Basic Cert-2-Directory mapping question

["Anders Rundgren" <anders.rundgren@xxxxxxxxx>]

Basic question from an RDBMS-hack.

Assume you have a directory structure like

   /O=Internet/DC=COM/DC=Acme/CN=Users/CN=James A Smith

Now you have a [probably TTP-issued] certificate for this person with a DN

  CN=James Adrian Smith + SN=343434

How do you map/match such a "alien" certificate in an efficient and easy-to-adminster way
using directory technology?  The solution should support many-to-one mappings
of certificates-to-individuals.  To make it simple, ignore the issuer part.

To reduce load on the PKIX-list you may mail me directly.

Anders