Policy Server Guides › Policy Design Guide › Authentication Schemes › Certificate Mapping › Custom Mapping Expressions › EnableCustomExprOnly Registry Key

EnableCustomExprOnly Registry Key

When you create a custom certificate mapping for an LDAP user directory, the resulting search query string includes the LDAP User DN Lookup Start and End strings in addition to the Mapping Expression that you specify on the Create Certificate Mapping pane. The resulting query is invalid, as seen in the following example:

LDAP User DN Lookup Start

(samAccountName=

LDAP User DN Lookup End

)

Certificate Mapping Expression

(mail=%{E})

Resulting Search Query

(samAccountName=(mail=%{E}))

To omit the User DN Lookup Start and End strings from the search query, navigate to \Netegrity\SiteMinder\CurrentVersion\PolicyServer\ and set the EnableCustomExprOnly registry key to 1. The resulting search query string is valid, as seen in this example:

Certificate Mapping Expression

mail=%{E}

Resulting Search Query

mail=%{E}

Note: If the EnableCustomExprOnly registry key is 0 (the default) or the key does not exist, the User DN Lookup Start and End strings are included in the resulting search query.