389-ds-base

#49611 Ticket 49543 - fix certmap dn comparison
Closed by spichugi. Opened by ftweedal.
ftweedal/389-ds-base fix/49543-certmap-dn-cmp  into  389-ds-base-1.3.7

Download 49611.patch

Bug Description: Differences in DN string representations between
the value included in certmap.conf, and the stringified value of the
Issuer DN produced by NSS, as well as buggy DN normalisation code in
389 itself, cause 389 to wrongly reject the correct certmap
configuration to use. Authentication fails. This behaviour was
observed when there is an escaped comma in an attribute value.

Fix Description: Instead of comparing stringified DNs, parse the DN
represented in certmap.conf into an NSS CertNAME. Use the NSS DN
comparison routine when comparing certificate Issuer DNs against the
certmap configurations. Remove the buggy DN normalisation routine.

https://pagure.io/389-ds-base/issue/49543

Author: Fraser Tweedale ftweedal@redhat.com

Review by: ???

rebased onto 00a2a1655c4485a8a9da0a63b21f78be957d634d

I think it should be in master branch, not in 389-ds-base-1.3.7

@spichugi No it's 1.3.7. IT's for the 1.3.x series, but we can apply to master too. Really, https://pagure.io/389-ds-base/pull-request/49579 would obsolete it (and probably needs it's own fix too).

Looks good, can you rebase this patch again? Then I will merge it...

rebased onto 37873dbca7723791d935d41354f54c3636ba1bbb

@mreynolds thanks for reviewing! I've rebased this PR, and the patch will apply without changes on 1.3.8 and master branches too.
Edited by ftweedal

@ftweedal At some point we'll need to get together and rework this for the new certmap plugin that's still being reviewed (waiting on some other things so I can finish pushing that over the line ... )

@firstyear sure thing mate. It should be pretty straightforward, just got to make sure DNs are compared as DNs, not strings.

@mreynolds anything else you need from me to get this merged?

rebased onto 8c20519d5220a53aa2ea42a7d4707e75c033a422

@ftweedal this was already merged upstream right? So this can be closed/cancelled?

Yep, it's merged (on three branches):

commit 818807d551e211298e205313b7c29f8318403081 (389-ds-base-1.3.8)
commit 1a93d63fa1fa95599c0dda1a1f3b2a72ab90d634 (389-ds-base-1.3.9)
commit 70bdd335d151e58e227fc2263ece9aedc0803152  (master)

I'll close this.

Pull-Request has been closed by ftweedal

389-ds-base is moving from Pagure to Github. This means that new issues and pull requests
will be accepted only in 389-ds-base's github repository.

This pull request has been cloned to Github as issue and is available here:
- https://github.com/389ds/389-ds-base/issues/2670

If you want to continue to work on the PR, please navigate to the github issue,
download the patch from the attachments and file a new pull request.

Thank you for understanding. We apologize for all inconvenience.

Pull-Request has been closed by spichugi
Metadata
None
No Tags
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.