Andrea e Luca Giacobazzi wrote:
> >I need the full subject DN of the certificate, and the DER encoded X509
> >certificate itself (and its length). ie: what you would find in the
> >userCertificate field in an LDAP directory.
>
> Use i2d_X509(..) to convert from X509* to DER :
>
> /* Convert certificate from X509* to DER, put it in a string certificate */
> len = i2d_X509(xs, NULL);
> cert = malloc(len);
> buf = cert;
> if (!(i2d_X509(xs, &buf)))
>
> Find the correct NID to get DN in openssl *.h, and use:
>
> X509* xs;
>
> xn = X509_get_subject_name(xs);
> X509_NAME_get_text_by_NID(xn, NID_commonName, name, 30);
> X509_NAME_get_text_by_NID(xn, NID_pkcs9_emailAddress, mail, 30);
>
> I made a patch to check cert status during client authentication in Apache,
> with LDAP directory v2, I send it to the list, if you're interested I'll
> send you again.
I've got a printout of your patch sitting in front of me right now. I must
have missed the i2d_xxxx() calls - thanks!
Your patch doesn't do _quite_ what I need it to though. I need to allow the
user to configure the mapping from subject DN to LDAP DN, etc. I'll be
submitting my patch when it gets working as well. We should try and merge the
two so we don't have a billion patches for LDAP verification floating around,
kind of like the LDAP auth modules for apache. :)
One thing I plan on adding to this is the ability to specify the search base
based on the attribute/value pairs in the subject DN. You would basically have
a printf-like format string for your search base, like:
uid=%{CN}, OU=%{OU}, OU=People, O=%{O}, C=US
Thanks for the pointers!
-Bill P.
______________________________________________________________________
OpenSSL Project http://www.openssl.org
Development Mailing List [EMAIL PROTECTED]
Automated List Manager [EMAIL PROTECTED]
