Profile validation error message verbosity

[ralienpp]

I was recently troubleshooting this error message: Wrong number of UNSTRUCTUREDADDRESS fields in Subject DN and I thought that my life would have been easier if the message or the logs were more detailed.

Excerpt from modules/ejbca-common/src/org/ejbca/core/model/ra/raadmin/EndEntityProfile.java

    	final List<String> dnFields = DnComponents.getDnProfileFields();
    	final List<Integer> dnFieldExtractorIds = DnComponents.getDnDnIds();
    	for (int i = 0; i < dnFields.size(); i++) {
    		if (getNumberOfField(dnFields.get(i)) < subjectdnfields.getNumberOfFields(dnFieldExtractorIds.get(i))) {
    			throw new EndEntityProfileValidationException("Wrong number of " + dnFields.get(i) + " fields in Subject DN.");
    		}
    	}

I would prefer something like Wrong number of UNSTRUCTUREDADDRESS fields in Subject DN. Expected 5, got 7.. However, it is sometimes preferred not to make error messages too revealing.

If one were to make a patch to adjust this, would it be accepted? And if so, what do you consider an ideologically-correct approach to do it - put the info in the exception text, or use logging statements here and there? (thus enabling only the server admin to get this info)

[primetomas]

You are right, it's a fine balance between helpful errors and error that are considered to reveal too much information about the configuration.
If it is to be very helpful such messages should be available to the caller of the API. Server admins may have GBs of logs and should typically not be bothered for client configuration issues. For this particular one it seems:
How about a slightly more revealing, but not completely? "Wrong number of UNSTRUCTUREDADDRESS fields in Subject DN, received more than allowed". There could also be "Received less than required".

[ralienpp]

I find your wording a good compromise, but in retrospect I think that even the current message is good enough for someone who knows what they're doing. I had to troubleshoot an issue, but with my limited background in using EJBCA the error didn't bring me on the right path. When someone more knowledgeable had a look - they knew the culprit exactly (one needs to add multiple fields of the same type to the profile; whereas I only had one entry and thought that it would work).

A change is unnecessary, in my opinion.

[primetomas]

Thank you