[389-users] Searching for userCertificate

[Howard Chu]

> Date: Tue, 21 Oct 2014 13:29:32 +0200
> From: Graham Leggett <minfrin at sharp.fm>

> Hi all,
>
> I am trying to research how it might be possible to do a directory search
for an exact match on a digital certificate storing in userCertificate. Most
specifically, I want to do a simple lookup based on a binary match of the
cert, its not enough to do the combination of DN and serial number.
>
> Does anyone know whether a simple search will work with 389ds or if there
are any gotchas to look out for? Some googling would suggest that openldap
can’t do it, I was wondering if 389ds had the same problem.

The userCertificate attribute is defined in RFC4523 with a specific syntax, 
and only supports the certificateExactMatch matching rule. OpenLDAP implements 
this RFC, along with the rest of the LDAPv3 spec.

In the past, before the certificateExactMatch matching rule was defined 
(LDAPv2 days), it was common practice to change the core.schema definition of 
userCertificate to use octetString syntax, and the corresponding 
octetStringMatch equality matching rule. You can still do this in OpenLDAP, 
although it obviously breaks compatibility with the standards.

-- 
   -- Howard Chu
   CTO, Symas Corp.           http://www.symas.com
   Director, Highland Sun     http://highlandsun.com/hyc/
   Chief Architect, OpenLDAP  http://www.openldap.org/project/