On Tue, Sep 22, 2015 at 04:14:44PM +0200, Michael Ströder wrote:
Sumit Bose wrote:
> In addition to the page above there is
>
https://fedorahosted.org/sssd/wiki/DesignDocs/LookupUsersByCertificate
> with more D-Bus details.
Since this is a design document one important comment:
This won't work with OpenLDAP.
In 389-DS 'userCertificate' is declared like this:
( 2.5.4.36
NAME 'userCertificate'
DESC 'X.509 user certificate'
EQUALITY octetStringMatch
SYNTAX 1.3.6.1.4.1.1466.115.121.1.40
X-ORIGIN 'RFC 4523' )
Note that although this references RFC 4523 simply Octet String syntax is used
with the accompanying equality matching rule 'octetStringMatch'. That's
what's
used in your design for generating the LDAP filter strings.
In OpenLDAP 'userCertificate' is declared like defined in RFC 4523:
( 2.5.4.36
NAME 'userCertificate'
DESC 'RFC2256: X.509 user certificate, use ;binary'
EQUALITY certificateExactMatch
SYNTAX 1.3.6.1.4.1.1466.115.121.1.8 )
Note that 'certificateExactMatch' is used as equality matching rule.
Generating simple filters like for 'octetStringMatch' does not work. You would
have to construct a issuer-DN+serial assertion value.
Thank you for the comment. Out plan is to add more flexible mappings in
one of the next releases. Besides matching the certificate as a whole we
also plan to drop the requirement to have the full certificate stored in
LDAP but find the matching user with some data from the certificate,
like e.g. the CN or some values form the Subject Alternative Names.
bye,
Sumit
Ciao, Michael.
_______________________________________________
sssd-users mailing list
sssd-users(a)lists.fedorahosted.org
https://lists.fedorahosted.org/mailman/listinfo/sssd-users