freeipa

#9866 [BUG] ATTR_NAME_BY_OID is missing OID 2.5.4.97, organizationIdentifier
Closed: fixed by sumenon. Opened by kororland.

Closed: fixed
Reopen Issue

What were you trying to do that didn't work?

trying to install ipa with IPA's CA cetificate with OID 2.5.4.97, organizationIdentifier, in the DN, fails because it's missing from ATTR_NAME_BY_OID

What is the impact of this issue to you?

Compliance to EU regulations

Please provide the package NVR for which the bug is seen:

ipa-server-4.12.2-14.el9_6.5.x86_64

How reproducible is this bug?:

always

Steps to reproduce

  • sign the CSR with CA that has OID 2.5.4.97 in subject DN
  • try to install it either during two-step IPA installation, or via ipa-cacert-manage renew
  • Installation fails with error
    [error] InvalidSyntax: ipaCaIssuerDN: value #0 invalid per syntax: Invalid syntax.

Copy of RHEL-122767.

Metadata Update from @frenaud:
- Custom field rhbz adjusted to https://issues.redhat.com/browse/RHEL-122767

PR, WIP - https://github.com/freeipa/freeipa/pull/7990

master:

  • e0b9ad0ae00ea478b6603fb56c9b369afd957d34 Correctly recognize OID 2.5.4.97, organizationIdentifier as a subject/issuer DN of the CA certificate

ipa-4-12:

  • 8905bbf7a9ad7aefc9ddad9ccdbfb050c8429863 Correctly recognize OID 2.5.4.97, organizationIdentifier as a subject/issuer DN of the CA certificate

Metadata Update from @sumenon:
- Issue close_status updated to: fixed
- Issue status updated to: Closed (was: Open)
Metadata
None
None
None
None
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.