eTrust CA-Top Secret Security for z/OS and OS ... - SupportConnect

Certificate Name Filtering SupportSearch Sequence ScenarioAssume the following records exist and all are trusted. They are listed in the order inwhich they are grouped in the search table.CERTMAP(MAP001) ACID(NJDEPT1)IDNFILTR(OU=Verisign Class 1 Individual Subscriber.O=Verisign,Inc.L=Internet)SDNFILTR(OU=DEPT1.OU=NJ.OU=Sales.O=ABC Co)CERTMAP(MAP002) ACID(NJDEPTX)IDNFILTR(O=Verisign,Inc.L=Internet) SDNFILTR(OU=Sales.O=ABC Co)CERTMAP(MAP003) ACID(NYDEPT2)SDNFILTR(OU=DEPT2.OU=NY,OU=Sales.O=ABC Co)CERTMAP(MAP004) ACID(NYDEPT3)SDNFILTR(OU=DEPT3.OU=NY,OU=Sales.O=ABC Co)CERTMAP(MAP005) ACID(ABCDEPT)SDNFILTR(OU=Sales.O=ABC Co)CERTMAP(MAP006) ACID(ABCTECH)SDNFILTR(OU=R&D.O=ABC Co)CERTMAP(MAP007) ACID(MULTIID)IDNFILTR(O=Verisign,Inc.L=Internet) CRITERIA(CNFAPP=&CNFAPP)CRITMAP(CRT001) ACID(ABCCUST)CNFAPP(ABCINET)CRITMAP(CRT002) ACID(ABCDFLT)CNFAPP(*)Assume a certificate is being presented by a user whose distinguished name is:CN=Bill,OU=Dept4,OU=PA,OU=Sales,O=ABC Co. The issuer’s distinguishedname contains information about That we not VeriSign. How would we processthe search for this certificate?The first two entries don’t match, so we get to the section without an IDNF. Weloop through the SDNFs checking for a match. Then, we take off the CN from thecertificate distinguished name and compare the rest of the certificatedistinguished name against the SDNF. The sections starting with OU=Dept4 andOU=PA will not match. However, the section starting with OU=Sales willprovide a match and the ABCDEPT acid is assigned.Assume a user presents a certificate issued by VeriSign but not for ABC Co. Wewould get a match on CERTMAP MAP007, based on the IDNF information. Thenwe would search the CRITMAP records for a matching CNFAPP. If the CNFAPPwas ABCINET, then acid ABCCUST would be assigned. All other applicationswould be assigned the default acid ABCDFLT.1–80 Cookbook