Personal certificates with "sn" and "gn" fields not supported?

[arrabito]

Dear all,

We have an issue with certificates having "sn" and "gn" fields, as in the example below:

/C=DE/O=GridGermany/OU=Max-Planck-Gesellschaft/OU=Max-Planck-Institut fuer Kernphysik/sn=Werner/gn=Felix/CN=Felix Werner

When users issue a proxy with dirac-proxy-init they get:

DN /C=DE/O=GridGermany/OU=Max-Planck-Gesellschaft/OU=Max-Planck-Institut fuer Kernphysik/SN=Werner/GN=Felix/CN=Felix Werner is not registered

I tried to manually change lower case letters to upper case:

/sn=Werner/gn=Felix/ -> /SN=Werner/GN=Felix/

in the CS and it seems to work fine. However, the VOMS2CSAgent then updates again the CS with lower case letters and users cannot issue a proxy anymore.

Is there some fix needed in dirac-proxy-init or in some other component to handle this use case?

Thank you,

Luisa

[marianne013]

We had a similar problem back in June 2019, where the voms server had PostalCode=/STREET=, but the proxy supplied postalCode=/street= which was correct according to @sfayer (there is a standard, I just don't know where). Looking back at the email chain, I have "we filed a ticket", but I cannot find the ticket, Simon might remember.

[marianne013]

I found the ticket: https://ggus.eu/index.php?mode=ticket_info&ticket_id=139345
(GGUS helpfully anonymized me, which seems to have broken the search algorithm. Sigh.)

[fstagni]

I can't easily find a place where DIRAC VOMS2CSAgent manipulates the DN recevived by VOMS. Can you let me know:

• what's the DN in VOMS (admin)?
• if you issue voms-proxy-init on this certificate, what you get?

[arrabito]

Here an example of a problematic DN in VOMS:

[arrabito]

Then:

dirac-proxy-init
DN /C=DE/O=GridGermany/OU=Max-Planck-Gesellschaft/OU=Max-Planck-Institut fuer Kernphysik/SN=Werner/GN=Felix/CN=Felix Werner is not registered

[fstagni]

Can you do voms-proxy-init instead of dirac-proxy-init?

[arrabito]

I've asked the user. I let you know as soon as I get the answer.
Thank you.

[fstagni]

Up! Just to know more info...