Unable to match entry by X.509 certificate

• Key: DIRSERVER-715
• Type: Bug
• Status: Closed
• Resolution: Fixed
• Priority: Major
• Assignee: Alex Karasulu
• Reporter: Nikola Goran Cutura
• Component/s: ldap
• Affects Version/s: 1.0-RC3
• Fix Version/s: 1.5.0, 1.0-RC4

Description

There is an entry containing valid X.509 certificate. When I attempt to find that entry by that certificate, search fails. There are two variants of search: one uses 'userCrtificate' attribute name and the other uses 'userCrtificate;certificate' attribute name ('binary' may be specified instead of 'certiifcate' - no change). Attached are log files produced in each of the search attempts.

Case 1:

Java statement:
        NamingEnumeration results = ctx.search("ou=users,o=ActiveMQ,dc=example,dc=com", "userCertificate = {0}", new Object[] {cert}, constraints);

produces log as in file ' no-binary.log'

Case 2:

Java statement:
        NamingEnumeration results = ctx.search("ou=users,o=ActiveMQ,dc=example,dc=com", "userCertificate;binary = {0}", new Object[] {cert}, constraints);

produces log as in file 'with-binary.log'

Comments

[Ersin Er]

If possible a junit test case would also be good.

Thanks Nikola.

[Nikola Goran Cutura]

Attached are three files for testing:

test.ldif is a sample directory hierarchy I use for testing. It contains an entry with a certificate that I attempt to find.

test-export.pem is the certificate I use in this testing.

LdapTest is a jUnit test case. It tests whether the entry can be found by a text attribute (successful) and whether same entry can be found by the certificate (unsuccessful). Please update path to the certificate file before runnig the test.

Last bit's fixed by Emmanuel and we're golden. Please confirm.

[Emmanuel Lecharny]

I confirm, after modification in TwixTransformer, that it has been fixed. Thanks Alex for the great work !

[Nikola Goran Cutura]

I downloaded 1.0RC4 preview, executed LdapTest and I report the following:

when search filter is specifid as

ctx.search("ou=users,o=ActiveMQ,dc=example,dc=com", "usercertificate = {0}", new Object[] {cert}, constraints);
or
ctx.search("ou=users,o=ActiveMQ,dc=example,dc=com", "usercertificate;binary = {0}", new Object[] {cert}, constraints);

nothing is returned and the test fails.

When search filter is specified as

ctx.search("ou=users,o=ActiveMQ,dc=example,dc=com", "usercertificate = {0}", new Object[] {cert.getEncoded()}, constraints);

proper entry is returned and the test passes.

I can work with the latter though I believe the former is proper.