679389 - retrieving S/MIME certificates from LDAP server does not work anymore

Status: RESOLVED DUPLICATE of bug 572074

(Thunderbird :: Address Book, defect)

Description

[Ingo Rogalsky]

User Agent: Mozilla/5.0 (X11; Linux x86_64; rv:5.0.1) Gecko/20100101 Firefox/5.0.1
Build ID: 20110707182747

Steps to reproduce:

Thunderbird 5 is configured with a LDAP address book. 


Actual results:

Looking up persons in the LDAP server works. But Thunderbird isn't able to fetch the S/MIME certificate of a person stored in the LDAP database. I looked at the network traffic between the client and the LDAP server with Wireshark. There are two LDAP queries. The first one searches for the person. If one clicks to the button "View Security Info" or if one tries to send the mail the second query occures, which should fetch the certificate. Thunderbird looks for the person, but it does not ask for the attribute "userCertificate". And the LDAP server does not include this attribute in its answer.

I did my tests with Thunderbird on a Linux box (Debian 6, 64 Bit). But Windows users I asked for,  reported the same problem.

Some debug output:

NSPR_LOG_MODULES=ldap:5 /sw/mozilla/bin/thunderbird-5
-1239468000[7f38aa910040]: nsLDAPOperation::SimpleBind(): called; bindName = ''; 
-1239468000[7f38aa910040]: pending operation added; total pending operations now = 1
-1239468000[7f38aa910040]: nsLDAPOperation::SearchExt(): called with aBaseDn = 'dc=local'; aFilter = '(|(cn=someuser**)(mail=someuser**)(sn=someuser**))'; aAttributes = cn,mail; aSizeLimit = 100
-1239468000[7f38aa910040]: pending operation added; total pending operations now = 2
-1982859520[7f3895524590]: pending operation removed; total pending operations now = 1
-1982859520[7f3895524590]: pending operation removed; total pending operations now = 0
-1239468000[7f38aa910040]: nsLDAPOperation::SimpleBind(): called; bindName = ''; 
-1239468000[7f38aa910040]: pending operation added; total pending operations now = 1
-1239468000[7f38aa910040]: nsLDAPOperation::SearchExt(): called with aBaseDn = 'dc=local'; aFilter = '(mail=somuser@domain)'; aAttributes = 1; aSizeLimit = 0
-1239468000[7f38aa910040]: pending operation added; total pending operations now = 2
-1991252224[7f38955257a0]: pending operation removed; total pending operations now = 1
-1239468000[7f38aa910040]: nsLDAPMessage::GetBinaryValues(): ldap_get_values returned LDAP_DECODING_ERROR
-1991252224[7f38955257a0]: pending operation removed; total pending operations now = 0



Expected results:

I verified this issue with Thunderbird 3.1.10 and the same profile.  Fetching the certificate works with this version. And I see with Wirkshark, that Thunderbird is looking for the attribute "userCertificate".

Debug output from Thunderbird 3.1:

NSPR_LOG_MODULES=ldap:5 /sw/mozilla/bin/thunderbird-3
-468726928[e59337c0]: nsLDAPConnection::Run() entered
-162400400[f630f060]: nsLDAPOperation::SimpleBind(): called; bindName = ''; 
-162400400[f630f060]: pending operation added; total pending operations now = 1
-162400400[f630f060]: nsLDAPOperation::SearchExt(): called with aBaseDn = 'dc=local'; aFilter = '(|(cn=someuser**)(mail=someuser**)(sn=someuser**))', aAttrCounts = 2, aSizeLimit = 100
-162400400[f630f060]: pending operation added; total pending operations now = 2
-468726928[e59337c0]: pending operation removed; total pending operations now = 1
-468726928[e59337c0]: pending operation removed; total pending operations now = 0
-451941520[f441a0e0]: nsLDAPConnection::Run() entered
-162400400[f630f060]: nsLDAPOperation::SimpleBind(): called; bindName = ''; 
-162400400[f630f060]: pending operation added; total pending operations now = 1
-162400400[f630f060]: nsLDAPOperation::SearchExt(): called with aBaseDn = 'dc=local'; aFilter = '(mail=someouser@domain)', aAttrCounts = 1, aSizeLimit = 2
-162400400[f630f060]: pending operation added; total pending operations now = 2
-451941520[f441a0e0]: pending operation removed; total pending operations now = 1
-451941520[f441a0e0]: pending operation removed; total pending operations now = 0

Unfortunately one can't recoqnize here, whether Thunderbird is looking for "userCertificate". But there are small differences compared to the output of Thunderbird 5. "aAttrCounts" seems to have the new name "aAttributes" and "aSizeLimit" is "0" with Thunderbird 5 and "2" with Thunderbird 3.

Comment 1

[Mark Banner (:standard8)]

Duplicate of bug 572074 which has been fixed in Thunderbird 6 which has just been released.

Comment 2

[Ingo Rogalsky]

Sorry for this unnecessary bug report. I didn't found the duplicate yesterday. Indeed, Thunderbird 6 fixes this issue.

Thanks.