Bug 1288495 - Add userCertificate index used in Smart Card authentication
Add userCertificate index used in Smart Card authentication
Product: Red Hat Enterprise Linux 6
Classification: Red Hat
Component: ipa (Show other bugs)
Unspecified Unspecified
unspecified Severity unspecified
: rc
: ---
Assigned To: IPA Maintainers
Namita Soman
Depends On:
Blocks: 1272422
  Show dependency treegraph
Reported: 2015-12-04 06:55 EST by Martin Kosek
Modified: 2016-05-10 20:08 EDT (History)
3 users (show)

See Also:
Fixed In Version: ipa-3.0.0-50.el6
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Last Closed: 2016-05-10 20:08:47 EDT
Type: Bug
Regression: ---
Mount Type: ---
Documentation: ---
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---

Attachments (Terms of Use)

  None (edit)
Description Martin Kosek 2015-12-04 06:55:44 EST
Description of problem:
Smart Card authentication capabilities introduced in Bug 1072383 require also RHEL-6 changes, for mixed environments when IdM clients perform Smart Card authentication against IdM Server on both RHEL-6 and RHEL-7, by querying certificate by userCertificate attribute.

The userCertificate index will ensure that IdM Clients will not hit degraded performance in these scenarios, when authenticating against the RHEL-6 IdM Server.

No new API/CLI/UI is needed for this request, the management is still supported in RHEL-7.2+ IdM Servers.
Comment 4 Scott Poore 2016-02-16 13:13:53 EST

Version ::

on client:


On rhel 6.8 master:


On rhel 7.2 replica:


Results ::

Smart Card testing was successfully run on environment with RHEL 6.8 Master and RHEL 7.2 Replica.

Here is the index from the RHEL 6.8 IPA Master:

[root@gizmo ~]# ldapsearch -H ldapi://%2fvar%2frun%2fslapd-TESTRELM-TEST.socket -b cn=config cn=userCertificate
SASL/EXTERNAL authentication started
SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth
# extended LDIF
# LDAPv3
# base <cn=config> with scope subtree
# filter: cn=userCertificate
# requesting: ALL

# userCertificate, index, userRoot, ldbm database, plugins, config
dn: cn=userCertificate,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=con
objectClass: top
objectClass: nsIndex
nsIndexType: eq
nsIndexType: pres
cn: userCertificate
nsSystemIndex: false

# search result
search: 3
result: 0 Success

# numResponses: 2
# numEntries: 1
[root@gizmo ~]#
Comment 6 errata-xmlrpc 2016-05-10 20:08:47 EDT
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.


Note You need to log in before you can comment on or make changes to this bug.