Custom DN attribute OID

[talcher]

Hello the EJBCA team,

I think the src/java/profilemappings.properties should be updated. Indeed, linde 26, one reads that custom attributes have an ID from 200 to 299; while, lines 111 and 113, one reads that custom IDs are from 300 to 399.

First issue:
What's true? I tend to believe that it is the 300-399 range, given the content of SshEndEntityProfileFields.java

Second issue:
using an old EJBCA version, I have created many certificates with a custom atribute whose ID is 200.
To compile the latest version of EJBCA, I will change the src/java/profilemappings.properties file and assign the ID 300 to my custom attribute.
The question is: will I encounter any problem with such a change of ID?

Thank you for your help.

talcher

[primetomas]

Warning! Adding custom DN attributes is one of the thing I would warn against most.
Line 26 is clearly wrong.

If you are interested in some standard DN attributes that EJBCA does not support, I'd rather recommend raising that as an issue, or preferably a PR. Adding your own poses a long term risk for upgrades. I.e. you have to maintain it yourself, and if EJBCA ever addes it as a standard attribute you will get into bit problems.

(as the warning in the properties file says).

I will update the properties file for the next release btw.

[talcher]

Hello Tomas,

thank you for your answer.

I would be glad not to modify this properties file. Even more so that the DN attribute I use is fairly standard: ORGANIZATIONIDENTIFIER

My predecessor added a line in this properties file, to get the ORGANIZATIONIDENTIFIER field in the "End Entity" page on the WebUI.
Then, the "subjectDN" string sent to EJBCA WS via SOAP contains the substring "organizationIdentifier=foo". And it works well.

However, if I remove the ORGANIZATIONIDENTIFIER field from the "End Entity" page on the WebUI, I cannot create a new user anymore:

INFO [org.apache.cxf.phase.PhaseInterceptorChain] (default task-1) Application {http://ws.protocol.core.ejbca.org/}EjbcaWSService#{http://ws.protocol.core.ejbca.org/}editUser has thrown exception, unwinding now: org.ejbca.core.model.ra.raadmin.UserDoesntFullfillEndEntityProfile: org.ejbca.core.model.ra.raadmin.EndEntityProfileValidationException: Unsupported Subject DN Field found in:UID=00371619,[...],organizationIdentifier=foo

I am afraid I am doing something wrong, but I cannot find out what.

[primetomas]

Ah OerganizationIdentifier. An eIDAS field. Like for PSD2, https://doc.primekey.com/ejbca/ejbca-operations/ejbca-ca-concept-guide/certificate-profiles-overview/certificate-profile-fields#CertificateProfileFields-PSD2QualifiedCertificateStatement

You can't add end entities with end entity profile enforcement in place.

So the short answers are.

1. Yes it looks like 300-399 are the ones to use.
2. yes, you may have problems if you change the ID from 200 to 300. Your end entity profiles will be "messed up" and need to be re-configured.

I'm actually not sure what would happen if you disable "end entity profile limitations" in the System configuration...

[talcher]

Hello Thomas,
and thank you for your answer.
Take care!