Hide
The LDAPIdentityStore getUID method for handling UID lookup by X.509 certificate assumed the backing LDAP can handle userCertificate binary search filters. While this may work on some LDAP providers it is not guaranteed that the LDAP provider implements certificateExactMatch or handles it in this way. OpenLDAP 2.4 in later versions does, but 2.3 does not.
Attached is a patch that attempts a fallback that does the certificate equality matching in-application if the LDAP returned no results from the userCertificate search that should ensure greater portability across LDAP providers.
Show
The LDAPIdentityStore getUID method for handling UID lookup by X.509 certificate assumed the backing LDAP can handle userCertificate binary search filters. While this may work on some LDAP providers it is not guaranteed that the LDAP provider implements certificateExactMatch or handles it in this way. OpenLDAP 2.4 in later versions does, but 2.3 does not.
Attached is a patch that attempts a fallback that does the certificate equality matching in-application if the LDAP returned no results from the userCertificate search that should ensure greater portability across LDAP providers.
Improvement
Open
Major
