Subject: Basic Cert-2-Directory mapping question

From: "Anders Rundgren" <[email-masked]>
Date: Thu, 4 Jan 2001 21:51:00 +0100

Basic question from an RDBMS-hack.

Assume you have a directory structure like

   /O=Internet/DC=COM/DC=Acme/CN=Users/CN=James A Smith

Now you have a [probably TTP-issued] certificate for this person with a DN

  CN=James Adrian Smith + SN=343434

How do you map/match such a "alien" certificate in an efficient and easy-to-adminster way
using directory technology?  The solution should support many-to-one mappings
of certificates-to-individuals.  To make it simple, ignore the issuer part.

To reduce load on the PKIX-list you may mail me directly.

Anders

---

From: Richard Levitte at Celo <[email-masked]>
Date: Sat, 06 Jan 2001 09:39:34 +0100

If I understand things correctly, you need support for one-to-many of
certificate-to-direntry, because

would map both to

	/CN=James Adrian Smith

and

	/SN=343434

If I'm incorrect, I'll gladly be corrected.

-- 
Richard Levitte			!!! New cell phone number !!!
[email-masked]

/* You might enjoy viewing the complete vCard */

---

From: Richard Levitte at Celo <[email-masked]>
Date: Sat, 06 Jan 2001 09:42:46 +0100

would map both to

	/CN=James Adrian Smith

and

	/SN=343434

---

From: Richard Levitte at Celo <[email-masked]>
Date: Sat, 06 Jan 2001 09:55:30 +0100

Sorry for the double message.  I had some trouble on my end and it looked like
the first try didn't get through...

---

From: "Anders Rundgren" <[email-masked]>
Date: Sat, 6 Jan 2001 12:38:47 +0100

Richard,

> If I'm incorrect, I'll gladly be corrected.

No, that was not exactly what I searched for.  As a side note: Regarding SN I thought that it denoted
serial number that could be used as an entity UID.

The key issue is: How do you map/match using *X500 directory technology* (in contrast
to using RDBMSs where this is a piece of cake), an arbitrary certificate with an equally arbitrary
directory entry in an efficient and standard-conformant way?

That this is not that easy is demonstrated by the fact that you (AFAIK) cannot use
anthyning but a Win2K kerberos certificate to perform a local Win2K PKI-based login.  If you have a
PKI credential (for example in a GemSAFE card) it will only be usable in one domain
which is awkward as you (as a person) may be trusted in multiple *independent* places.

####################################################################
Essentially the value of TTP-issued ID-certificates is severely reduced by such limitations.
Commercial CA vendors out there! Are you listening?
####################################################################

The request for many-to-one mappings is optional but potentially extremely useful as you
could end-up having different credentials in your PDA than in your smart card.

If my findings are correct I would say this this issue should absolutely be studied to see if there
is a feasibility to come up with a generic solution. Yet Another Standard that is.

/Anders

---

From: Richard Levitte at Celo <[email-masked]>
Date: Sun, 07 Jan 2001 02:29:54 +0100

> directory entry in an efficient and standard-conformant way?

Ah...  Eh, you got me stumped there.  You see, I was under the impression that
certificate DNs (I assume we're talking RFC2459 or X.509 certificates heer)
would map more or less directly into a X.500 directory with no trouble at all. 
But then, I don't know X.500 that well, so I may be talking out of my behind...

> which is awkward as you (as a person) may be trusted in multiple *independent* places.

I've always wondered what those "Kerberos Certificates" are, or do you mean
tickets?  They have nothing to do with PKI, since Kerberos doesn't use PKC. 
Could this not just be an IP security policy problem?  (in that case, this
discussion has nothing more to do on this list)

---

From: "Anders Rundgren" <[email-masked]>
Date: Sun, 7 Jan 2001 07:18:56 +0100

Richard,

> But then, I don't know X.500 that well, so I may be talking out of my behind...

The question rephrased: How could an RFC2459-compliant cert using an arbitrary DN map
in an equally arbitrary X.500-compliant directory?  Arbitrary could also be expressed in
this context as: The certs are not tailor-made for this particular directory.  This is what you
get if you for example buy a Swedish Electronic ID-card based on a citizen registration system
that usually have no relevance in a private company.  Still you would like to use it in that
context and the question is how?  The answer is mapping and my question was how you
do that using *directory technology* using an (hopefully) standardized method. 

> discussion has nothing more to do on this list)

No,  maybe the name is bad but I referred to the certificates that the Win2K kerberos accepts
which currently is AFAIK limited to certs issued by the domain controller CA itself (approx.)
which results in the problems noted.

Anders