apereo/cas · warning

Found certificate attribute

Error message

Found certificate attribute [{}] but it is not marked as a binary attribute

What it means

LdaptiveResourceCRLFetcher found the configured certificateAttribute on the LDAP entry but the attribute is not flagged as binary. CRL data must be fetched in binary mode; without the binary flag the LDAP driver may mangle the DER-encoded CRL, so the fetcher logs a warning and does not use the attribute, ultimately failing the CRL fetch.

Solutions

1. Configure the Ldaptive connection/operation to request the attribute as binary (add the attribute name to the binary attribute list in the LDAP configuration).
2. Verify the configured certificateAttribute name points at the actual CRL attribute (e.g. certificateRevocationList) and not a text attribute.
3. Ensure the LDAP directory schema defines the CRL attribute with binary syntax so Ldaptive marks it binary on retrieval.
4. Enable debug logging to inspect the returned entry and confirm attribute names and binary flags, then adjust the mapping accordingly.

Example fix

// before: search without binary attribute handling
new SearchOperation(connection, SearchRequest.builder()
    .baseDn(baseDn).filter(filter).returnAttributes(certificateAttribute).build()).execute();
// after: mark the attribute as binary
val request = SearchRequest.builder()
    .baseDn(baseDn).filter(filter).returnAttributes(certificateAttribute).build();
request.setBinaryAttributes(new String[]{certificateAttribute});

// Verify the attribute exists and is binary before parsing:
val attribute = entry.getAttribute(certificateAttribute);
if (attribute == null || attribute.getStringValue() == null) {
    throw new CertificateException("Attribute " + certificateAttribute + " missing on entry");
}
if (!attribute.isBinary()) {
    throw new CertificateException("Attribute " + certificateAttribute + " must be fetched as binary");
}

try {
    return fetcher.fetch(ldapResource);
} catch (CertificateException e) {
    logger.error("Failed to fetch CRL from LDAP; check binary attribute config for {}", certificateAttribute, e);
    return cachedCrl;
}

When it happens

Trigger: fetch() calls fetchCRLFromLdap(); the LDAP search returns an entry whose certificateAttribute exists and has a value, but attribute.isBinary() is false, taking the warn branch instead of parsing the CRL.

Common situations: LdapEntryMapper/search config not setting binary attributes (missing binary attribute name in the LdapOperation/binary-attribute settings); LDAP server schema storing CRLs in a non-binary attribute type; wrong attribute name configured so a non-binary text attribute is picked up.

Understand the failure class

Background: "Invalid value" and "allowed values are" config errors: what your library rejected and how to fix it — this error's family across 41 libraries.

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

• Failed to establish a connection ldap and search.
• Could not decode provided CRL file
• Unknown CRL reason code.
• Unable to fetch [ ]
• CRL data is not available for

AI-assisted analysis of apereo/cas@e7288fc434 (2026-09-08). Data as JSON: /api/errors/2546ca347baae956. Report an issue: GitHub.

Appendix: source

Thrown at support/cas-server-support-x509-core/src/main/java/org/apereo/cas/adaptors/x509/authentication/ldap/LdaptiveResourceCRLFetcher.java:98

     * @return the x 509 cRL
     * @throws Exception the exception
     */
    protected X509CRL fetchCRLFromLdap(final Object r) throws Exception {
        try {
            val ldapURL = r.toString();
            LOGGER.debug("Fetching CRL from ldap [{}]", ldapURL);

            val result = performLdapSearch(ldapURL);
            if (result.isSuccess()) {
                val entry = result.getEntry();
                val attribute = Objects.requireNonNull(entry.getAttribute(this.certificateAttribute),
                    () -> String.format("Certificate attribute %s does not exist or has no value", this.certificateAttribute));

                if (attribute.isBinary()) {
                    LOGGER.debug("Located entry [{}]. Retrieving first attribute [{}]", entry, attribute);
                    return fetchX509CRLFromAttribute(attribute);
                }
                LOGGER.warn("Found certificate attribute [{}] but it is not marked as a binary attribute", this.certificateAttribute);
            }

            LOGGER.debug("Failed to execute the search [{}]", result);
            throw new CertificateException("Failed to establish a connection ldap and search.");

        } catch (final Exception e) {
            LoggingUtils.error(LOGGER, e);
            throw new CertificateException(e.getMessage());
        }
    }


    /**
     * Gets x509 cRL from attribute. Retrieves the binary attribute value,
     * decodes it to base64, and fetches it as a byte-array resource.
     *
     * @param attribute the attribute, which may be null if it's not found
     * @return the x 509 cRL from attribute

View on GitHub (pinned to e7288fc434)