From 71cf23ca177c15c548ae70ad0d5a742b14ce7e8d Mon Sep 17 00:00:00 2001
From: Viktor Ashirov <vashirov@redhat.com>
Date: Dec 10 2019 15:44:23 +0000
Subject: Issue 50774 - Account.enroll_certificate() should not check for DS version


Bug Description:

`Account.enroll_certificate()` assumes that `userCertificate` can be added
only to `nsAccount` and does a check for DS version where this objectClass
was introduced.
But `userCertificate` is a valid attribute for `inetOrgPerson` objectClass
too. And `enroll_certificate()` can be used with this objectClass.

Fix Description:

Instead of relying on a DS version we should trust the server to add or
reject an invalid attribute.

Fixes: https://pagure.io/389-ds-base/issue/50774

Reviewed by: mhonek (Thanks!)

---

diff --git a/src/lib389/lib389/idm/account.py b/src/lib389/lib389/idm/account.py
index 8a9e36d..cea6725 100644
--- a/src/lib389/lib389/idm/account.py
+++ b/src/lib389/lib389/idm/account.py
@@ -259,8 +259,6 @@ class Account(DSLdapObject):
         :param der_path: the certificate file in DER format to include.
         :type der_path: str
         """
-        if ds_is_older('1.4.0'):
-            raise Exception("This version of DS does not support nsAccount")
         # Given a cert path, add this to the object as a userCertificate
         crt = None
         with open(der_path, 'rb') as f: