Unable to match entry by X.509 certificate

• Key: DIRSERVER-715
• Type: Bug
• Status: Closed
• Resolution: Fixed
• Priority: Major
• Assignee: Alex Karasulu
• Reporter: Nikola Goran Cutura
• Component/s: ldap
• Affects Version/s: 1.0-RC3
• Fix Version/s: 1.5.0, 1.0-RC4

Description

There is an entry containing valid X.509 certificate. When I attempt to find that entry by that certificate, search fails. There are two variants of search: one uses 'userCrtificate' attribute name and the other uses 'userCrtificate;certificate' attribute name ('binary' may be specified instead of 'certiifcate' - no change). Attached are log files produced in each of the search attempts.

Case 1:

Java statement:
        NamingEnumeration results = ctx.search("ou=users,o=ActiveMQ,dc=example,dc=com", "userCertificate = {0}", new Object[] {cert}, constraints);

produces log as in file ' no-binary.log'

Case 2:

Java statement:
        NamingEnumeration results = ctx.search("ou=users,o=ActiveMQ,dc=example,dc=com", "userCertificate;binary = {0}", new Object[] {cert}, constraints);

produces log as in file 'with-binary.log'

Comments

[Ersin Er]

If possible a junit test case would also be good.

Thanks Nikola.

[Nikola Goran Cutura]

Attached are three files for testing:

test.ldif is a sample directory hierarchy I use for testing. It contains an entry with a certificate that I attempt to find.

test-export.pem is the certificate I use in this testing.

LdapTest is a jUnit test case. It tests whether the entry can be found by a text attribute (successful) and whether same entry can be found by the certificate (unsuccessful). Please update path to the certificate file before runnig the test.

[Alex Karasulu]

Last bit's fixed by Emmanuel and we're golden. Please confirm.

[Emmanuel Lecharny]

I confirm, after modification in TwixTransformer, that it has been fixed. Thanks Alex for the great work !

[Nikola Goran Cutura]

I downloaded 1.0RC4 preview, executed LdapTest and I report the following:

when search filter is specifid as

ctx.search("ou=users,o=ActiveMQ,dc=example,dc=com", "usercertificate = {0}", new Object[] {cert}, constraints);
or
ctx.search("ou=users,o=ActiveMQ,dc=example,dc=com", "usercertificate;binary = {0}", new Object[] {cert}, constraints);

nothing is returned and the test fails.

When search filter is specified as

ctx.search("ou=users,o=ActiveMQ,dc=example,dc=com", "usercertificate = {0}", new Object[] {cert.getEncoded()}, constraints);

proper entry is returned and the test passes.

I can work with the latter though I believe the former is proper.