Actually it's the certificationAuthority object that takes the OU
objectClass, not the certificateauthorities container itself.
Since the certificationAuthority is just an auxiliary objectClass,
it needs a structural objectClass as well (every object must have
at least one structural objectClass). As far as LDAP is concerned,
you could even use some other structural objectClass (In looking
for information about this, I've found some people use the
applicationEntity or person classes as well.) This is similar to
the macosxodconfig object in cn=config in that it's an OU
objectClass with the data stored in the description attribute.
I completely agree. However, you'll note that the CA entry in
Directory Access is mapped to "all" items in the list which
includes organizationalUnit. The other categories seem to be mapped
to "any" item in the list. WIth a default OD install you get a
cn=certificateAuthorities which won't work until you swap "all"
with "any".
My understanding was that "all" items means that DS will only return
objects in that search base (cn= certificateauthorities,…) that have
all those items as objectClasses. If there is an object with only a
class of organizationalUnit it won't return it, likewise if there is
an object that only has a class of certificationAuthority it won't
return it. But as long as the object has both classes, it'll be
returned by DS. This is what I have and it works for me in dscl
without having to modify the mappings or the default container. It
just doesn't appear in Keychain Access.
I might submit this question to Developer Technical Support and see
if they know how to get Keychain Access to see it.
--
John Anthony Grigutis
User Support Specialist III
Apple Certified (ACHDS/ACSA)
Indiana University : UITS : STC : Macintosh/Unix Team
_______________________________________________
Do not post admin requests to the list. They will be ignored.
Macos-x-server mailing list (email@hidden)
Help/Unsubscribe/Update your Subscription:
http://lists.apple.com/mailman/options/macos-x-server/email@hidden
This email sent to email@hidden
