Red Hat Bugzilla – Bug 1288495
Add userCertificate index used in Smart Card authentication
Last modified: 2016-05-10 20:08:47 EDT
Description of problem:
Smart Card authentication capabilities introduced in Bug 1072383 require also RHEL-6 changes, for mixed environments when IdM clients perform Smart Card authentication against IdM Server on both RHEL-6 and RHEL-7, by querying certificate by userCertificate attribute.
The userCertificate index will ensure that IdM Clients will not hit degraded performance in these scenarios, when authenticating against the RHEL-6 IdM Server.
No new API/CLI/UI is needed for this request, the management is still supported in RHEL-7.2+ IdM Servers.
On rhel 6.8 master:
On rhel 7.2 replica:
Smart Card testing was successfully run on environment with RHEL 6.8 Master and RHEL 7.2 Replica.
Here is the index from the RHEL 6.8 IPA Master:
[root@gizmo ~]# ldapsearch -H ldapi://%2fvar%2frun%2fslapd-TESTRELM-TEST.socket -b cn=config cn=userCertificate
SASL/EXTERNAL authentication started
SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth
SASL SSF: 0
# extended LDIF
# base <cn=config> with scope subtree
# filter: cn=userCertificate
# requesting: ALL
# userCertificate, index, userRoot, ldbm database, plugins, config
dn: cn=userCertificate,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=con
# search result
result: 0 Success
# numResponses: 2
# numEntries: 1
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.
For information on the advisory, and where to find the updated
files, follow the link below.
If the solution does not work for you, open a new bug report.