Netscape NETSCAPE MANAGEMENT SYSTEM 6.01 - PLUG-IN User manual

Plug-Ins Guide
Netscape Certificate Management System
Version6.01
May 2002

Netscape Communications Corporation ("Netscape") and its licensors retain all ownership rights to the software programs offered by
Netscape (referred to herein as "Software") and related documentation. Use of the Software and related documentation is governed
by the license agreement for the Software and applicable copyright law.
Your right to copy this documentation is limited by copyright law. Making unauthorized copies, adaptations or compilation works is
prohibited and constitutes a punishable violation of the law. Netscape may revise this documentation from time to time without
notice.
THIS DOCUMENTATION IS PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND. IN NO EVENT SHALL NETSCAPE BE
LIABLE FOR INDIRECT, SPECIAL, INCIDENTAL, OR CONSEQUENTIAL DAMAGES OF ANY KIND ARISING FROM ANY
ERROR IN THIS DOCUMENTATION, INCLUDING WITHOUT LIMITATION ANY LOSS OR INTERRUPTION OF BUSINESS,
PROFITS, USE, OR DATA.
The Software and documentation are copyright © 2001 Sun Microsystems, Inc. Portions copyright 1999, 2002 Netscape
Communications Corporation. All rights reserved.
Netscape and the Netscape N logo are registered trademarks of Netscape Communications Corporation in the United States and
other countries. Other Netscape logos, product names, and service names are also trademarks of Netscape Communications
Corporation, which may be registered in some countries. Other product and brand names are the exclusive property of their
respective owners.
The downloading, exporting, or reexporting of Netscape software or any underlying information or technology must be in full
compliance with all United States and other applicable laws and regulations. Any provision of Netscape software or documentation
to the U.S. government is with restricted rights as described in the license agreement for that Software.

3
Contents
AboutThisGuide.............................................................. 11
What’sinThisGuide....................................................................11
WhatYouShouldAlreadyKnow .........................................................13
ConventionsUsedinThisGuide .........................................................14
WheretoGoforRelatedInformation......................................................15
Chapter 1 AuthenticationPlug-inModules ....................................... 17
OverviewofAuthenticationModules .....................................................18
ManualAuthentication..................................................................21
UidPwdDirAuthPlug-inModule .........................................................22
ConfigurationParametersofUidPwdDirAuth ...........................................24
UidPwdPinDirAuthPlug-inModule ......................................................28
ConfigurationParametersofUidPwdPinDirAuth ........................................29
NISAuthPlug-inModule ................................................................35
ConfigurationParametersofNISAuth ..................................................37
PortalEnrollPlug-inModule .............................................................42
ConfigurationParametersofPortalAuth ................................................45
Certificate-BasedEnrollment.............................................................50
EnrollmentForms ......................................................................53
CustomizingEnrollmentFormsforGeneratingDSAKeyPairs.............................58
GeneratingFilesRequiredByThird-PartyObjectSigningTools ............................59
Chapter 2 JobPlug-inModules ................................................ 63
OverviewofJobPlug-inModules.........................................................63
RenewalNotificationJobPlug-inModule...................................................65
ConfigurationParametersofRenewalNotificationJob.....................................66
RequestInQJobPlug-inModule ..........................................................69

4 Netscape Certificate Management System Plug-Ins Guide • May 2002
ConfigurationParametersofRequestInQJob ............................................ 70
UnpublishExpiredJobPlug-inModule .................................................... 72
ConfigurationParametersofUnpublishExpiredJob ...................................... 74
ScheduleforExecutingJobs........................................................... 76
CustomizingNotificationMessages ...................................................... 77
TemplatesforSummaryNotifications .................................................. 77
CustomizingMessageTemplates ...................................................... 79
TokensAvailableinMessageTemplates ................................................ 79
TokensforRenewalNotificationMessages ........................................... 79
TokensforRequestInQueueNotificationMessages ................................... 81
TokensforDirectoryUpdateNotificationMessages ................................... 81
Chapter 3 Constraints Policy Plug-in Modules . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 83
OverviewofConstraints-SpecificPolicyModules .......................................... 84
AttributePresentConstraintsPlug-inModule............................................... 86
ConfigurationParametersofAttributePresentConstraints................................. 87
DSAKeyConstraintsPlug-inModule...................................................... 91
ConfigurationParametersofDSAKeyConstraints........................................ 92
DSAKeyRuleRule ................................................................... 94
IssuerConstraintsPlug-inModule ........................................................ 94
ConfigurationParametersofIssuerConstraints .......................................... 95
IssuerRuleRule ..................................................................... 96
KeyAlgorithmConstraintsPlug-inModule ................................................ 97
ConfigurationParametersofKeyAlgorithmConstraints................................... 97
KeyAlgRuleRule .................................................................... 99
RenewalConstraintsPlug-inModule...................................................... 99
ConfigurationParametersofRenewalConstraints....................................... 100
RenewalConstraintsRuleRule........................................................ 101
RenewalValidityConstraints Plug-in Module . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 102
ConfigurationParametersofRenewalValidityConstraints................................ 103
DefaultRenewalValidityRule Rule . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 105
RevocationConstraintsPlug-inModule .................................................. 106
ConfigurationParametersofRevocationConstraints .................................... 106
RevocationConstraintsRuleRule...................................................... 107
RSAKeyConstraintsPlug-inModule ..................................................... 108
ConfigurationParametersofRSAKeyConstraints ....................................... 108
RSAKeyRuleRule .................................................................. 110
SigningAlgorithmConstraintsPlug-inModule ............................................ 111
ConfigurationParametersofSigningAlgorithmConstraints .............................. 112
SigningAlgRuleRule................................................................ 114
SubCANameConstraintsPlug-inModule................................................. 114
ConfigurationParametersofSubCANameConstraints................................... 115
SubCANameConstraintsRule........................................................ 116

5
UniqueSubjectNameConstraintsPlug-inModule ..........................................117
ConfigurationParametersofUniqueSubjectNameConstraints ............................117
UniqueSubjectNameConstraintsRule..................................................120
ValidityConstraints Plug-in Module . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 120
ConfigurationParametersofValidityConstraints .......................................122
DefaultValidityRuleRule ............................................................125
Chapter 4 CertificateExtensionPlug-inModules................................. 127
OverviewofExtension-SpecificPolicyModules ...........................................128
AuthInfoAccessExtPlug-inModule......................................................132
ConfigurationParametersofAuthInfoAccessExt........................................134
AuthInfoAccessExtRule .............................................................140
AuthorityKeyIdentifierExtPlug-inModule ...............................................141
ConfigurationParametersofAuthorityKeyIdentifierExt .................................142
AuthorityKeyIdentifierExtRule.......................................................144
BasicConstraintsExtPlug-inModule .....................................................144
ConfigurationParametersofBasicConstraintsExt .......................................145
BasicConstraintsExtRule ............................................................147
CertificatePoliciesExtPlug-inModule ....................................................148
ConfigurationParametersofCertificatePoliciesExt ......................................149
CertificatePoliciesExtRule ...........................................................152
CertificateRenewalWindowExtPlug-inModule ...........................................153
ConfigurationParametersofCertificateRenewalWindowExt .............................154
CertificateScopeOfUseExtPlug-inModule ................................................158
ConfigurationParametersofCertificateScopeOfUseExt ..................................159
CRLDistributionPointsExtPlug-inModule................................................163
ConfigurationParametersofCRLDistributionPointsExt..................................163
CRLDistributionPointsExtRule.......................................................167
ExtendedKeyUsageExtPlug-inModule ..................................................168
ConfigurationParametersofExtendedKeyUsageExt.....................................170
CODESigningExtRule...............................................................172
OCSPSigningExtRule ...............................................................173
GenericASN1ExtPlug-inModule........................................................174
ConfigurationParametersofGenericASN1Ext ..........................................176
GenericASN1ExtRule ...............................................................181
IssuerAltNameExtPlug-inModule ......................................................181
ConfigurationParametersofIssuerAltNameExt ........................................182
KeyUsageExtPlug-inModule ...........................................................186
ConfigurationParametersofKeyUsageExt .............................................188
CMCertKeyUsageExtRule ...........................................................193
RMCertKeyUsageExtRule ...........................................................194
ServerCertKeyUsageExtRule.........................................................195
ClientCertKeyUsageExtRule .........................................................196

6 Netscape Certificate Management System Plug-Ins Guide • May 2002
ObjSignCertKeyUsageExtRule ....................................................... 198
CRLSignCertKeyUsageExt........................................................... 199
NameConstraintsExtPlug-inModule .................................................... 199
ConfigurationParametersofNameConstraintsExt ...................................... 200
NameConstraintsExtRule ........................................................... 207
NSCCommentExtPlug-inModule....................................................... 208
ConfigurationParametersofNSCCommentExt......................................... 209
NSCCommentExtRule .............................................................. 211
NSCertTypeExtPlug-inModule......................................................... 212
ConfigurationParametersofNSCertTypeExt........................................... 215
NSCertTypeExtRule................................................................ 217
OCSPNoCheckExtPlug-inModule ...................................................... 217
ConfigurationParametersofOCSPNoCheckExt ........................................ 219
OCSPNoCheckExtRule ............................................................. 220
PolicyConstraintsExtPlug-inModule .................................................... 221
ConfigurationParametersofPolicyConstraintsExt ...................................... 221
PolicyConstraintsExtRule ........................................................... 224
PolicyMappingsExtPlug-inModule ..................................................... 224
ConfigurationParametersofPolicyMappingsExt ....................................... 225
PolicyMappingsExtRule ............................................................ 228
PrivateKeyUsagePeriodExtPlug-inModule .............................................. 228
ConfigurationParametersofPrivateKeyUsagePeriodExt ................................ 229
RemoveBasicConstraintsExtPlug-inModule.............................................. 230
ConfigurationParametersofRemoveBasicConstraintsExt................................ 231
SubjectAltNameExtPlug-inModule ..................................................... 232
ConfigurationParametersofSubjectAltNameExt ....................................... 234
SubjectAltNameExtRule ............................................................ 237
SubjectDirectoryAttributesExtPlug-inModule ............................................ 238
ConfigurationParametersofSubjectDirectoryAttributesExt .............................. 239
SubjectKeyIdentifierExtPlug-inModule.................................................. 242
ConfigurationParametersofSubjectKeyIdentifierExt.................................... 243
SubjectKeyIdentifierExtRule......................................................... 245
Chapter 5 MapperPlug-inModules ............................................ 247
OverviewofMapperModules .......................................................... 248
LdapCaSimpleMapPlug-inModule ..................................................... 250
ConfigurationParametersofLdapCaSimpleMap ....................................... 252
LdapCaCertMapMapper............................................................ 254
LdapCrlMapMapper ............................................................... 254
LdapDNCompsMapPlug-inModule .................................................... 254
ConfigurationParametersofLdapDNCompsMap ...................................... 257
LdapDNExactMapPlug-inModule...................................................... 260
ConfigurationParametersofLdapDNExactMap........................................ 260

7
LdapSimpleMapPlug-inModule ........................................................261
ConfigurationParametersofLdapSimpleMap ..........................................262
LdapUserCertMapMapper ..........................................................263
LdapSubjAttrMapPlug-inModule.......................................................263
ConfigurationParametersofLdapSubjAttrMap.........................................264
Chapter 6 PublisherPlug-inModules .......................................... 267
OverviewofPublisherModules .........................................................268
FileBasedPublisherPlug-inModule ......................................................270
ConfigurationParametersofFileBasedPublisher ........................................270
LdapCaCertPublisherPlug-inModule....................................................271
ConfigurationParametersofLdapCaCertPublisher......................................272
LdapCaCertPublisherPublisher ......................................................273
LdapUserCertPublisherPlug-inModule..................................................273
ConfigurationParametersofLdapUserCertPublisher....................................274
LdapUserCertPublisherPublisher.....................................................275
LdapCrlPublisherPlug-inModule .......................................................275
ConfigurationParametersofLdapCrlPublisher .........................................276
LdapCrlPublisherPublisher..........................................................277
OCSPPublisherPlug-inModule .........................................................277
ConfigurationParametersofOCSPPublisher ...........................................277
Chapter 7 CRL Extension Plug-in Modules . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 279
OverviewofCRLExtensionModules ....................................................280
AuthorityKeyIdentifierRule ............................................................281
CRLNumberRule .....................................................................283
CRLReasonRule ......................................................................284
HoldInstructionRule ..................................................................286
InvalidityDate Rule . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 287
IssuerAlternativeNameRule ............................................................289
IssuingDistributionPointRule...........................................................293
Chapter 8 LogPlug-inModules ............................................... 297
OverviewofLogModules ..............................................................297
filePlug-inModule ....................................................................299
ConfigurationParametersoffile ......................................................300
AuditLogEventListener ............................................................302
ErrorLogEventListener.............................................................303
SystemLogEventListener ...........................................................304
NTEventLogPlug-inModule ...........................................................304
ConfigurationParametersofNTEventLog .............................................305
NTAuditEventListener .............................................................307

8 Netscape Certificate Management System Plug-Ins Guide • May 2002
NTSystemEventListener............................................................ 307
Appendix A DistinguishedNames ............................................. 309
WhatIsaDistinguishedName? ......................................................... 309
DistinguishedNameComponents .................................................... 310
RootDistinguishedName......................................................... 311
BaseDistinguishedName......................................................... 311
DNsinCertificateManagementSystem .................................................. 312
ExtendingAttributeSupport......................................................... 314
AddingNeworProprietaryAttributes ............................................. 315
AddingAttributestoanEnrollmentForm........................................... 316
ChangingtheDEREncodingOrder ................................................ 318
RoleofDistinguishedNamesinCertificates............................................ 319
DNsinEnd-EntityCertificates..................................................... 320
DNsinCACertificates ........................................................... 320
SelectingDNsforCertificates...................................................... 321
DNPatternsandCertificateSubjectNames.......................................... 321
Appendix B ObjectIdentifiers................................................. 325
What’sanObjectIdentifier? ............................................................ 325
RegistrationofObjectIdentifiers ........................................................ 325
Appendix C CertificateandCRLExtensions..................................... 327
IntroductiontoCertificateExtensions .................................................... 327
StructureofCertificateExtensions .................................................... 330
SampleCertificateExtensions ........................................................ 331
RecommendationsforCertificateExtensionUse........................................... 331
StandardX.509v3CertificateExtensions ................................................. 337
authorityInfoAccess .............................................................. 339
authorityKeyIdentifier............................................................ 340
basicConstraints ................................................................. 341
certificatePolicies ................................................................ 342
cRLDistributionPoints ............................................................ 343
extKeyUsage .................................................................... 344
issuerAltName .................................................................. 347
keyUsage ....................................................................... 348
nameConstraints................................................................. 350
OCSPNocheck................................................................... 351
policyConstraints ................................................................ 352
policyMappings ................................................................. 353
privateKeyUsagePeriod........................................................... 353
subjectAltName ................................................................. 354

9
subjectDirectoryAttributes ........................................................356
subjectKeyIdentifier ..............................................................356
IntroductiontoCRLExtensions .........................................................357
StructureofCRLExtensions..........................................................358
SampleCRLandCRLEntryExtensions................................................359
StandardX.509v3CRLExtensions.......................................................360
ExtensionsforCRLs.................................................................360
authorityKeyIdentifier ............................................................361
CRLNumber.....................................................................361
deltaCRLIndicator................................................................362
issuerAltName...................................................................363
issuingDistributionPoint ..........................................................363
CRLEntryExtensions ...............................................................364
certificateIssuer ..................................................................364
holdInstructionCode..............................................................365
invalidityDate ...................................................................365
reasonCode .....................................................................366
Netscape-DefinedCertificateExtensions..................................................366
netscape-cert-type................................................................367
netscape-comment ...............................................................368
CACertificatesandExtensionInteractions................................................368
Index ....................................................................... 371

10 Netscape Certificate Management System Plug-Ins Guide • May 2002

11
About This Guide
The Plug-Ins Guide provides reference information about all the plug-in modules
provided with Netscape Certificate Management System (CMS). Plug-in modules
help you configure and customize Certificate Management System, and use it for
issuing and managing certificates to various end entities, such as web browsers
(users), servers, Virtual Private Network (VPN) clients, and Cisco™ routers.
This chapter has the following sections:
• What’s in This Guide (page 11)
• What You Should Already Know (page 13)
• Conventions Used in This Guide (page 14)
• Where to Go for Related Information (page 15)
What’s in This Guide
This guide covers topics that are listed below. You should use this guide in
conjunction with the other CMS documentation, such as the one that explains how
to install and setup Certificate Management System. For a complete list of CMS
documentation, see section “Where to Go for Related Information,” available later
in this preface.
• “About This Guide” Describes what’s covered in this guide, what you should
already know, and where to look for more information.
• Chapter 1, “Authentication Plug-in Modules” Describes the plug-in modules
that you can use for authenticating end-users during certificate enrollment and
it helps you decide on the authentication method suitable for your PKI setup.

What’s in This Guide
12 Netscape Certificate Management System Plug-Ins Guide • May 2002
• Chapter 2, “Job Plug-in Modules” Describes the plug-in modules that enable
you to automate certain certificate-related tasks—such as notifying agents
when a request gets queued, notifying users before their certificates expire, and
removing expired certificates from the directrory—to ease administration
overheads.
• Chapter 3, “Constraints Policy Plug-in Modules” Describes the plug-in
modules that you can use to govern the formulation of certificate content, such
as key size, signing algorithm, validity period, and so on, and issuance of
certificates.
• Chapter 4, “Certificate Extension Plug-in Modules” Describes the plug-in
modules that enable you to add standard (X.509) and proprietary certificate
extensions to certificate requests.
• Chapter 5, “Mapper Plug-in Modules” Describes the plug-in modules that
enable you to configure a Certificate Manager to locate directory entries for
publishing certificates and CRLs to the directory.
• Chapter 6, “Publisher Plug-in Modules” Describes the plug-in modules that
enable you to configure a Certificate Manager to publish certificates to the
correct attribute of the located directory entries.
• Chapter 7, “CRL Extension Plug-in Modules” Describes the plug-in modules
that enable you to configure a Certificate Manager to set CRL extensions in
CRLs before generating them and publishing them to a directory.
• Chapter 8, “Log Plug-in Modules” Describes the plug-in modules that enable
you to configure CMS logs.
Appendixes
• Appendix A, “Distinguished Names” Briefly explains what are distinguished
names (DNs) and describes how DNs are used in Certificate Management
System.
• Appendix B, “Object Identifiers” Briefly explains what are object identifiers
(OIDs) and describes significance of registering OIDs.
• Appendix C, “Certificate and CRL Extensions” Summarizes the standard
certificate and CRL extensions defined by X.509 version 3 and the extensions
defined by Netscape before this version was finalized. Recommends
extensions to use with specific kinds of certificates, including both PKIX Part 1
recommendations and Netscape extensions that must be supported to
maintain compatibility with early versions of Netscape products.

What You Should Already Know
About This Guide 13
What You Should Already Know
This guide is intended for experienced system administrators who are planning to
deploy Certificate Management System. CMS agents should refer to CMS Agent’s
Guide for information on how to perform agent tasks, such as handling certificate
requests and revoking certificates.
This guide assumes that you
• Are familiar with the basic concepts of public-key cryptography and the Secure
Sockets Layer (SSL) protocol.
❍SSL cipher suites
❍The purpose of and major steps in the SSL handshake
• Understand the concepts of intranet, extranet, and the Internet security and the
role of digital certificates in a secure enterprise. These include the following
topics:
❍Encryption and decryption
❍Public keys, private keys, and symmetric keys
❍Significance of key lengths
❍Digital signatures
❍Digital certificates, including various types of digital certificates
❍The role of digital certificates in a public-key infrastructure (PKI)
❍Certificate hierarchies
If you are new to these concepts, we recommend that you read the
security-related appendixes of the accompanying manual, Managing Servers
with Netscape Console.
• Are familiar with the role of Netscape Console in managing Netscape servers.
Otherwise, see the accompanying manual, Managing Servers with Netscape
Console.
• Are reading this guide in conjunction with the documentation listed in section
“Where to Go for Related Information” on page 15.

Conventions Used in This Guide
14 Netscape Certificate Management System Plug-Ins Guide • May 2002
Conventions Used in This Guide
The following conventions are used in this guide:
•Monospaced font—Thistypefaceisusedforanytextthatappearsonthe
computer screen or text that you should type. It’s also used for filenames,
functions, and examples.
Example: Server Root is the directory where the CMS binaries are kept.
•Italic—Italic type is used for emphasis, book titles, and glossary terms.
Example: This control depends on the access permissions the superadministrator
has set up for you.
• Text within “quotation marks”—Indicates cross-references to other topics
within this guide.
Example: For more information, see “Issuing a Certificate to a New User” on
page 154.
•Boldface—Boldface type is used for various UI components such as captions
and field names, and the terminology explained in the glossary, which can be
found in CMS Installation and Setup Guide.
Example:
Rotation frequency. From the drop-down list, select the interval at which the
server should rotate the active error log file. The available choices are Hourly,
Daily, Weekly, Monthly, and Yearly. The default selection is Monthly.
•Monospaced [ ]—Square brackets enclose commands that are optional.
Example: PrettyPrintCert <input_file> [<output_file>]
<input_file> specifies the path to the file that contains the base-64
encoded certificate.
<output_file> specifies the path to the file to write the certificate. This
argument is optional; if you don’t specify an output file, the certificate
information is written to the standard output.
•Monospaced <>—Angle brackets enclose variables or placeholders. When
following examples, replace the angle brackets and their text with text that
applies to your situation. For example, when path names appear in angle
brackets, substitute the path names used on your computer.
Example: Using Netscape Communicator 4.7x or later, enter the URL for the
agent interface: https://<hostname>:<port_number>

Where to Go for Related Information
About This Guide 15
•/—A slash is used to separate directories in a path. If you use the Windows NT
operating system, you should replace / with \ in paths.
Example: Except for the Security Module Database Tool, you can find all the
other command-line utilities at this location: <server_root>/bin/cert/tools
• Sidebar text—Sidebar text marks important information. Make sure you read
the information before continuing with a task.
Examples:
Where to Go for Related Information
This section summarizes the documentation that ships with Certificate
Management System, using these conventions:
•<server_root> is the directory where the CMS binaries are kept (which you
specify during installation).
•<instance_id> is the ID for this instance of Certificate Management System
(specified during installation).
The documentation set for Certificate Management System includes the following:
•Managing Servers with Netscape Console
Provides background information on basic cryptography concepts and the role
of Netscape Console. To view the HTML version of this guide, open this file:
<server_root>/manual/en/admin/ag/contents.htm
•CMS Installation and Setup Guide
Describes how to plan for, install, and administer Certificate Management
System. To access the installation and configuration information from within
the CMS Installation Wizard or from the CMS window (within Netscape
Console), click any help button. To view the HTML version of this guide, open
this file: <server_root>/manual/en/cert/setup_guide/contents.htm
NOTE You can use Netscape Console only when Administration Server is
up and running.
CAUTION A caution note documents a potential risk of losing data, damaging
software or hardware, or otherwise disrupting system performance.

WheretoGoforRelatedInformation
16 Netscape Certificate Management System Plug-Ins Guide • May 2002
•CMS Plug-Ins Guide (this guide)
Provides detailed reference information on CMS plug-ins. To access this
information from the CMS window within Netscape Console, click any help
button. To view the HTML version of this guide, open this file:
<server_root>/manual/en/cert/plugin_guide/contents.htm
•CMS Command-Line Tools Guide
Provides detailed reference information on CMS tools. To view the HTML
version of this guide, open this file:
<server_root>/manual/en/cert/tools_guide/contents.htm
•CMS Customization Guide
Provides detailed reference information on customizing the HTML-based
agent and end-entity interfaces. To view the HTML version of this guide, open
this file: <server_root>/manual/en/cert/custom_guide/contents.htm
•CMSAgent’sGuide
Provides detailed reference information on CMS agent interfaces. To access
this information from the Agent Services pages, click any help button. To view
the HTML version of this guide, open this file:
<server_root>/cert-<instance_id>/web-apps/agent/manual/agent_gui
de/contents.htm
•End-EntityHelp
Provides detailed reference information on CMS end-entity interfaces. To
access this information from the end-entity pages, click any help button. To
view the HTML version of this guide, open this file:
<server_root>/cert-<instance_id>/web-apps/ee/manual/ee_guide/con
tents.htm
For a complete list of CMS documentation that gets installed with the product,
open the <server_root>/manual/index.html file. For the latest information
about Certificate Management System, check the CMS Release Notes and other
documents available at this site:
http://enterprise.netscape.com/docs/cms/index.html

17
Chapter 1
Authentication Plug-in Modules
Netscape Certificate Management System (CMS) provides a set of authentication
plug-in modules that enable you to configure a Certificate Manager or Registration
Manager to authenticate end users, based on specified criteria, when they enroll for
a certificate. This chapter explains the authentication modules that are installed
with the Certificate Manager and Registration Manager—it lists and briefly
describes the modules and then explains each one in detail.
The chapter has the following sections:
• Overview of Authentication Modules (page 18)
• Manual Authentication (page 21)
• UidPwdDirAuth Plug-in Module (page 22)
• UidPwdPinDirAuth Plug-in Module (page 28)
• NISAuth Plug-in Module (page 35)
• PortalEnroll Plug-in Module (page 42)
• Certificate-Based Enrollment (page 50)
• Enrollment Forms (page 53)

Overview of Authentication Modules
18 Netscape Certificate Management System Plug-Ins Guide • May 2002
Overview of Authentication Modules
Certificate Management System supports both manual and automated certificate
issuance.
• In the manual method of certificate issuance, end entities supply most of the
information required by the server to formulate certificate requests and issue
certificates. Manual issuance is also dependent on human agents; it requires
that all end-entity certificate requests be approved by agents before the server
can process the requests. To understand the role of an agent in your PKI, see
section “Agents” in Chapter 13, Managing Privileged Users and Groups” of
CMS Installation and Setup Guide.
• In the automated method of certificate issuance, repositories, such as
directories, supply part of the end-entity information. End entities only supply
certain information—for example, a user ID and password—contained in the
repository during certificate enrollment. The server uses this information for
authenticating end entities before retrieving information required to formulate
the certificate request from the repository.
For details on the manual method of certificate issuance, see “Manual
Authentication” on page 21. For the automated method of certificate issuance,
Certificate Management System provides a set of plug-in modules. Plug-in
modules are implemented as Java classes and are registered in the CMS
authentication framework. The Authentication Plugin Registration tab of the CMS
window (see Figure 1-1) lists all the modules and the corresponding classes that are
currently registered with a CMS instance.
Figure 1-1 Default authentication modules for end-user enrollment

Overview of Authentication Modules
Chapter 1 Authentication Plug-in Modules 19
Table 1-1 lists the authentication modules provided for the Certificate Manager and
Registration Manager; no authentication modules are provided for the Data
Recovery Manager as it does not function as an enrollment authority in a PKI. You
can use these modules to configure a Certificate Manager and Registration
Manager to employ a specific authentication method during certificate
enrollments.
Note that the name of the Java class for an authentication plug-in is in this format:
com.netscape.cms.authentication.<plugin_name>
where <plugin_name> is the name of a plug-in module. For example, the Java class
for the UidPwdDirAuth module would be:
com.netscape.cms.authentication.UidPwdDirAuthentication
Because large corporations typically store corporatewide user, group, and
network-resource data in LDAP-compliant directories, the default authentication
modules provided for automated certificate enrollment use an LDAP directory for
authenticating users or for formulating certificate subject names, or for both. If you
already have an LDAP-compliant directory, such as Netscape Directory Server,
with end-user data, you can use that directory for any of the purposes mentioned
above. For example, if you have an NIS server and LDAP directory installations,
you can use the NIS server for authenticating end users and the directory for
formulating certificate subject names; end users will be required to provide only
their NIS user IDs and passwords during enrollment.
Table 1-1 Authentication plug-in modules for end user certificate enrollments
Plug-in module name Function
NISAuth Authenticates end users based on their user IDs and passwords stored in a NIS
server. Optionally, uses an LDAP directory for formulating certificate subject
names. For details, see “NISAuth Plug-in Module” on page 35.
PortalEnroll Authenticates online service users based on their user IDs and passwords stored
in an LDAP directory. Also registers new users for the online service. For details,
see “PortalEnroll Plug-in Module” on page 42.
UidPwdDirAuth Authenticates end users based on their user IDs and passwords stored in an
LDAP directory. For details, see “UidPwdDirAuth Plug-in Module” on page 22.
UidPwdPinDirAuth Authenticates end users based on their user IDs, passwords, and PINs stored in
an LDAP directory. For details, see “UidPwdPinDirAuth Plug-in Module” on
page 28.

Overview of Authentication Modules
20 Netscape Certificate Management System Plug-Ins Guide • May 2002
If you don’t have a directory deployed, you may use the Netscape Directory Server
instance created at the time of CMS installation; in the documentation, this instance
is identified as the Configuration Directory. For a demonstration on how to use this
directory for issuing certificates to end users, see Chapter 3, “Default Demo
Installation” of CMS Installation and Setup Guide.
If you determine that the default authentication modules do not meet your
requirements, you can develop a custom authentication module using the CMS
SDK, which is available in the form of Javadocs at this location:
<server_root>/cms_sdk/cms_jdk/javadoc
For general guidelines on developing custom authentication modules and adding
them to the CMS authentication framework, check the tutorials on authentication.
Be sure to take a look at the authentication-specific samples available at this
location: <server_root>/cms_sdk/cms_jdk/samples/authentication
For instructions on how to configure a Certificate Manager and a Registration
Manager to use one or more of the authentication methods, see section
“Configuring Authentication for End-User Enrollment” in Chapter 15, “Setting Up
End-User Authentication” of CMS Installation and Setup Guide.
Keep in mind that in an automated certificate management setup, the Certificate
Manager and Registration Manager use the configured authentication methods
only during certificate enrollment. During certificate renewal, the servers rely on
end users SSL client certificate for automated renewal. For automated revocation,
the users can use their SSL-client certificate or a challenge password. For more
information, see sections “Authentication for End Users During Certificate
Renewal” and “Authentication for End Users During Certificate Revocation” in
Chapter 15, “Setting Up End-User Authentication” of CMS Installation and Setup
Guide.
Certificate Management System also provides HTML forms-based interfaces for all
the authentication methods it supports. Your end entities can use these forms for
certificate enrollment. Explanation of each enrollment form, along with the
corresponding authentication module, is covered in “Enrollment Forms” on
page 53. Certificate renewal and revocation forms are covered as a part of those
processes. For details on individual form elements in the enrollment, renewal, and
revocation forms, see the online help available by clicking the Help buttons on the
HTML forms. You can also customize these forms to suit to your organization’s
requirements. For customization information, see CMS Customization Guide.