Hide Forgot
Description of problem: The changes are in https://bugzilla.redhat.com/show_bug.cgi?id=491183 They involve UI changes as well. You'll need a console, and awnuk to explain them to you. Version-Release number of selected component (if applicable): How reproducible: Steps to Reproduce: 1. 2. 3. Actual results: Expected results: Additional info:
As far as I could tell, the schema changes removed an option from the LDAP publishing config and changed the schema. This had a fairly minimal doc impact. * I changed the object class in 7.4.1 * I updated the screenshot in 7.4.3 http://docs.redhat.com/docs/en-US/Red_Hat_Certificate_System/8.1/html/Admin_Guide/Configuring_Publishers_for_LDAP_Publishing.html * I updated the object class in the publishing module reference http://docs.redhat.com/docs/en-US/Red_Hat_Certificate_System/8.1/html/Admin_Guide/Publishing_Module_Reference.html#LdapCaCertPublisher
I'm going to defer to awnuk to review this. But it is not true that the objectClass *has to be* pkiCA. The old object classes are just as valid. Also, it is possible (and sometimes desirable) to have multiple objectclasses.
Emailed to me from Andrew Wnuk, 4/27/11: 1. In "7.4.1. Configuring the LDAP Directory" there is a table with 3 columns: "Certificate Type", "Schema", and "Reason". "Certificate Type" is not matching values placed in this column: "End-entity", "CA", "CRL". I would replace "Certificate Type" with "Object Type" and update values to be "End-entity certificate", "CA certificate", "CRL" 2. In the above table there is missing row designated to delta CRL. "Object Type": deltaCRL "Schema": deltaRevocationList;binary(attribute) "Reason": This is the attribute to which the Certificate Manager publishes the delta CRL. The Certificate Manager publishes the delta CRL to its own LDAP directory entry. The entry corresponds to the Certificate Manager's issuer name. This is an attribute of the deltaCRL or certificationAuthority-V2 object class. The value of the attribute is the DER-encoded binary X.509 deltaCRL. 3. In "C.1.5. LdapDeltaCrlPublisher" "deltaCRL attribute" should be replaced with "deltaRevocationList attribute" and "deltaCRL;binary" should be replaced with "deltaRevocationList;binary" 4. In "C.1.7. OCSPPublisher" the "path" should be "/ocsp/agent/ocsp/addCRL" and there is nothing about certificate nickname required for client auth.
The fixes for comment #3: 1. and 2. In step 2: http://docs.redhat.com/docs/en-US/Red_Hat_Certificate_System/8.1/html/Admin_Guide/Configuring_Publishers_for_LDAP_Publishing.html#Configuring_the_Directory_for_LDAP_Publishing 3. http://docs.redhat.com/docs/en-US/Red_Hat_Certificate_System/8.1/html/Admin_Guide/Publishing_Module_Reference.html#LdapDeltaCrlPublisher 4. http://docs.redhat.com/docs/en-US/Red_Hat_Certificate_System/8.1/html/Admin_Guide/Publishing_Module_Reference.html#OCSPPublisher
Changing MODIFIED bugs to ON_QA.