What is changed?

In testing with LdapPublisher, I found a few issues and provide some fixes as described below:

1. The static strings for HOSTNAMES and BASEDN had typos. I fixed this and provided a change to upgrade() method to rectify any previous configurations using the incorrect spellings.

2. The method constructLDAPDN() appends the BaseDN after working out the LDAP DN. This is normally OK, but not if the BaseDN is 'blank'. Some situations may require a BaseDN set to 'blank', so have included a fix for this. Note that you could set a 'blank' BaseDN in the GUI by entering a space character.

3. The method getObjectClassAttribute() was limitted to creation of O and OU object classes. Generally, other object classes should be supported, such as DC, L, ST, and C. This method has been updated for this.

4. The method createIntermediateNodes() changed to use a recursive process of checking the existence of parent nodes, and then creating the missing nodes as the recursion unwinds. I suggest this code variation is a bit simpler and better handles a BaseDN that is blank..

5. The method revokeCertificate() has the option to delete the revoked certificate from LDAP. However, if the user has multiple certificates in the LDAP, then all certificates will get deleted. This is mentioned in the documentation, but a better approach would be to keep the remaining certificates in the LDAP. A fix for this has been included.

6. The method revokeCertificate() can also delete the whole user entry in the LDAP when their certificate is revoked. A better approach would be to only delete an entry if there are no other certificates remaining once the revoked certificate is removed. A fix for this has been included.

7. Some changes to debug log messages included.

8. Some methods changed from 'private' to 'protected' to help further subclassing.

How has this been tested?

Added extra testcase into LdapPublisherUnitTest.
Other testing performed manually using an LDAP service (OpenLdap and ViewDS). Tested publishing with CA and EE certs, included the creation of parent nodes. Tested revocation of EE cert using LDAP entries having one certificate, and others having two certificates.

Checklist before requesting a review

• I have performed a self-review of my code
• I have kept the patch limited to only change the parts related to the patch
• This change requires a documentation update (as the behaviour has changed with revoked certs)

See also Contributing Guidelines.