Payara 5.184: Certificate Realm not supporting OID e-mailAddress (1.2.840.113549.1.9.1) anymore. PAYARA-3417

[KriechelD]

Description

---

When using Client-Certificate Authentication in web.xml:

<login-config>
	<auth-method>CLIENT-CERT</auth-method>
	<realm-name>certificate</realm-name>
</login-config>

In Payara 5.183 our certificate was converted to the principal name:

CN=*.somedomain.de, EMAILADDRESS=somemail@somedomain.de, L=SomeTown, ST=SomeState, OU=Something, O=CompanyName, C=DE

Expected Outcome

In Payara 5.184 there have been some changes under the hood, related to the security implementation such as client certificate authentication: https://blog.payara.fish/new-feature-in-payara-server-5.184-allow-use-of-different-security-providers-via-jce-api

The article states, that there are no more empty spaces (", "), between the certificate propertys, so since Payara 5.184 the expected outcome should be:

CN=*.somedomain.de,EMAILADDRESS=somemail@somedomain.de,L=SomeTown,ST=SomeState,OU=Something,O=CompanyName,C=DE

Thats why @arjantijms changed the javaee7-samples (javaee-samples/javaee7-samples@daf9f87) to match the new payara 5.184 behavior.

Current Outcome

The empty spaces have actually disappeard, but now the new outcome is as follow:

CN=*.somedomain.de,1.2.840.113549.1.9.1=#161a6e65746d616e61676572406c6f74746f2d68657373656e2e6465,L=SomeTown,ST=SomeState,OU=Something,O=CompanyName,C=DE

As you can see, EMAILADDRESS has changed to 1.2.840.113549.1.9.1. This is the OID for e-MailAddress, as you can see here: http://oid-info.com/get/1.2.840.113549.1.9.1

Somehow, the support for this OID is missing in 5.184. Can you please check this and provide me an advice how to get back the old functionality?

Environment

• Payara Version: 5.184
• Edition: Full
• JDK Version: 8u191 - OpenJDK
• Operating System: Linux

[KriechelD]

@smillidge Can someone please have a look at this issue?

[smillidge]

We welcome PRs.

[KriechelD]

I would like to provide a PR 😃

But I was not able to track down where exactly this behavioir is coming from. In Payara 5.183 the conversion for OID e-mailAddress (1.2.840.113549.1.9.1) was correct, but I don't know which part of payara is responsible for the handling this.

So if someone directs me on the right location, I like to contribute my part 😁

[OndroMih]

We're going to improve this behavior based on a feedback from our customers. Stay tuned for more info soon.

[KriechelD]

The problem was fixed by #4042