Length of user_name in database too short for X.509 DNs

[Alvaro Lopez]

We are using the REMOTE_AUTH authentication with X.509 certificates, setting the username to the user certificate's DN. However, the name column in the SQL backend is limited to 64 characters, but the certificate DN can be longer than that so we are unable to add some of our users.

[Adam Young (ayoung)]

An example one, a bit on the long side is

dn="DN=macgregor,cn=PUBLICTEST09,cn=FEDORAPROJECT,cn=ORG"

In [2]: len(dn)
Out[2]: 52

How long do you need them to be?

[Alvaro Lopez (aloga)]

Hi,

some real examples of DNs really really long (personal details are removed):

/C=IT/O=INFN/OU=Personal Certificate/L=University of Perugia Dept Maths and CompSci/CN=XXXXXXXXXXXXXXXXXXXXX
/DC=com/DC=quovadisglobal/DC=grid/DC=switch/DC=users/C=CH/O=Paul-Scherrer-Institut (PSI)/CN=XXXXXXXXXXXXXXXX
/DC=org/DC=terena/DC=tcs/C=NL/O=Stichting Academisch Rekencentrum Amsterdam/CN=XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
/DC=ORG/DC=SEE-GRID/O=People/O=Georgian Research and Educational Networking Association/CN=XXXXXXXXXXXXXXXXXXXX

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/22694

[Dolph Mathews (dolph)]

Patch appears to be abandoned.

[Alvaro Lopez (aloga)]

@Dolhp, sorry, the patch should be still valid but I was overhelmed by other work and couldn't have a look at this.

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/22694
Committed: http://github.com/openstack/keystone/commit/8d6055ede4131a5ab7829561123798fd3807cc34
Submitter: Jenkins
Branch: master

commit 8d6055ede4131a5ab7829561123798fd3807cc34
Author: Alvaro Lopez Garcia <email address hidden>
Date: Tue Dec 18 15:56:20 2012 +0100

    Increase length of username in DB

    Length of username in database may be too short for X.509 DNs and 255
    seems a sane value for it.

    Fixes bug #1081932

    Change-Id: Ie8f696845ea15d37cf13f3fe7978b22deac798b0