Netscape NETSCAPE MANAGEMENT SYSTEM 4.5 - PLUG-IN User manual

Plug-ins Guide
Netscape Certificate Management System
Version4.5
October 2001

Netscape Communications Corporation (“Netscape”), a subsidiary of America Online, Inc., and its licensors retain all ownership
rights to the software programs offered by Netscape (referred to herein as “Software”) and related documentation. Use of the
Software and related documentation is governed by the license agreement accompanying the Software and applicable copyright law.
Your right to copy this documentation is limited by copyright law. Making unauthorized copies, adaptations, or compilation works
is prohibited and constitutes a punishable violation of the law. Netscape may revise this documentation from time to time without
notice.
THIS DOCUMENTATION IS PROVIDED “AS IS” WITHOUT WARRANTY OF ANY KIND. IN NO EVENT SHALL NETSCAPE BE
LIABLE FOR INDIRECT, SPECIAL, INCIDENTAL, OR CONSEQUENTIAL DAMAGES OF ANY KIND ARISING FROM ANY
ERROR IN THIS DOCUMENTATION, INCLUDING WITHOUT LIMITATION ANY LOSS OR INTERRUPTION OF BUSINESS,
PROFITS, USE, OR DATA.
Software applications: © 2001 Sun Microsystems, Inc.
Some software code: © 1999, 2001 Netscape Communications Corporation.
All rights reserved.
Netscape and the Netscape N logo are registered trademarks of Netscape Communications Corporation in the United States and
other countries. Other Netscape logos, product names, and service names are also trademarks of Netscape Communications
Corporation, which may be registered in other countries. Other product and brand names are the exclusive property of their
respective owners.
The downloading, exporting, or reexporting of Netscape software or any underlying information or technology must be in full
compliance with all United States and other applicable laws and regulations. Any provision of Netscape software or documentation
to the U.S. Government is with restricted rights as described in the license agreement accompanying Netscape software.

3
Contents
AboutThisGuide.............................................................. 11
What’sinThisGuide....................................................................11
WhatYouShouldAlreadyKnow .........................................................13
ConventionsUsedinThisGuide .........................................................14
WheretoGoforRelatedInformation......................................................15
Chapter 1 AuthenticationPlug-inModules ....................................... 19
OverviewofAuthenticationModules .....................................................20
ManualAuthentication..................................................................23
UidPwdDirAuthPlug-inModule .........................................................24
ConfigurationParametersofUidPwdDirAuth ...........................................26
UidPwdPinDirAuthPlug-inModule ......................................................30
ConfigurationParametersofUidPwdPinDirAuth ........................................31
NISAuthPlug-inModule ................................................................37
ConfigurationParametersofNISAuth ..................................................39
PortalEnrollPlug-inModule .............................................................44
ConfigurationParametersofPortalAuth ................................................47
Certificate-BasedEnrollment.............................................................52
EnrollmentForms ......................................................................55
CustomizingEnrollmentFormsforGeneratingDSAKeyPairs.............................60
GeneratingFilesRequiredByThird-PartyObjectSigningTools ............................61
Chapter 2 JobPlug-inModules ................................................ 65
OverviewofJobPlug-inModules.........................................................65
RenewalNotificationJobPlug-inModule...................................................67
ConfigurationParametersofRenewalNotificationJob.....................................68
RequestInQJobPlug-inModule ..........................................................71

4 Netscape Certificate Management System Plug-ins Guide • October 2001
ConfigurationParametersofRequestInQJob ............................................ 72
UnpublishExpiredJobPlug-inModule .................................................... 74
ConfigurationParametersofUnpublishExpiredJob ...................................... 76
ScheduleforExecutingJobs........................................................... 78
CustomizingNotificationMessages ...................................................... 79
TemplatesforSummaryNotifications .................................................. 79
CustomizingMessageTemplates ...................................................... 81
TokensAvailableinMessageTemplates ................................................ 81
TokensforRenewalNotificationMessages ........................................... 81
TokensforRequestInQueueNotificationMessages ................................... 83
TokensforDirectoryUpdateNotificationMessages ................................... 83
Chapter 3 Constraints Policy Plug-in Modules . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 85
OverviewofConstraints-SpecificPolicyModules .......................................... 86
AttributePresentConstraintsPlug-inModule............................................... 88
ConfigurationParametersofAttributePresentConstraints................................. 89
DSAKeyConstraintsPlug-inModule...................................................... 93
ConfigurationParametersofDSAKeyConstraints........................................ 94
DSAKeyRuleRule ................................................................... 96
IssuerConstraintsPlug-inModule ........................................................ 96
ConfigurationParametersofIssuerConstraints .......................................... 97
IssuerRuleRule ..................................................................... 98
KeyAlgorithmConstraintsPlug-inModule ................................................ 99
ConfigurationParametersofKeyAlgorithmConstraints................................... 99
KeyAlgRuleRule ................................................................... 101
RenewalConstraintsPlug-inModule..................................................... 101
ConfigurationParametersofRenewalConstraints....................................... 102
RenewalConstraintsRuleRule........................................................ 103
RenewalValidityConstraints Plug-in Module . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 104
ConfigurationParametersofRenewalValidityConstraints................................ 105
DefaultRenewalValidityRule Rule . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 107
RevocationConstraintsPlug-inModule .................................................. 108
ConfigurationParametersofRevocationConstraints .................................... 108
RevocationConstraintsRuleRule...................................................... 109
RSAKeyConstraintsPlug-inModule ..................................................... 110
ConfigurationParametersofRSAKeyConstraints ....................................... 110
RSAKeyRuleRule .................................................................. 112
SigningAlgorithmConstraintsPlug-inModule ............................................ 113
ConfigurationParametersofSigningAlgorithmConstraints .............................. 114
SigningAlgRuleRule................................................................ 116
SubCANameConstraintsPlug-inModule................................................. 116
ConfigurationParametersofSubCANameConstraints................................... 117
SubCANameConstraintsRule........................................................ 118

5
UniqueSubjectNameConstraintsPlug-inModule ..........................................119
ConfigurationParametersofUniqueSubjectNameConstraints ............................119
UniqueSubjectNameConstraintsRule..................................................122
ValidityConstraints Plug-in Module . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 122
ConfigurationParametersofValidityConstraints .......................................124
DefaultValidityRuleRule ............................................................127
Chapter 4 CertificateExtensionPlug-inModules................................. 129
OverviewofExtension-SpecificPolicyModules ...........................................130
AuthInfoAccessExtPlug-inModule......................................................134
ConfigurationParametersofAuthInfoAccessExt........................................136
AuthInfoAccessExtRule .............................................................141
AuthorityKeyIdentifierExtPlug-inModule ...............................................142
ConfigurationParametersofAuthorityKeyIdentifierExt .................................143
AuthorityKeyIdentifierExtRule.......................................................145
BasicConstraintsExtPlug-inModule .....................................................145
ConfigurationParametersofBasicConstraintsExt .......................................146
BasicConstraintsExtRule ............................................................148
CertificatePoliciesExtPlug-inModule ....................................................149
ConfigurationParametersofCertificatePoliciesExt ......................................150
CertificatePoliciesExtRule ...........................................................153
CertificateRenewalWindowExtPlug-inModule ...........................................154
ConfigurationParametersofCertificateRenewalWindowExt .............................155
CertificateScopeOfUseExtPlug-inModule ................................................159
ConfigurationParametersofCertificateScopeOfUseExt ..................................160
CRLDistributionPointsExtPlug-inModule................................................164
ConfigurationParametersofCRLDistributionPointsExt..................................164
CRLDistributionPointsExtRule.......................................................168
ExtendedKeyUsageExtPlug-inModule ..................................................169
ConfigurationParametersofExtendedKeyUsageExt.....................................171
CODESigningExtRule...............................................................173
OCSPSigningExtRule ...............................................................174
GenericASN1ExtPlug-inModule........................................................175
ConfigurationParametersofGenericASN1Ext ..........................................177
GenericASN1ExtRule ...............................................................182
IssuerAltNameExtPlug-inModule ......................................................182
ConfigurationParametersofIssuerAltNameExt ........................................183
KeyUsageExtPlug-inModule ...........................................................187
ConfigurationParametersofKeyUsageExt .............................................189
CMCertKeyUsageExtRule ...........................................................194
RMCertKeyUsageExtRule ...........................................................195
ServerCertKeyUsageExtRule.........................................................196
ClientCertKeyUsageExtRule .........................................................197

6 Netscape Certificate Management System Plug-ins Guide • October 2001
ObjSignCertKeyUsageExtRule ....................................................... 199
CRLSignCertKeyUsageExt........................................................... 200
NameConstraintsExtPlug-inModule .................................................... 200
ConfigurationParametersofNameConstraintsExt ...................................... 201
NameConstraintsExtRule ........................................................... 208
NSCCommentExtPlug-inModule....................................................... 209
ConfigurationParametersofNSCCommentExt......................................... 210
NSCCommentExtRule .............................................................. 212
NSCertTypeExtPlug-inModule......................................................... 213
ConfigurationParametersofNSCertTypeExt........................................... 216
NSCertTypeExtRule................................................................ 218
OCSPNoCheckExtPlug-inModule ...................................................... 218
ConfigurationParametersofOCSPNoCheckExt ........................................ 220
OCSPNoCheckExtRule ............................................................. 221
PolicyConstraintsExtPlug-inModule .................................................... 222
ConfigurationParametersofPolicyConstraintsExt ...................................... 222
PolicyConstraintsExtRule ........................................................... 225
PolicyMappingsExtPlug-inModule ..................................................... 225
ConfigurationParametersofPolicyMappingsExt ....................................... 226
PolicyMappingsExtRule ............................................................ 229
PrivateKeyUsagePeriodExtPlug-inModule .............................................. 229
ConfigurationParametersofPrivateKeyUsagePeriodExt ................................ 230
RemoveBasicConstraintsExtPlug-inModule.............................................. 231
ConfigurationParametersofRemoveBasicConstraintsExt................................ 232
SubjectAltNameExtPlug-inModule ..................................................... 233
ConfigurationParametersofSubjectAltNameExt ....................................... 235
SubjectAltNameExtRule ............................................................ 238
SubjectDirectoryAttributesExtPlug-inModule ............................................ 239
ConfigurationParametersofSubjectDirectoryAttributesExt .............................. 240
SubjectKeyIdentifierExtPlug-inModule.................................................. 243
ConfigurationParametersofSubjectKeyIdentifierExt.................................... 244
SubjectKeyIdentifierExtRule......................................................... 246
Chapter 5 MapperPlug-inModules ............................................ 249
OverviewofMapperModules .......................................................... 250
LdapCaSimpleMapPlug-inModule ..................................................... 253
ConfigurationParametersofLdapCaSimpleMap ....................................... 254
LdapCaCertMapMapper............................................................ 256
LdapCrlMapMapper ............................................................... 257
LdapDNCompsMapPlug-inModule .................................................... 257
ConfigurationParametersofLdapDNCompsMap ...................................... 260
LdapDNExactMapPlug-inModule...................................................... 262
ConfigurationParametersofLdapDNExactMap........................................ 263

7
LdapSimpleMapPlug-inModule ........................................................263
ConfigurationParametersofLdapSimpleMap ..........................................264
LdapUserCertMapMapper ..........................................................265
LdapSubjAttrMapPlug-inModule.......................................................266
ConfigurationParametersofLdapSubjAttrMap.........................................266
Chapter 6 PublisherPlug-inModules .......................................... 269
OverviewofPublisherModules .........................................................270
FileBasedPublisherPlug-inModule ......................................................272
ConfigurationParametersofFileBasedPublisher ........................................272
LdapCaCertPublisherPlug-inModule....................................................273
ConfigurationParametersofLdapCaCertPublisher......................................274
LdapCaCertPublisherPublisher ......................................................275
LdapUserCertPublisherPlug-inModule..................................................275
ConfigurationParametersofLdapUserCertPublisher....................................276
LdapUserCertPublisherPublisher.....................................................277
LdapCrlPublisherPlug-inModule .......................................................277
ConfigurationParametersofLdapCrlPublisher .........................................278
LdapCrlPublisherPublisher..........................................................279
OCSPPublisherPlug-inModule .........................................................279
ConfigurationParametersofOCSPPublisher ...........................................279
Chapter 7 CRL Extension Plug-in Modules . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 281
OverviewofCRLExtensionModules ....................................................282
AuthorityKeyIdentifierRule ............................................................283
CRLNumberRule .....................................................................285
CRLReasonRule ......................................................................286
HoldInstructionRule ..................................................................288
InvalidityDate Rule . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 289
IssuerAlternativeNameRule ............................................................291
IssuingDistributionPointRule...........................................................295
Chapter 8 LogPlug-inModules ............................................... 299
OverviewofLogModules ..............................................................299
filePlug-inModule ....................................................................301
ConfigurationParametersoffile ......................................................302
AuditLogEventListener ............................................................304
ErrorLogEventListener.............................................................305
SystemLogEventListener ...........................................................306
NTEventLogPlug-inModule ...........................................................306
ConfigurationParametersofNTEventLog .............................................307
NTAuditEventListener .............................................................309

8 Netscape Certificate Management System Plug-ins Guide • October 2001
NTSystemEventListener............................................................ 309
Appendix A DistinguishedNames ............................................. 311
WhatIsaDistinguishedName? ......................................................... 311
DistinguishedNameComponents .................................................... 312
RootDistinguishedName......................................................... 313
BaseDistinguishedName......................................................... 313
DNsinCertificateManagementSystem .................................................. 314
ExtendingAttributeSupport......................................................... 316
AddingNeworProprietaryAttributes ............................................. 317
AddingAttributestoanEnrollmentForm........................................... 318
ChangingtheDEREncodingOrder ................................................ 320
RoleofDistinguishedNamesinCertificates............................................ 321
DNsinEnd-EntityCertificates..................................................... 322
DNsinCACertificates ........................................................... 322
SelectingDNsforCertificates...................................................... 323
DNPatternsandCertificateSubjectNames.......................................... 323
Appendix B ObjectIdentifiers................................................. 327
What’sanObjectIdentifier? ............................................................ 327
RegistrationofObjectIdentifiers ........................................................ 328
Appendix C CertificateandCRLExtensions..................................... 329
IntroductiontoCertificateExtensions .................................................... 329
StructureofCertificateExtensions .................................................... 332
SampleCertificateExtensions ........................................................ 333
RecommendationsforCertificateExtensionUse........................................... 333
StandardX.509v3CertificateExtensions ................................................. 339
authorityInfoAccess .............................................................. 341
authorityKeyIdentifier............................................................ 342
basicConstraints ................................................................. 343
certificatePolicies ................................................................ 344
cRLDistributionPoints ............................................................ 345
extKeyUsage .................................................................... 346
issuerAltName .................................................................. 348
keyUsage ....................................................................... 349
nameConstraints................................................................. 352
OCSPNocheck................................................................... 352
policyConstraints ................................................................ 353
policyMappings ................................................................. 354
privateKeyUsagePeriod........................................................... 355
subjectAltName ................................................................. 356

9
subjectDirectoryAttributes ........................................................357
subjectKeyIdentifier ..............................................................358
IntroductiontoCRLExtensions .........................................................359
StructureofCRLExtensions..........................................................359
SampleCRLandCRLEntryExtensions................................................360
StandardX.509v3CRLExtensions.......................................................361
ExtensionsforCRLs.................................................................361
authorityKeyIdentifier ............................................................362
CRLNumber.....................................................................362
deltaCRLIndicator................................................................363
issuerAltName...................................................................363
issuingDistributionPoint ..........................................................364
CRLEntryExtensions ...............................................................364
certificateIssuer ..................................................................365
holdInstructionCode..............................................................365
invalidityDate ...................................................................366
reasonCode .....................................................................366
Netscape-DefinedCertificateExtensions..................................................367
netscape-cert-type................................................................367
netscape-comment ...............................................................368
CACertificatesandExtensionInteractions................................................368
Index ....................................................................... 371

10 Netscape Certificate Management System Plug-ins Guide • October 2001

11
About This Guide
The Plug-ins Guide provides reference information about all the plug-in modules
provided with Netscape Certificate Management System (CMS). Plug-in modules
help you configure and customize Certificate Management System, and use it for
issuing and managing certificates to various end entities, such as web browsers
(users), servers, Virtual Private Network (VPN) clients, and Cisco™ routers.
This chapter has the following sections:
• What’s in This Guide (page 11)
• What You Should Already Know (page 13)
• Conventions Used in This Guide (page 14)
• Where to Go for Related Information (page 15)
What’s in This Guide
This guide covers topics that are listed below. You should use this guide in
conjunction with the other CMS documentation, such as the one that explains how
to install and setup Certificate Management System. For a complete list of CMS
documentation, see section “Where to Go for Related Information,” available later
in this preface.
• “About This Guide” Describes what’s covered in this guide, what you should
already know, and where to look for more information.
• Chapter 1, “Authentication Plug-in Modules” Describes the plug-in modules
that you can use for authenticating end-users during certificate enrollment and
it helps you decide on the authentication method suitable for your PKI setup.

What’s in This Guide
12 Netscape Certificate Management System Plug-ins Guide • October 2001
• Chapter 2, “Job Plug-in Modules” Describes the plug-in modules that enable
you to automate certain certificate-related tasks—such as notifying agents
when a request gets queued, notifying users before their certificates expire, and
removing expired certificates from the directrory—to ease administration
overheads.
• Chapter 3, “Constraints Policy Plug-in Modules” Describes the plug-in
modules that you can use to govern the formulation of certificate content, such
as key size, signing algorithm, validity period, and so on, and issuance of
certificates.
• Chapter 4, “Certificate Extension Plug-in Modules” Describes the plug-in
modules that enable you to add standard (X.509) and proprietary certificate
extensions to certificate requests.
• Chapter 5, “Mapper Plug-in Modules” Describes the plug-in modules that
enable you to configure a Certificate Manager to locate directory entries for
publishing certificates and CRLs to the directory.
• Chapter 6, “Publisher Plug-in Modules” Describes the plug-in modules that
enable you to configure a Certificate Manager to publish certificates to the
correct attribute of the located directory entries.
• Chapter 7, “CRL Extension Plug-in Modules” Describes the plug-in modules
that enable you to configure a Certificate Manager to set CRL extensions in
CRLs before generating them and publishing them to a directory.
• Chapter 8, “Log Plug-in Modules” Describes the plug-in modules that enable
you to configure CMS logs.
Appendixes
• Appendix A, “Distinguished Names” Briefly explains what are distinguished
names (DNs) and describes how DNs are used in Certificate Management
System.
• Appendix B, “Object Identifiers” Briefly explains what are object identifiers
(OIDs) and describes significance of registering OIDs.
• Appendix C, “Certificate and CRL Extensions” Summarizes the standard
certificate and CRL extensions defined by X.509 version 3 and the extensions
defined by Netscape before this version was finalized. Recommends
extensions to use with specific kinds of certificates, including both PKIX Part 1
recommendations and Netscape extensions that must be supported to
maintain compatibility with early versions of Netscape products.

What You Should Already Know
About This Guide 13
What You Should Already Know
This guide is intended for experienced system administrators who are planning to
deploy Certificate Management System. CMS agents should refer to CMS Agent’s
Guide for information on how to perform agent tasks, such as handling certificate
requests and revoking certificates.
This guide assumes that you
• Are familiar with the basic concepts of public-key cryptography and the Secure
Sockets Layer (SSL) protocol.
❍SSL cipher suites
❍The purpose of and major steps in the SSL handshake
• Understand the concepts of intranet, extranet, and the Internet security and the
role of digital certificates in a secure enterprise. These include the following
topics:
❍Encryption and decryption
❍Public keys, private keys, and symmetric keys
❍Significance of key lengths
❍Digital signatures
❍Digital certificates, including various types of digital certificates
❍The role of digital certificates in a public-key infrastructure (PKI)
❍Certificate hierarchies
If you are new to these concepts, we recommend that you read the
security-related appendixes ( Appendix D and Appendix E ) of the
accompanying manual, Managing Servers with Netscape Console.
• Are familiar with the role of Netscape Console in managing Netscape version
4.x servers. Otherwise, see the accompanying manual, Managing Servers with
Netscape Console.
• Are reading this guide in conjunction with the documentation listed in section
“Where to Go for Related Information” on page 15.

Conventions Used in This Guide
14 Netscape Certificate Management System Plug-ins Guide • October 2001
Conventions Used in This Guide
The following conventions are used in this guide:
•Monospaced font—Thistypefaceisusedforanytextthatappearsonthe
computer screen or text that you should type. It’s also used for filenames,
functions, and examples.
Example: Server Root is the directory where the CMS binaries are kept.
•Italic—Italic type is used for emphasis, book titles, and glossary terms.
Example: This control depends on the access permissions the superadministrator
has set up for you.
• Text within “quotation marks”—Indicates cross-references to other topics
within this guide.
Example: For more information, see “Issuing a Certificate to a New User” on
page 154.
•Boldface—Boldface type is used for various UI components such as captions
and field names, and the terminology explained in the glossary, which can be
found in CMS Installation and Setup Guide.
Example:
Rotation frequency. From the drop-down list, select the interval at which the
server should rotate the active error log file. The available choices are Hourly,
Daily, Weekly, Monthly, and Yearly. The default selection is Monthly.
•Monospaced [ ]—Square brackets enclose commands that are optional.
Example: PrettyPrintCert <input_file> [<output_file>]
<input_file> specifies the path to the file that contains the base-64
encoded certificate.
<output_file> specifies the path to the file to write the certificate. This
argument is optional; if you don’t specify an output file, the certificate
information is written to the standard output.
•Monospaced <>—Angle brackets enclose variables or placeholders. When
following examples, replace the angle brackets and their text with text that
applies to your situation. For example, when path names appear in angle
brackets, substitute the path names used on your computer.
Example: Using Netscape Communicator 4.7x or later, enter the URL for the
agent interface: https://<hostname>:<port_number>

Where to Go for Related Information
About This Guide 15
•/—A slash is used to separate directories in a path. If you use the Windows NT
operating system, you should replace / with \ in paths.
Example: Except for the Security Module Database Tool, you can find all the
other command-line utilities at this location: <server_root>/bin/cert/tools
• Sidebar text—Sidebar text marks important information. Make sure you read
the information before continuing with a task.
Examples:
Where to Go for Related Information
This section summarizes the documentation that ships with Certificate
Management System, using these conventions:
•<server_root> is the directory where the CMS binaries are kept (which you
specify during installation).
•<instance_id> is the ID for this instance of Certificate Management System
(specified during installation).
The documentation set for Certificate Management System includes the following:
•Managing Servers with Netscape Console
Provides background information on basic cryptography concepts and the role
of Netscape Console.
To view the HTML version of this guide, open this file:
<server_root>/manual/en/admin/help/contents.htm
•CMS Installation and Setup Guide
Describes how to plan for, install, and administer Certificate Management
System. To access the installation and configuration information from within
the CMS Installation Wizard or from the CMS window (within Netscape
Console), click any help button.
NOTE You can use Netscape Console only when Administration Server is
up and running.
CAUTION A caution note documents a potential risk of losing data, damaging
software or hardware, or otherwise disrupting system performance.

WheretoGoforRelatedInformation
16 Netscape Certificate Management System Plug-ins Guide • October 2001
To view the HTML version of this guide, open this file:
<server_root>/manual/en/cert/setup_guide/contents.htm
To view the PDF version of this guide, open this file:
<server_root>/manual/en/cert/pdf/cms45setup.pdf
•CMS Plug-ins Guide (this guide)
Provides detailed reference information on CMS plug-ins. To access this
information from the CMS window within Netscape Console, click any help
button.
To view the HTML version of this guide, open this file:
<server_root>/manual/en/cert/plugin_guide/contents.htm
To view the PDF version of this guide, open this file:
<server_root>/manual/en/cert/pdf/cms45plugin.pdf
•CMS Command-Line Tools Guide
Provides detailed reference information on CMS tools.
To view the HTML version of this guide, open this file:
<server_root>/manual/en/cert/tools_guide/contents.htm
To view the PDF version of this guide, open this file:
<server_root>/manual/en/cert/pdf/cms45tools.pdf
•CMS Customization Guide
Provides detailed reference information on customizing the HTML-based
agent and end-entity interfaces.
To view the HTML version of this guide, open this file:
<server_root>/manual/en/cert/custom_guide/contents.htm
To view the PDF version of this guide, open this file:
<server_root>/manual/en/cert/pdf/cms45custom.pdf
•CMSAgent’sGuide
Provides detailed reference information on CMS agent interfaces. To access
this information from the Agent Services pages, click any help button.
To view the HTML version of this guide, open this file:
<server_root>/cert-<instance_id>/web/agent/manual/agent_guide/
contents.htm
To view the PDF version of this guide, open this file:
<server_root>/manual/en/cert/pdf/cms45agent.pdf

Where to Go for Related Information
About This Guide 17
•End-EntityHelp
Provides detailed reference information on CMS end-entity interfaces. To
access this information from the end-entity pages, click any help button.
To view the HTML version of this guide, open this file:
<server_root>/cert-<instance_id>/web/ee/manual/ee_guide/
contents.htm
For a complete list of CMS documentation, open the
<server_root>/manual/index.html file. For the latest information about
Certificate Management System, check the CMS Release Notes.
NOTE Do not change the default location of any of the HTML files; they
areusedforonlinehelp.YoumaymovethePDFfilestoanother
location.

WheretoGoforRelatedInformation
18 Netscape Certificate Management System Plug-ins Guide • October 2001

19
Chapter 1
Authentication Plug-in Modules
Netscape Certificate Management System (CMS) provides a set of authentication
plug-in modules that enable you to configure a Certificate Manager or Registration
Manager to authenticate end users, based on specified criteria, when they enroll for
a certificate. This chapter explains the authentication modules that are installed
with the Certificate Manager and Registration Manager—it lists and briefly
describes the modules and then explains each one in detail.
The chapter has the following sections:
• Overview of Authentication Modules (page 20)
• Manual Authentication (page 23)
• UidPwdDirAuth Plug-in Module (page 24)
• UidPwdPinDirAuth Plug-in Module (page 30)
• NISAuth Plug-in Module (page 37)
• PortalEnroll Plug-in Module (page 44)
• Certificate-Based Enrollment (page 52)
• Enrollment Forms (page 55)

Overview of Authentication Modules
20 Netscape Certificate Management System Plug-ins Guide • October 2001
Overview of Authentication Modules
Certificate Management System supports both manual and automated certificate
issuance.
• In the manual method of certificate issuance, end entities supply most of the
information required by the server to formulate certificate requests and issue
certificates. Manual issuance is also dependent on human agents; it requires
that all end-entity certificate requests be approved by agents before the server
can process the requests. To understand the role of an agent in your PKI, see
section “Agents” in Chapter 13, Managing Privileged Users and Groups” of
CMS Installation and Setup Guide.
• In the automated method of certificate issuance, repositories, such as
directories, supply part of the end-entity information. End entities only supply
certain information—for example, a user ID and password—contained in the
repository during certificate enrollment. The server uses this information for
authenticating end entities before retrieving information required to formulate
the certificate request from the repository.
For details on the manual method of certificate issuance, see “Manual
Authentication” on page 23. For the automated method of certificate issuance,
Certificate Management System provides a set of plug-in modules. Plug-in
modules are implemented as Java classes and are registered in the CMS
authentication framework. The Authentication Plugin Registration tab of the CMS
window (see Figure 1-1) lists all the modules and the corresponding classes that are
currently registered with a CMS instance.
Figure 1-1 Default authentication modules for end-user enrollment