Re: [Pki-devel] [PATCH] Added fix for pki-server for db-update
On Wed, Jul 13, 2016 at 04:36:26PM +0530, Geetika Kapoor wrote:
Hi,
Please review this patch.Below is a small summary about this fix and
what we are trying to achieve.
CLI : pki-server db-upgrade
what it should be doing is if it sees that issuerName doesn't exist,NULL
it will add it itself.
Operation 1 : Search for the empty cn value for issuerName
-------------------------------------------------------------------------------
Current : '(&(objectclass=certificateRecord)(issuerName=*)) -- I
tried this it didn't show data even if i have record with empty issuerName
Hi Geetika,
The current filter is actually:
'(&(objectclass=certificateRecord)(!(issuerName=*)))',
This should match entries missing the issuerName attribute. You
talk about an entry with "empty issuerName" but empty strings are
not allowed for the Directory String attribute type. Could you
please clarify exactly what data is in the offending entry/entries
and how it got there?
Modified :
(&(objectclass=certificateRecord)(!(issuerName=cn*)))' --
This solves the purpose as it shows all the certs without issuerName
This filter is wrong - it does match entries without issuerName (as
intended), but also matches entries with issuerName set but not
starting with "cn".
Operation 2 : If we see a empty cn value , we are replacing it with
value we get from code
------------------------------------------------------------------------------------------------------------------
< code>
cert = nss.Certificate(bytearray(attr_cert[0]))
issuer_name = str(cert.issuer)
</code>
Current : we are updating the list it the format as mentioned
'issuerName': ['', 'CN=CA Signing Certificate,O=example.com Security
Domain']
Do we want to keep this behavior or we want to overwrite it in first
place? I believe in place of we do it MOD_REPLACE.
<try:
conn.ldap.modify_s(dn, [(ldap.MOD_ADD, 'issuerName',
issuer_name)])
>
Modified : onn.ldap.modify_s(dn, [(ldap.MOD_REPLACE, 'issuerName',
issuer_name)])
This change is OK.