RE: Cannot search usercertificate binary data with raw data
Luis Neves <[email protected]> Fri, 7 May 2010 22:24:30 +0000
| Newsgroups | gmane.network.openldap.general |
|---|---|
| Message-ID | <[email protected]> |
--_8592921c-22fe-4f53-a0cc-933fff529854_
Content-Type: text/plain; charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
Hi Michael=2C once again=2C thank you for your valuable tips and interest o=
n helping me
> Luis Neves wrote:
> > but i want to specifie a raw filter to the userCertificate atribute:
> > Ive uuencoded the original DER certificate and used the result as a
> > search filter
>
> Not sure whether you generated the search filter correctly at all. If you=
use
> uuencode the cert gets base64-encoded?
Sorry=2C i made a typo=2C Ive used Hexdump to get an hexadecimal representa=
tion of the DER file=2C and used that as the "raw" binary search filter=2C =
after putting slashes (tried also with bouble slashes=2C and as I said=2C a=
lso reversing the bytes order) before each hexadecimal value.
I ve used uuencode to turn the DER certificate on a list of base64 ascii ch=
aracters for using on the ldif file.
(its the same output as the PEM representation of the certificate=2C but wi=
thout the ---- begin certificate ---- header and footers)
>
> If you want to search for an octet string you have to use hex-escaping of=
the
> bytes in the search filter. See the escaping rules in RFC 4515.
>
> > ldapsearch -x -h 10.15.254.148 -p 389 -D "cn=3Droot=2Cdc=3Dcm-lisboa=2C=
dc=3Dpt" -w
> > ***** -s sub -b "ou=3DAuthzLDAPCertmap=2Cdc=3Dcm-lisboa=2Cdc=3Dpt"
> > '(&(userCertificate=3Bbinary=3D\\30\\82\\07\\38\\30\\82\\06\\20\\a0\\03=
\\02\\01\\02\\02\\08\\d9\\33\\e0\\f2\\f9\\5d\\0f\\30\\0d\\06\\09\\2a\\86\\4=
8\\86
> > etc etc etc )(objectClass=3DstrongAuthenticationUser))'
>
> But userCertificate has certificateExactMatch (2.5.13.34) defined as equa=
lity
> matching rule. This is *not* the octetStringMatch (2.5.13.17) matching ru=
le.
>
> Searching certs with octetStringMatch will obviously not perform well tho=
ugh.
> I'd recommend to think about another method.
>
sorry my dumb question=2C but this means that an octetstring like the one I=
am using cannot be matched on a ldapsearch against the usercertificate att=
ribute?
so how will mod_auhtz_ldap be able to ever work? (see below why)
> Since you asked a similar question on openssl-users I assume you want to =
use
> this module. Right?
>
> http://authzldap.othello.ch/configuration.html
correct.
I have configured this module to use the whole certificate as the matching =
attribute against the same data stored on the ldap server (after a lot of p=
roblems with UTF8 when trying to use subjectDN and issuesDN atributes).=20
I am seeing in the apache logs that the module is trying a ldapsearch using=
the hexadecimal raw data and returning an error:=20
ssl_error_log:
[client 10.15.1.119] [11624] filter: (&(userCertificate=3D\\30\\82\\07\\38\=
\30 etc etc etc etc \\91\\ee\\e9\\7d)(objectClass=3DstrongAuthenticationUse=
r)) base: ou=3DAuthzLDAPCertmap=2Cdc=3Dcm-lisboa=2Cdc=3Dpt=2C no such user
(Iam seeing now that "binary" option is not used on this query=2C but I thi=
nk Ive tried with and without this option as well)
so=2C to try to find out why I am getting the "no such user" error I starte=
d making tests with ldapsearch and a filter equal to the hexadecimal repres=
entation of the cert that is stored on the directory=2C just like what it s=
eems mod_authz_ldap is trying to do
But the truth is that I am not being able to find nothing using this techni=
que.... so=2C how could mod_authz_ldap ever work??....
Just for sure next monday I will try again all the tests Ive made today (ld=
apserach with and without "binary"=2C with bytes reversed and not=2C with s=
ingle and double slahes)=2C anyway=2C what you said above about the octetst=
ringmatch is ringing problems in my head....
Luis
=20
_________________________________________________________________
Hotmail: Powerful Free email with security by Microsoft.
https://signup.live.com/signup.aspx?id=3D60969=
--_8592921c-22fe-4f53-a0cc-933fff529854_
Content-Type: text/html; charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
<html>
<head>
<style><!--
.hmmessage P
{
margin:0px=3B
padding:0px
}
body.hmmessage
{
font-size: 10pt=3B
font-family:Verdana
}
--></style>
</head>
<body class=3D'hmmessage'>
Hi Michael=2C once again=2C thank you for your valuable tips and interest o=
n helping me<br><br>>=3B Luis Neves wrote:<br>>=3B >=3B but i want to=
specifie a raw filter to the userCertificate atribute:<br>>=3B >=3B Iv=
e uuencoded the original DER certificate and used the result as a<br>>=3B=
>=3B search filter<br>>=3B<br>>=3B Not sure whether you generated th=
e search filter correctly at all. If you use<br>>=3B uuencode the cert ge=
ts base64-encoded?<br><br>Sorry=2C i made a typo=2C Ive used Hexdump to get=
an hexadecimal representation of the DER file=2C and used that as the "raw=
" binary search filter=2C after putting slashes (tried also with bouble sla=
shes=2C and as I said=2C also reversing the bytes order) before each hexade=
cimal value.<br><br>I ve used uuencode to turn the DER certificate on a lis=
t of base64 ascii characters for using on the ldif file.<br>(its the same o=
utput as the PEM representation of the certificate=2C but without the ---- =
begin certificate ---- header and footers)<br><br>>=3B<br>>=3B If you w=
ant to search for an octet string you have to use hex-escaping of the<br>&g=
t=3B bytes in the search filter. See the escaping rules in RFC 4515.<br>>=
=3B<br><br>>=3B >=3B ldapsearch -x -h 10.15.254.148 -p 389 -D "cn=3Droo=
t=2Cdc=3Dcm-lisboa=2Cdc=3Dpt" -w<br>>=3B >=3B ***** -s sub -b "ou=3DAut=
hzLDAPCertmap=2Cdc=3Dcm-lisboa=2Cdc=3Dpt"<br>>=3B >=3B '(&=3B(userCe=
rtificate=3Bbinary=3D\\30\\82\\07\\38\\30\\82\\06\\20\\a0\\03\\02\\01\\02\\=
02\\08\\d9\\33\\e0\\f2\\f9\\5d\\0f\\30\\0d\\06\\09\\2a\\86\\48\\86<br>>=
=3B >=3B etc etc etc )(objectClass=3DstrongAuthenticationUser))'<br>>=
=3B<br>>=3B But userCertificate has certificateExactMatch (2.5.13.34) def=
ined as equality<br>>=3B matching rule. This is *not* the octetStringMatc=
h (2.5.13.17) matching rule.<br>>=3B<br>>=3B Searching certs with octet=
StringMatch will obviously not perform well though.<br>>=3B I'd recommend=
to think about another method.<br>>=3B<br><br>sorry my dumb question=2C =
but this means that an octetstring like the one I am using cannot be matche=
d on a ldapsearch against the usercertificate attribute?<br>so how will mod=
_auhtz_ldap be able to ever work? (see below why)<br><br><br>>=3B Since y=
ou asked a similar question on openssl-users I assume you want to use<br>&g=
t=3B this module. Right?<br>>=3B<br>>=3B http://authzldap.othello.ch/co=
nfiguration.html<br><br>correct.<br><br>I have configured this module to us=
e the whole certificate as the matching attribute against the same data sto=
red on the ldap server (after a lot of problems with UTF8 when trying to us=
e subjectDN and issuesDN atributes). <br>I am seeing in the apache logs tha=
t the module is trying a ldapsearch using the hexadecimal raw data and retu=
rning an error: <br><br>ssl_error_log:<br>[client 10.15.1.119] [11624] filt=
er: (&=3B(userCertificate=3D\\30\\82\\07\\38\\30 etc etc etc etc \\91\\e=
e\\e9\\7d)(objectClass=3DstrongAuthenticationUser)) base: ou=3DAuthzLDAPCer=
tmap=2Cdc=3Dcm-lisboa=2Cdc=3Dpt=2C no such user<br><br>(Iam seeing now that=
"binary" option is not used on this query=2C but I think Ive tried with an=
d without this option as well)<br><br>so=2C to try to find out why I am get=
ting the "no such user" error I started making tests with ldapsearch and a =
filter equal to the hexadecimal representation of the cert that is stored o=
n the directory=2C just like what it seems mod_authz_ldap is trying to do<b=
r><br>But the truth is that I am not being able to find nothing using this =
technique.... so=2C how could mod_authz_ldap ever work??....<br><br>Just fo=
r sure next monday I will try again all the tests Ive made today (ldapserac=
h with and without "binary"=2C with bytes reversed and not=2C with single a=
nd double slahes)=2C anyway=2C what you said above about the octetstringmat=
ch is ringing problems in my head....<br><br>Luis<br> <br /><hr =
/>Hotmail: Powerful Free email with security by Microsoft. <a href=3D'https=
://signup.live.com/signup.aspx?id=3D60969' target=3D'_new'>Get it now.</a><=
/body>
</html>=
--_8592921c-22fe-4f53-a0cc-933fff529854_--