eTrust CA-Top Secret Security for z/OS and OS ... - SupportConnect

Certificate Name Filtering SupportTo understand how certificate name filtering works, it is important to know afew directory concepts and to understand the models described by the X.500standard. The subject’s and issuer’s distinguished names on a certificate identifythe subject’s or issuer’s location in an X.500 directory information tree. Let’s lookat an example of a directory tree to help clarify this.In this X.500 directory information tree, Amy’s path name would be:/O=ABC Co/OU=Sales/OU=NY/OU=Dept3/CN=AmyOr, written in the address form used by eTrust CA-Top Secret:O=ABC Co.OU=Sales.OU=NY.OU=Dept3.CN=AmyThe nodes in this tree structure show that Amy works in department Dept3 inNew York in the Sales division of the ABC Co company. A user’s location in thehierarchy determines the access to resources that they have.eTrust CA-Top Secret supports this tree structure. Acids can be assigned to eachlevel at which you want to group users or they can be assigned at just one level.For example, node OU=Dept2 could be assigned to acid NYDEPT2 andOU=Dept3 could be assigned to NYDEPT3. When a user enters the system bypresenting a certificate, eTrust CA-Top Secret determines which acid to assign bymatching the subject’s distinguished name to a node name.1–74 Cookbook