{"record":{"id":"2546ca347baae956","repo":"apereo/cas","slug":"found-certificate-attribute-but-it-is-not-mar","errorCode":null,"errorMessage":"Found certificate attribute [{}] but it is not marked as a binary attribute","messagePattern":"Found certificate attribute \\[(.+?)\\] but it is not marked as a binary attribute","errorType":"console","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"support/cas-server-support-x509-core/src/main/java/org/apereo/cas/adaptors/x509/authentication/ldap/LdaptiveResourceCRLFetcher.java","lineNumber":98,"sourceCode":"     * @return the x 509 cRL\n     * @throws Exception the exception\n     */\n    protected X509CRL fetchCRLFromLdap(final Object r) throws Exception {\n        try {\n            val ldapURL = r.toString();\n            LOGGER.debug(\"Fetching CRL from ldap [{}]\", ldapURL);\n\n            val result = performLdapSearch(ldapURL);\n            if (result.isSuccess()) {\n                val entry = result.getEntry();\n                val attribute = Objects.requireNonNull(entry.getAttribute(this.certificateAttribute),\n                    () -> String.format(\"Certificate attribute %s does not exist or has no value\", this.certificateAttribute));\n\n                if (attribute.isBinary()) {\n                    LOGGER.debug(\"Located entry [{}]. Retrieving first attribute [{}]\", entry, attribute);\n                    return fetchX509CRLFromAttribute(attribute);\n                }\n                LOGGER.warn(\"Found certificate attribute [{}] but it is not marked as a binary attribute\", this.certificateAttribute);\n            }\n\n            LOGGER.debug(\"Failed to execute the search [{}]\", result);\n            throw new CertificateException(\"Failed to establish a connection ldap and search.\");\n\n        } catch (final Exception e) {\n            LoggingUtils.error(LOGGER, e);\n            throw new CertificateException(e.getMessage());\n        }\n    }\n\n\n    /**\n     * Gets x509 cRL from attribute. Retrieves the binary attribute value,\n     * decodes it to base64, and fetches it as a byte-array resource.\n     *\n     * @param attribute the attribute, which may be null if it's not found\n     * @return the x 509 cRL from attribute","sourceCodeStart":80,"sourceCodeEnd":116,"githubUrl":"https://github.com/apereo/cas/blob/e7288fc434b4f4505b8452e1a57e8fb3111bb863/support/cas-server-support-x509-core/src/main/java/org/apereo/cas/adaptors/x509/authentication/ldap/LdaptiveResourceCRLFetcher.java#L80-L116","documentation":"LdaptiveResourceCRLFetcher found the configured certificateAttribute on the LDAP entry but the attribute is not flagged as binary. CRL data must be fetched in binary mode; without the binary flag the LDAP driver may mangle the DER-encoded CRL, so the fetcher logs a warning and does not use the attribute, ultimately failing the CRL fetch.","triggerScenarios":"fetch() calls fetchCRLFromLdap(); the LDAP search returns an entry whose certificateAttribute exists and has a value, but attribute.isBinary() is false, taking the warn branch instead of parsing the CRL.","commonSituations":"LdapEntryMapper/search config not setting binary attributes (missing binary attribute name in the LdapOperation/binary-attribute settings); LDAP server schema storing CRLs in a non-binary attribute type; wrong attribute name configured so a non-binary text attribute is picked up.","solutions":["Configure the Ldaptive connection/operation to request the attribute as binary (add the attribute name to the binary attribute list in the LDAP configuration).","Verify the configured certificateAttribute name points at the actual CRL attribute (e.g. certificateRevocationList) and not a text attribute.","Ensure the LDAP directory schema defines the CRL attribute with binary syntax so Ldaptive marks it binary on retrieval.","Enable debug logging to inspect the returned entry and confirm attribute names and binary flags, then adjust the mapping accordingly."],"exampleFix":"// before: search without binary attribute handling\nnew SearchOperation(connection, SearchRequest.builder()\n    .baseDn(baseDn).filter(filter).returnAttributes(certificateAttribute).build()).execute();\n// after: mark the attribute as binary\nval request = SearchRequest.builder()\n    .baseDn(baseDn).filter(filter).returnAttributes(certificateAttribute).build();\nrequest.setBinaryAttributes(new String[]{certificateAttribute});","handlingStrategy":"validation","validationCode":"// Verify the attribute exists and is binary before parsing:\nval attribute = entry.getAttribute(certificateAttribute);\nif (attribute == null || attribute.getStringValue() == null) {\n    throw new CertificateException(\"Attribute \" + certificateAttribute + \" missing on entry\");\n}\nif (!attribute.isBinary()) {\n    throw new CertificateException(\"Attribute \" + certificateAttribute + \" must be fetched as binary\");\n}","typeGuard":null,"tryCatchPattern":"try {\n    return fetcher.fetch(ldapResource);\n} catch (CertificateException e) {\n    logger.error(\"Failed to fetch CRL from LDAP; check binary attribute config for {}\", certificateAttribute, e);\n    return cachedCrl;\n}","preventionTips":["Always register the CRL attribute name in the Ldaptive binary-attributes configuration.","Confirm the directory schema defines the CRL attribute with binary/octet-string syntax.","Use the exact attribute name (e.g. certificateRevocationList) from your directory schema.","Test LDAP CRL retrieval after any directory schema or attribute-mapping change."],"tags":["x509","crl","ldap","ldaptive","binary-attribute"],"backgroundTag":"invalid-config-value","analyzedSha":"e7288fc434b4f4505b8452e1a57e8fb3111bb863","analyzedAt":"2026-09-08T15:39:16.015Z","contentChangedAt":"2026-09-08T15:39:16.015Z","schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}