Thierry Van Doninck <Thi...@de...> wrote:
> Hi,
>
> Has anyone ever tried (and succeeded) to retrieve X509 certificates from
> a directory using Net::LDAP ?
>
> I tried doing this and get back a string saying :
>
> usercertificate:{ASN1}.....
>
> How could I exploit this ?
>
> I would greatly appreciate any help / examples / advice.
>
> Thanx.
>
> Thierry
>
Yes, I have.
Have you looked in the Net::LDAP::FAQ? It tells you about storing them,
which might give enough clues to work out how to read them back.
-----------
Using X.509 certificates.
How do I store X.509 certificates in the directory?
The first problem here is that there are many different
formats to hold certificates in, for example PEM, DER,
PKCS#7 and PKCS#12. The directory *only* uses the DER
format (more correctly, it only uses the BER format) which
is a binary format.
Your first job is to ensure that your certificates are
therefore in DER/BER format. You could use OpenSSL to
convert from PEM like this:
openssl x509 -inform PEM -in cert.pem -outform DER -out
cert.der
Consult the OpenSSL documentation to find out how to
perform other conversions.
To add a certificate to the directory, just slurp in the
DER/BER certificate into a scalar variable, and add it to
the entry's userCertificate attribute. How you do that
will depend on which version of LDAP you are using.
To slurp in the certificate try something like this:
my $cert;
{
local $/ = undef; # Slurp mode
open CERT, "cert.der" or die;
$cert = <CERT>;
close CERT;
}
# The certificate is now in $cert
For LDAPv2, because most directory vendors ignore the
string representation of certificates defined in RFC 1778,
you should add this value to the directory like this:
$res = $ldap->modify("cn=My User, o=My Company,c=XY",
add => [
'userCertificate' => [ $cert ]
]);
die "Modify failed (" . ldap_error_name($res->code) . ")\n"
if $res->code;
For LDAPv3, you must do this instead:
$res = $ldap->modify("cn=My User, o=My Company, c=XY",
add => [
'userCertificate;binary' => [ $cert ]
]);
die "Modify failed (" . ldap_error_name($res->code) . ")\n"
if $res->code;
Of course, the entry you are trying to add the certificate
to must use object classes that permit the userCertificate
attribute, otherwise the modify will fail with an object
class violation error. The inetOrgPerson structural object
class permits userCertificates, as does the
strongAuthenticationUser auxiliary object class. Others
might also.
-----------
Cheers,
Chris
|
