RE: Cannot search usercertificate binary data with raw data
Luis Neves <[email protected]> Sat, 8 May 2010 10:21:27 +0000
| Newsgroups | gmane.network.openldap.general |
|---|---|
| Message-ID | <[email protected]> |
--_d42767b9-c18e-4559-99f3-0a33a7d8a3bf_
Content-Type: text/plain; charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
Hi
a) I have extracted the user certificate from the directory to a file using=
"ldapsearch -t .... "
Ive encoded the result file with hexdump and added slashes (and double slas=
hes and tested also with reversing the byte order)
Iam using the result as a search filter against the directory=2C and no res=
ults
b) Ive copy/pasted all the values from apache error_log (which comes from t=
he user browser) and used as a filter to ldapsearch and nothing
userCertificate=3D\\30\\82\\07\\38\\30\\82\\06\\20\\a0\\03\\02\\01\\02\\02\=
\08\\d9\\33\\e0\\f2\\f9\\5d\\0f\\30\\0d\\06\\09\\2a\\86\\48\\86
etc etc etc
a) and b) filters are the same=2C so I think I am doing the right tests=2C =
without errors
I dont have any more ideas... :(
help.....
c) I will make every test again next monday just to be sure i didnt copy/pa=
sted any error
I am starting to think of making some smaller testcase with some other bina=
ry fields=2C like a jpg for example. What do you think?
Add a image attribute to the user=2C load a very small (1x1) jpg=2C hexdump=
it to a file and try to feed it to ldapsearch until i get something
This is the only idea I have so far that other users could test without too=
much effort and compare results with me....
Luis
> >
> >> ldapsearch -x -h 10.15.254.148 -p 389 -D "cn=3Droot=2Cdc=3Dcm-lisboa=
=2Cdc=3Dpt" -w
> >> ***** -s sub -b "ou=3DAuthzLDAPCertmap=2Cdc=3Dcm-lisboa=2Cdc=3Dpt"
> >> '(&(userCertificate=3Bbinary=3D\\30\\82\\07\\38\\30\\82\\06\\20\\a0\\0=
3\\02\\01\\02\\02\\08\\d9\\33\\e0\\f2\\f9\\5d\\0f\\30\\0d\\06\\09\\2a\\86\\=
48\\86
> >> etc etc etc )(objectClass=3DstrongAuthenticationUser))'
> >
>=20
> It is legal to use an octet string for certificateExactMatch. In OpenLDAP=
the=20
> octet string is simply parsed and turned into a certificate assertion val=
ue=20
> and then matched as usual.
>=20
> Probably the encoding of his filter value is just wrong. And of course=2C=
it=20
> would be simpler to just use a certificate assertion value instead.
>=20
> --=20
> -- Howard Chu
> CTO=2C Symas Corp. http://www.symas.com
> Director=2C Highland Sun http://highlandsun.com/hyc/
> Chief Architect=2C OpenLDAP http://www.openldap.org/project/
=20
_________________________________________________________________
Hotmail: Trusted email with powerful SPAM protection.
https://signup.live.com/signup.aspx?id=3D60969=
--_d42767b9-c18e-4559-99f3-0a33a7d8a3bf_
Content-Type: text/html; charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
<html>
<head>
<style><!--
.hmmessage P
{
margin:0px=3B
padding:0px
}
body.hmmessage
{
font-size: 10pt=3B
font-family:Verdana
}
--></style>
</head>
<body class=3D'hmmessage'>
Hi<br><br>a) I have extracted the user certificate from the directory to a =
file using "ldapsearch -t .... "<br>Ive encoded the result file with hexdum=
p and added slashes (and double slashes and tested also with reversing the =
byte order)<br>Iam using the result as a search filter against the director=
y=2C and no results<br><br>b) Ive copy/pasted all the values from apache er=
ror_log (which comes from the user browser) and used as a filter to ldapsea=
rch and nothing<br>userCertificate=3D\\30\\82\\07\\38\\30\\82\\06\\20\\a0\\=
03\\02\\01\\02\\02\\08\\d9\\33\\e0\\f2\\f9\\5d\\0f\\30\\0d\\06\\09\\2a\\86\=
\48\\86<br>etc etc etc<br><br>a) and b) filters are the same=2C so I think =
I am doing the right tests=2C without errors<br><br><br>I dont have any mor=
e ideas... :(<br>help.....<br><br>c) I will make every test again next mond=
ay just to be sure i didnt copy/pasted any error<br><br>I am starting to th=
ink of making some smaller testcase with some other binary fields=2C like a=
jpg for example. What do you think?<br>Add a image attribute to the user=
=2C load a very small (1x1) jpg=2C hexdump it to a file and try to feed it =
to ldapsearch until i get something<br>This is the only idea I have so far =
that other users could test without too much effort and compare results wit=
h me....<br><br>Luis<br><br><br><br>>=3B >=3B<br>>=3B >=3B>=3B ld=
apsearch -x -h 10.15.254.148 -p 389 -D "cn=3Droot=2Cdc=3Dcm-lisboa=2Cdc=3Dp=
t" -w<br>>=3B >=3B>=3B ***** -s sub -b "ou=3DAuthzLDAPCertmap=2Cdc=3D=
cm-lisboa=2Cdc=3Dpt"<br>>=3B >=3B>=3B '(&=3B(userCertificate=3Bbin=
ary=3D\\30\\82\\07\\38\\30\\82\\06\\20\\a0\\03\\02\\01\\02\\02\\08\\d9\\33\=
\e0\\f2\\f9\\5d\\0f\\30\\0d\\06\\09\\2a\\86\\48\\86<br>>=3B >=3B>=3B =
etc etc etc )(objectClass=3DstrongAuthenticationUser))'<br>>=3B >=3B<br=
><br>>=3B <br>>=3B It is legal to use an octet string for certificateEx=
actMatch. In OpenLDAP the <br>>=3B octet string is simply parsed and turn=
ed into a certificate assertion value <br>>=3B and then matched as usual.=
<br>>=3B <br>>=3B Probably the encoding of his filter value is just wro=
ng. And of course=2C it <br>>=3B would be simpler to just use a certifica=
te assertion value instead.<br>>=3B <br>>=3B -- <br>>=3B -- Howard=
Chu<br>>=3B CTO=2C Symas Corp. http://www.symas.com<br>>=
=3B Director=2C Highland Sun http://highlandsun.com/hyc/<br>>=3B =
Chief Architect=2C OpenLDAP http://www.openldap.org/project/<br> =
<br /><hr />Hotmail: Trusted email with powerful SPAM protection. <a hr=
ef=3D'https://signup.live.com/signup.aspx?id=3D60969' target=3D'_new'>Sign =
up now.</a></body>
</html>=
--_d42767b9-c18e-4559-99f3-0a33a7d8a3bf_--