenLDAP clients and servers are capable of using the
|
2002-06-14 17:19:42 -04:00
|
|
|
{{TERM[expand]TLS}} ({{TERM:TLS}}) framework to provide
|
2001-05-12 02:15:42 -04:00
|
|
|
integrity and confidentiality protections and to support
|
2002-06-14 17:19:42 -04:00
|
|
|
LDAP authentication using the {{TERM:SASL}} EXTERNAL mechanism.
|
2001-05-12 02:15:42 -04:00
|
|
|
|
2002-06-14 08:38:32 -04:00
|
|
|
TLS uses {{TERM:X.509}} certificates to carry client and server
|
|
|
|
|
identities. All servers are required to have valid certificates,
|
|
|
|
|
whereas client certificates are optional. Clients must have a
|
2002-06-14 09:35:09 -04:00
|
|
|
valid certificate in order to authenticate via SASL EXTERNAL.
|
|
|
|
|
For more information on creating and managing certificates,
|
|
|
|
|
see the {{PRD:OpenSSL}} documentation.
|
2002-06-14 08:38:32 -04:00
|
|
|
|
2002-06-14 09:35:09 -04:00
|
|
|
H2: Server Certificates
|
2002-06-14 08:38:32 -04:00
|
|
|
|
2002-06-14 09:35:09 -04:00
|
|
|
The DN of a server certificate must use the CN attribute
|
2002-06-14 17:47:09 -04:00
|
|
|
to name the server, and the {{EX:CN}} must carry the server's
|
2002-06-14 09:35:09 -04:00
|
|
|
fully qualified domain name. Additional alias names and wildcards
|
2002-06-14 17:47:09 -04:00
|
|
|
may be present in the {{EX:subjectAltName}} certificate extension.
|
2002-06-14 09:35:09 -04:00
|
|
|
More details on server certificate names are in {{REF:RFC2830}}.
|
|
|
|
|
|
|
|
|
|
H2: Client Certificates
|
|
|
|
|
|
|
|
|
|
The DN of a client certificate can be used directly as an
|
|
|
|
|
authentication DN.
|
|
|
|
|
Since X.509 is a part of the {{TERM:X.500}} standard and LDAP
|
|
|
|
|
is also based on X.500, both use the same DN formats and
|
|
|
|
|
generally the DN in a user's X.509 certificate should be
|
|
|
|
|
identical to the DN of their LDAP entry. However, sometimes
|
|
|
|
|
the DNs may not be exactly the same, and so the mapping
|
|
|
|
|
facility described in
|
|
|
|
|
{{SECT:Mapping Authentication identities to LDAP entries}}
|
|
|
|
|
can be applied to these DNs as well.
|
