Bug: LDAP server userCertificate;binary with S/MIME public certificates is not used
Status: RESOLVED
Priority: --
Resolution: WORKSFORME
Created: 2024-12-01 15:28:51+00:00
Resolved: 2024-12-01 18:49:47+00:00

User Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Steps to reproduce:

My goal was to use my LDAP server to distribute S/MIME public certificates. 
https://support.mozilla.org/en-US/kb/thunderbird-help-cannot-encrypt#w_obtaining-smime-certificates-of-correspondents
told me that should be possible. 

I stored the certificate for every person in DER format base64-coded in the attribute userCertificate;binary. 
like the Thunderbird source code suggests:
const USER_CERT_ATTRIBUTE = "usercertificate;binary";
https://github.com/mozilla/releases-comm-central/blob/master/mailnews/extensions/smime/certFetchingStatus.js

While discovering the Username and the eMail via LDAP works fine, the certificate is a problem. When I try to write an eMail, I see an additional request for the userCertificate;binary at the server: 

[01/Dec/2024:16:02:25.530616416 +0100] - DEBUG - NSACLPlugin - aclanom_match_profile - conn=469 op=1: Allow access on entry(uid=k17c,ou=people,dc=smime,dc=uni-bremen,dc=de).attr(mail) to anonymous: acidn="ou=people,dc=smime,dc=uni-bremen,dc=de"
[01/Dec/2024:16:02:25.540352542 +0100] - DEBUG - NSACLPlugin - print_access_control_summary - conn=469 op=1 (main): Allow search on entry(uid=k17c,ou=people,dc=smime,dc=uni-bremen,dc=de).attr(mail) to anonymous: allow anyone aci matched anon user
[01/Dec/2024:16:02:25.548357693 +0100] - DEBUG - NSACLPlugin - aclanom_match_profile - conn=469 op=1: Allow access on entry(uid=k17c,ou=people,dc=smime,dc=uni-bremen,dc=de).attr(NULL) to anonymous: acidn="ou=people,dc=smime,dc=uni-bremen,dc=de"
[01/Dec/2024:16:02:25.556825651 +0100] - DEBUG - NSACLPlugin - aclanom_match_profile - conn=469 op=1: Allow access on entry(uid=k17c,ou=people,dc=smime,dc=uni-bremen,dc=de).attr(userCertificate;binary) to anonymous: acidn="ou=people,dc=smime,dc=uni-bremen,dc=de"

But the Thunderbird UI insists that there is no cert for that person I want to write to. Thus no encrytion available. 

Then I thought that I am just too stupid to set up the LDAP correctly and switched to a commercial ldap server provider for a test. They have even an tutorial how to use their service with 
https://globaltrust.eu/en/mozilla-thunderbird-install-certificate-how-to-sign-encrypt-e-mails-ldap-directory-service-v1-2/
The userCertificate;binary are stored like mine (can are also in DER format base64-coded) 
ldapsearch -x -H ldap://ldap.globaltrust.eu -b "c=at"
And for them Thunderbird UI says also that it doesn't find their certificates. 

Thus for the moment I will assume that this is a bug in Thunderbird... 

Help? Thanks!

[mailnews.ldap.loglevel	All]

mailnews.ldap: Connecting to ldaps://smime.neuro.uni-bremen.de:636 LDAPClient.sys.mjs:44:18
mailnews.ldap: Connected LDAPClient.sys.mjs:163:18
mailnews.ldap: Binding LDAPClient.sys.mjs:66:18
mailnews.ldap: C: [1] BindRequest LDAPClient.sys.mjs:283:18
mailnews.ldap: S: [1] BindResponse resultCode=0 message="" LDAPClient.sys.mjs:211:20
mailnews.ldap: Searching dn="ou=people,dc=smime,dc=uni-bremen,dc=de" filter="(&(|(cn=*Markus*)(givenName=*Markus*)(sn=*Markus*)(mozillaNickname=*Markus*)(mail=*Markus*)(mozillaSecondEmail=*Markus*)(&(description=*Markus*))(o=*Markus*)(ou=*Markus*)(title=*Markus*)(mozillaWorkUrl=*Markus*)(mozillaHomeUrl=*Markus*)))" LDAPClient.sys.mjs:135:18
mailnews.ldap: C: [2] SearchRequest LDAPClient.sys.mjs:283:18
mailnews.ldap: S: [2] SearchResultEntry <empty string> LDAPClient.sys.mjs:211:20
mailnews.ldap: S: [2] SearchResultDone resultCode=0 message="" LDAPClient.sys.mjs:211:20
mailnews.ldap: C: [3] UnbindRequest LDAPClient.sys.mjs:283:18
mailnews.ldap: Connection closed LDAPClient.sys.mjs:255:18

mailnews.ldap: Connecting to ldaps://smime.neuro.uni-bremen.de:636 LDAPClient.sys.mjs:44:18
mailnews.ldap: Connected LDAPClient.sys.mjs:163:18
mailnews.ldap: Binding LDAPClient.sys.mjs:66:18
mailnews.ldap: C: [1] BindRequest LDAPClient.sys.mjs:283:18
mailnews.ldap: S: [1] BindResponse resultCode=0 message="" LDAPClient.sys.mjs:211:20
mailnews.ldap: Searching dn="ou=people,dc=smime,dc=uni-bremen,dc=de" filter="(mail=REDACTED)" LDAPClient.sys.mjs:135:18
mailnews.ldap: C: [2] SearchRequest LDAPClient.sys.mjs:283:18
mailnews.ldap: S: [2] SearchResultEntry <empty string> LDAPClient.sys.mjs:211:20
mailnews.ldap: S: [2] SearchResultDone resultCode=0 message="" LDAPClient.sys.mjs:211:20
mailnews.ldap: C: [3] UnbindRequest LDAPClient.sys.mjs:283:18
mailnews.ldap: Connection closed LDAPClient.sys.mjs:255:18


[LDAP server logs]
[01/Dec/2024:15:20:54.474160743 +0100] conn=448 fd=64 slot=64 SSL connection from 79.241.73.58 to 134.102.23.52
[01/Dec/2024:15:20:54.524096314 +0100] conn=448 TLS1.3 128-bit AES-GCM
[01/Dec/2024:15:20:54.524568040 +0100] conn=448 op=0 BIND dn="cn=admin" method=128 version=3
[01/Dec/2024:15:20:54.524657372 +0100] conn=448 op=0 RESULT err=0 tag=97 nentries=0 wtime=0.039902519 optime=0.000096542 etime=0.039997240 dn="cn=admin"
[01/Dec/2024:15:20:54.552183918 +0100] conn=448 op=1 MOD dn="cn=config"
[01/Dec/2024:15:20:55.078009953 +0100] conn=448 op=1 RESULT err=0 tag=103 nentries=0 wtime=0.000072011 optime=0.525829656 etime=0.525899347
[01/Dec/2024:15:20:55.105529729 +0100] conn=448 op=2 UNBIND
[01/Dec/2024:15:20:55.105550620 +0100] conn=448 op=2 fd=64 closed error - U1
[01/Dec/2024:15:21:41.651561743 +0100] conn=449 fd=64 slot=64 SSL connection from 79.241.73.58 to 134.102.23.52
[01/Dec/2024:15:21:41.747860844 +0100] conn=449 TLS1.3 128-bit AES-GCM; client CN=David Rotermund,givenName=David,SN=Rotermund,E=davrot@uni-bremen.de,OID.2.5.4.97=\22GOVDE+HB\22,O=Universit\c3\a4t Bremen,ST=Bremen,C=DE; issuer CN=GEANT Personal CA 4,O=GEANT Vereniging,C=NL
[01/Dec/2024:15:21:41.933016822 +0100] conn=449 TLS1.3 failed to map client certificate to LDAP DN (No such object)
[01/Dec/2024:15:21:41.933083973 +0100] conn=449 op=0 BIND dn="" method=128 version=3
[01/Dec/2024:15:21:41.933144514 +0100] conn=449 op=0 RESULT err=0 tag=97 nentries=0 wtime=0.271628580 optime=0.000063531 etime=0.271690661 dn=""
[01/Dec/2024:15:21:41.964629145 +0100] conn=449 op=1 SRCH base="dc=smime,dc=uni-bremen,dc=de" scope=2 filter="(&(|(cn=*Markus*)(givenName=*Markus*)(sn=*Markus*)(mozillaNickname=*Markus*)(mail=*Markus*)(mozillaSecondEmail=*Markus*)(&(description=*Markus*))(o=*Markus*)(ou=*Markus*)(title=*Markus*)(mozillaWorkUrl=*Markus*)(mozillaHomeUrl=*Markus*)))" attrs=ALL
[01/Dec/2024:15:21:41.974737587 +0100] conn=449 op=1 RESULT err=0 tag=101 nentries=1 wtime=0.000164722 optime=0.010112122 etime=0.010273474 notes=U details="Partially Unindexed Filter"
[01/Dec/2024:15:21:42.046097818 +0100] conn=449 op=2 UNBIND
[01/Dec/2024:15:21:42.046114878 +0100] conn=449 op=2 fd=64 closed error - U1


[01/Dec/2024:15:51:18.107507172 +0100] - DEBUG - NSACLPlugin - aclanom_match_profile - conn=467 op=1: Allow access on entry(uid=k17c,ou=people,dc=smime,dc=uni-bremen,dc=de).attr(cn) to anonymous: acidn="ou=people,dc=smime,dc=uni-bremen,dc=de"
[01/Dec/2024:15:51:18.365823655 +0100] - DEBUG - NSACLPlugin - print_access_control_summary - conn=467 op=1 (main): Allow search on entry(uid=k17c,ou=people,dc=smime,dc=uni-bremen,dc=de).attr(cn) to anonymous: allow anyone aci matched anon user
[01/Dec/2024:15:51:18.490883601 +0100] - DEBUG - NSACLPlugin - aclanom_match_profile - conn=467 op=1: Allow access on entry(uid=k17c,ou=people,dc=smime,dc=uni-bremen,dc=de).attr(NULL) to anonymous: acidn="ou=people,dc=smime,dc=uni-bremen,dc=de"
[01/Dec/2024:15:51:18.732619894 +0100] - DEBUG - NSACLPlugin - aclanom_match_profile - conn=467 op=1: Allow access on entry(uid=k17c,ou=people,dc=smime,dc=uni-bremen,dc=de).attr(objectClass) to anonymous: acidn="ou=people,dc=smime,dc=uni-bremen,dc=de"
[01/Dec/2024:15:51:18.857730019 +0100] - DEBUG - NSACLPlugin - aclanom_match_profile - conn=467 op=1: Allow access on entry(uid=k17c,ou=people,dc=smime,dc=uni-bremen,dc=de).attr(uid) to anonymous: acidn="ou=people,dc=smime,dc=uni-bremen,dc=de"
[01/Dec/2024:15:51:19.108171794 +0100] - DEBUG - NSACLPlugin - aclanom_match_profile - conn=467 op=1: Allow access on entry(uid=k17c,ou=people,dc=smime,dc=uni-bremen,dc=de).attr(cn) to anonymous: acidn="ou=people,dc=smime,dc=uni-bremen,dc=de"
[01/Dec/2024:15:51:19.266020954 +0100] - DEBUG - NSACLPlugin - aclanom_match_profile - conn=467 op=1: Allow access on entry(uid=k17c,ou=people,dc=smime,dc=uni-bremen,dc=de).attr(givenName) to anonymous: acidn="ou=people,dc=smime,dc=uni-bremen,dc=de"
[01/Dec/2024:15:51:19.391300373 +0100] - DEBUG - NSACLPlugin - aclanom_match_profile - conn=467 op=1: Allow access on entry(uid=k17c,ou=people,dc=smime,dc=uni-bremen,dc=de).attr(sn) to anonymous: acidn="ou=people,dc=smime,dc=uni-bremen,dc=de"
[01/Dec/2024:15:51:19.508106493 +0100] - DEBUG - NSACLPlugin - aclanom_match_profile - conn=467 op=1: Allow access on entry(uid=k17c,ou=people,dc=smime,dc=uni-bremen,dc=de).attr(mail) to anonymous: acidn="ou=people,dc=smime,dc=uni-bremen,dc=de"
[01/Dec/2024:15:51:19.675036629 +0100] - DEBUG - NSACLPlugin - aclanom_match_profile - conn=467 op=1: Allow access on entry(uid=k17c,ou=people,dc=smime,dc=uni-bremen,dc=de).attr(userCertificate;binary) to anonymous: acidn="ou=people,dc=smime,dc=uni-bremen,dc=de"



Actual results:

I didn't found / took the certificate. 


Expected results:

It should have taken the certificate and allow me to write an encrypted message to the receiving person.