Subject: subject DN vs. directory DN

From: Jari Pirhonen <[email-masked]>
Date: Thu, 29 Aug 2002 21:20:37 +0300

Hi,

What do the standards say about certificate subject DN matching the
directory object DN?

I have seen some applications, which seem to use certificate subject as
a *searchbase* to the directory, when fetching additional info. I have
heard comments that subject and directory DN *must* match. To me it
seems to be quite a tough requirement. Especially when the organization
has built the corporate directory before implementing the PKI. This
requirement could mean that  either current directory DN must be used as
a certificate subject, which may lead to quite weird subjects or DIT
must be changed according to planned certificate subject, and this may
break some directory applications. One choice of course would be to
separate PKI and corporate directories and sync data as needed.

Example.

Let's say that for some good the company has decided to use the
following DN to store directory objects: "employeeNumber=123, ou=us,
ou=people,o=company" (has attribute "cn=John Smith 123" among others).
Now, when PKI is implemented, certificate subject like "cn=John Smith
123, o=Company"  is wanted.

Are the vendors, who say that this "breaks" the standard, correct?

I have also seen applications, which are sophisticated enough to search
"cn=John Smith 123" using "ou=people,o=company"  as a searchbase, to
fetch an "uid", for example.

regards,
Jari Pirhonen

---

From: Eric Norman <[email-masked]>
Date: Thu, 29 Aug 2002 15:15:39 -0500 (CDT)

> What do the standards say about certificate subject DN matching the

There are more than standards involved.  For educational institutions
here in the US, FERPA regulations apply too.  This means that if a
student exercises her FERPA "opt out" rights, then there is information
that you can't have in the DN in a publically available directory.

The way we do this here at Wisconsin is to only include a bunch of
random gibberish in the directory DN as an identifier.  If you're
authorized, then you can use that gibberish to get attributes that
wouldn't normally be available to the whole world.  Furthermore,
it changes daily; that has interesting ramifications as far as
X.509 certificates and their DNs are concerned.

Eric Norman

		"I may be just a butterfly,
		 but watch out if I flap my wings".