I don't find the following answer given on the discuss list to be acceptable. 
The middleware (that is, us) should hide any anomalies in the toolkits on 
which we depend.

BTW, I recommend emailAddress= throughout.

/Olle

-----Original Message-----
From: Samuel Meder
Sent: Wednesday, March 31, 2004 16:53
To: Masahiro Ito
Cc: discuss@globus.org
Subject: Re: [Globus-discuss] User certificate subject (DN)
withEmailAddress


On Wed, 2004-03-31 at 06:11, Masahiro Ito wrote:
> Hi all,
> 
> I have a touble with the user certificates that contain EmailAddress in the
> subject.
> 
> If my user certificate's subject is
> "/C=JP/O=myhome/CN=Masahiro ITO/Email=itou_masahiro2002@ybb.ne.jp",
> I must describe DN in grid-mapfile as following (otherwise the operations
> will be failure):
> 
> (1) To use WS in GT3.0.2 and GT3.2beta
> "/C=JP/O=myhome/CN=Masahiro ITO/E=itou_masahiro2002@ybb.ne.jp"  masahiro
> 
> (2) To use pre-WS in GT3.0.2
> "/C=JP/O=myhome/CN=Masahiro ITO/Email=itou_masahiro2002@ybb.ne.jp"  masahiro
> 
> (3) To use pre-WS in GT3.2beta
> "/C=JP/O=myhome/CN=Masahiro ITO/emailAddress=itou_masahiro2002@ybb.ne.jp"
> masahiro
> 
> I found openssl-0.9.6 displays "Email=" and openssl-0.9.7 displays
> "emailAddress=".
> ( $ openssl x509 -subject -in certfile )
> But I don't know about "E=".
> 
> I have to use and switch three types of grid-mapfile now.
> But I'd like to use only one grid-mapfile. How to describe such DNs?
> Or shouldn't I use email-address in the certificate subject?

It's somewhat unfortunate. Adding all three entries to the same
grid-mapfile should work, so you will still only have to have one
grid-mapfile.

/Sam