Fix to UMich's ldapd....

Peter Whittaker (
Thu, 29 Aug 1996 08:33:47 -0400

The UMich ldapd will not respect a setting of "unknown" for the syntax
of a userCertificate in This note suggests a fix and
describes the problem in more detail.
>In the file servers/ldapd/syntax.c, change the line
> certif_init(); /* initialize certificate syntax handler */
> if ( ldap_certif_syntax ) {
> /* If the syntax is anything other than "unknown", treat it as
> an RFC 1778 string encoding */
> certif_init(); /* initialize certificate syntax handler */
> }
>What this does:
>As distributed, the UMich code will run certif_init() regardless of the
>syntax associated with the userCertificate attribute in; this
>fix causes the UMich code to run certif_init() only if the syntax associated
>with userCertificate is something other than "unknown", i.e., Certificate.
>Why is this fix necessary?
>This fix is necessary in order to allow the UMich ldapd to handle
>userCertificate attributes whose syntax is not the "Certificate" syntax known
>to the ISODE libraries used by the UMich ldapd, i.e., it allows the UMich
>ldapd to handle version 3 certificates.
>A little more background:
>The ISODE libraries used by the UMich ldapd and by ISODE-based DSAs such as
>QUIPU understand "Certificate" syntax to mean the older Certificate syntax
>defined in X.500(1988). When retrieving such a certificate from the
>directory, the UMich ldapd will transform it from the ASN.1 encoding returned
>by the DSA to the string encoding defined in RFC 1778.
>If a user wishes to use newer (version 3) certificates, whose syntax is not
>understood by ISODE-based DSAs and for which there is no string encoding, the
>syntax associated with userCertificate in the file should be
>changed from "Certificate" to "unknown", and the user's application should
>use printable ASN.1 instead of a string encoding. Making this change to the
> allows an ISODE-based DSA to store these certificates.
>However, this change is not enough to allow the UMich ldapd to handle such
>certificates. This is because the existing UMich code causes certif_init(),
>which treats certificates as string encoded objects, to be run regardless of
>the syntax associted with userCertificate in The fix above
>causes the UMich ldapd to respect the "unknown" setting and not run
>certif_init(). This is because a syntax of "unknown" in causes
>ldap_certif_syntax to be equal to 0 (zero), while any other syntax, including
>"Certificate", causes ldap_certif_syntax to be a non-zero value.
>Peter Whittaker [~~~~~~~~~~~~~~~~~~~~~~] X.500 Specialist
> [] Nortel Secure Networks
>Ph: +1 613 765 2064 [ ] P.O. Box 3511, Station C
>FAX:+1 613 765 3520 [______________________] Ottawa, Canada, K1Y 4H7