[jboss-jira] [JBoss JIRA] (ELY-1616) ldap-key-store requires attribute userPKCS12 on ldap entry, even if it should be mandatory
[
https://issues.jboss.org/browse/ELY-1616?page=com.atlassian.jira.plugin.s...
]
Jiri Ondrusek commented on ELY-1616:
------------------------------------
Issue is caused by missing configuration. Problem is caused by some ldap servers (OpenLdap
in this case), which return "usercertificate;binary" as a result of search for
"usercertificate".
If this happens, then ldap entry is not recognized as certificate without
"userPKCS12" attribute.
Solution is simple, use mapping for this kind of ldap servers, to search for
"usercertificate;binary" instead of "usercertificate".
{quote}/subsystem=elytron/ldap-key-store=qsTrustStore:add( \
dir-context=exampleDC, \
search-path="ou=trusstore,dc=example,dc=org", \
certificate-chain-attribute="*userCertificate;binary*", \
){quote}
With this mapping ldap trusstore will work without "userPKCS12" attributes.
ldap-key-store requires attribute userPKCS12 on ldap entry, even if
it should be mandatory
------------------------------------------------------------------------------------------
Key: ELY-1616
URL: https://issues.jboss.org/browse/ELY-1616
Project: WildFly Elytron
Issue Type: Bug
Affects Versions: 1.1.11.CR1
Reporter: Jiri Ondrusek
Assignee: Jiri Ondrusek
The "key-attribute" ("userPKCS12") should not be necessary to use
LdapKeyStore as truststore.
See Steps to Reproduce for more information.
--
This message was sent by Atlassian JIRA
(v7.5.0#75005)