389-ds-base

#50038 Ticket 49543 - fix certmap dn comparison
Closed by spichugi. Opened by ftweedal.
ftweedal/389-ds-base fix/49543-certmap-dn-cmp-1.3.8  into  389-ds-base-1.3.8

Download 50038.patch

Clone of https://pagure.io/389-ds-base/pull-request/49611 for 1.3.8 branch.

Bug Description: Differences in DN string representations between
the value included in certmap.conf, and the stringified value of the
Issuer DN produced by NSS, as well as buggy DN normalisation code in
389 itself, cause 389 to wrongly reject the correct certmap
configuration to use. Authentication fails. This behaviour was
observed when there is an escaped comma in an attribute value.

Fix Description: Instead of comparing stringified DNs, parse the DN
represented in certmap.conf into an NSS CertNAME. Use the NSS DN
comparison routine when comparing certificate Issuer DNs against the
certmap configurations. Remove the buggy DN normalisation routine.

https://pagure.io/389-ds-base/issue/49543

Author: Fraser Tweedale ftweedal@redhat.com

Review by: ???

This has been merged; cancelling PR.

Pull-Request has been closed by ftweedal

389-ds-base is moving from Pagure to Github. This means that new issues and pull requests
will be accepted only in 389-ds-base's github repository.

This pull request has been cloned to Github as issue and is available here:
- https://github.com/389ds/389-ds-base/issues/3097

If you want to continue to work on the PR, please navigate to the github issue,
download the patch from the attachments and file a new pull request.

Thank you for understanding. We apologize for all inconvenience.

Pull-Request has been closed by spichugi
Metadata
None
No Tags
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.