MyID can maintain a single Entrust entity/user after their (distinguished) name changes; for example, due to changes to marital status.

To trigger a change of DN, use the PIV applicant editing screens in the MyID Operator Client, click the Position tab, and edit the PIV DN field. Equally an update will result from a change to First Name, Last Name, Employee ID or the person's group's Base DN.

To complete a change of DN, the person must have at least one new certificate issued.

If a person changes DN multiple times without an new certificate actually being issued, only that last change will be reflected at the CA; for example, a person who changes from Arthur Alpha to Arthur Beta to Arthur Gamma is reflected at the Certificate Authority as Arthur Alpha becoming Arthur Gamma.

If a person changes DN multiple times and a new certificate has been issued, each change is reflected at the CA; for example, a person who changes from Arthur Alpha to Arthur Beta to Arthur Gamma is reflected at the Certificate Authority as individual approved DN changes.

Entrust refuses to process a change DN request in some circumstances because the user is not in appropriate state or only has revoked certificates. It does return specific errors in those cases but MyID cannot independently correct the situation.

If for any reason MyID is unable to complete a change of DN successfully, it continues to attempt to apply the change (unless undone) in future certificate requests.

Entrust refuses to allow a change of DN for a user if that user DN has ever existed in the lifetime of the Certificate Authority, even if that user has since been archived or removed. In such cases, you must use the Entrust Security Manager Administrator utility (other Entrust tools may be available) and change the 'Allow DN reuse' setting; the default is off/deselected.

Entrust allows a change of DN only if the user is using default key expiration settings; as such, as part of the processing, MyID reverts to defaults during the user change DN. However, as soon as a certificate is issued after the change of DN, the MyID configured settings are applied – they default to MyID being in control of lifetimes.

The DN change logic can track only one DN; this DN is the main DN that is used for certificate requests; for example, Xu55. If you need your DN to be in a particular order, make sure that your DN construction trigger and group Base DN values follow the pattern expected, and do not set ReverseDN against the policies.

Note: The Track Entrust distinguished name changes option on the LDAP tab of the Operation Settings workflow does not affect this functionality; this option was added for MyID Enterprise systems, not PIV systems.