Re: [389-users] retrieving x509 certificates using java

[Rich Megginson]

On 03/25/2011 07:12 AM, Luke Schierer wrote:
>  We have a java application that is attempting to pull the
> userCertificate
>  attribute from our 389ds ldap server.  Looking at the ldap logs, I see its
>  request, and it looks like it should be working, except for one oddity, it
>  is asking for the attribute "usercertificate;binary".  By attaching
>  eclipse to the application, we have determined that the general flow of
>  the code is
>
>  <get certificate from client and put it into myCert>
>
>  LDAPCertStoreParameters loCertStoreParams = new
>  LDAPCertStoreParameters(<ldap_host>,<ldap_port>);
>
>  CertStore loCertStore = CertStore.getInstance("LDAP", loCertStoreParams,
>  "Sun");
>
>  x509CertSelector loTargetConstraints = new X509CertSelector();
>
>  lsSubjectDN = CSFGlobalPKIUtil.getSubjectDNFromCertificate(myCert);
>  //we have verified that everything works fine as far as this point.
>
>  loTargetConstraints.setSubject(lsSubjectDN);
>  Collection loCol = loCertStore.getCertificates(loTargetConstraints);
>
>  Once the gall to getCertificates is made, a query is built and sent to the
>  LDAP server using java internal classes, we believe it is ultimately the
>  X509CertStoreLDAP class.  We do not have the source to debug this part of
>  the code, but at some point, without visible interaction in the source
>  code we do have, it choses to ask for "usercertificate;binary" instead of
>  just "usercertificate".
>
>  Should the 389ds be able to understand "usercertificate;binary", and is
>  this a misconfiguration on my part in the directory server, or is that not
>  something I should be expecting the directory to understand? 
the ;binary option was
defined in http://www.ietf.org/rfc/rfc2251.txt 
but dropped in http://www.ietf.org/rfc/rfc4511.txt (see C.1.7. Section 
4.1.5.1 (Binary Option) and others)

So the real fix would be to change the client app to not use ";binary".  
You could also file a bug/RFE against 389 to add support for legacy apps 
that still use ";binary".  Another fix would be to add a duplicate 
attribute "usercertificate;binary" which is a duplicate of the 
userCertificate attribute.
>  As a point of further information, when I try to replicate the
> behavior
>  using ldapsearch, I also fail to retrieve a certificate when I request
>  "usercertificate;binary" but succeed when I request only
>  "usercertificate".
>
>  Any help would be greatly appreciated.
>
>  Thanks!!
>
>  Luke
>
>  --
>  389 users mailing list
>  389-users(a)lists.fedoraproject.org
>  https://admin.fedoraproject.org/mailman/listinfo/389-users