Date: Tue, 21 Oct 2014 13:29:32 +0200
From: Graham Leggett <minfrin@xxxxxxxx>
Hi all,
I am trying to research how it might be possible to do a directory search
for an exact match on a digital certificate storing in userCertificate. Most
specifically, I want to do a simple lookup based on a binary match of the
cert, its not enough to do the combination of DN and serial number.
Does anyone know whether a simple search will work with 389ds or if there
are any gotchas to look out for? Some googling would suggest that openldap
can’t do it, I was wondering if 389ds had the same problem.
The userCertificate attribute is defined in RFC4523 with a specific syntax,
and only supports the certificateExactMatch matching rule. OpenLDAP implements
this RFC, along with the rest of the LDAPv3 spec.
In the past, before the certificateExactMatch matching rule was defined
(LDAPv2 days), it was common practice to change the core.schema definition of
userCertificate to use octetString syntax, and the corresponding
octetStringMatch equality matching rule. You can still do this in OpenLDAP,
although it obviously breaks compatibility with the standards.
--
-- Howard Chu
CTO, Symas Corp. http://www.symas.com
Director, Highland Sun http://highlandsun.com/hyc/
Chief Architect, OpenLDAP http://www.openldap.org/project/
--
389 users mailing list
389-users@xxxxxxxxxxxxxxxxxxxxxxx
https://admin.fedoraproject.org/mailman/listinfo/389-users
