Re: Cannot search usercertificate binary data with raw data

Michael Str=F6der wrote:
> Luis Neves wrote:
>> but i want to specifie a raw filter to the userCertificate atribute:
>> Ive uuencoded the original DER certificate and used the result as a
>> search filter
>
> Not sure whether you generated the search filter correctly at all. If y=
ou use
> uuencode the cert gets base64-encoded?
>
> If you want to search for an octet string you have to use hex-escaping =
of the
> bytes in the search filter. See the escaping rules in RFC 4515.
>
>> ldapsearch -x -h 10.15.254.148 -p 389 -D "cn=3Droot,dc=3Dcm-lisboa,dc=3D=
pt" -w
>> ***** -s sub -b "ou=3DAuthzLDAPCertmap,dc=3Dcm-lisboa,dc=3Dpt"
>> '(&(userCertificate;binary=3D\\30\\82\\07\\38\\30\\82\\06\\20\\a0\\03\=
\02\\01\\02\\02\\08\\d9\\33\\e0\\f2\\f9\\5d\\0f\\30\\0d\\06\\09\\2a\\86\\=
48\\86
>> etc etc etc )(objectClass=3DstrongAuthenticationUser))'
>
> But userCertificate has certificateExactMatch (2.5.13.34) defined as eq=
uality
> matching rule. This is *not* the octetStringMatch (2.5.13.17) matching =
rule.
>
> Searching certs with octetStringMatch will obviously not perform well t=
hough.
> I'd recommend to think about another method.

It is legal to use an octet string for certificateExactMatch. In OpenLDAP=
 the=20
octet string is simply parsed and turned into a certificate assertion val=
ue=20
and then matched as usual.

Probably the encoding of his filter value is just wrong. And of course, i=
t=20
would be simpler to just use a certificate assertion value instead.

--=20
   -- Howard Chu
   CTO, Symas Corp.           http://www.symas.com
   Director, Highland Sun     http://highlandsun.com/hyc/
   Chief Architect, OpenLDAP  http://www.openldap.org/project/