{"record":{"id":"6ff4e4a32d04228d","repo":"nats-io/nats-server","slug":"invalid-type-name-v","errorCode":null,"errorMessage":"invalid type name: %+v","messagePattern":"invalid type name: %\\+v","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/ldap/dn.go","lineNumber":58,"sourceCode":"}\n\n// DN represents a distinguishedName from https://tools.ietf.org/html/rfc4514\ntype DN struct {\n\tRDNs []*RelativeDN\n}\n\n// FromCertSubject takes a pkix.Name from a cert and returns a DN\n// that uses the same set.  Does not support multi value RDNs.\nfunc FromCertSubject(subject pkix.Name) (*DN, error) {\n\tdn := &DN{\n\t\tRDNs: make([]*RelativeDN, 0),\n\t}\n\tfor i := len(subject.Names) - 1; i >= 0; i-- {\n\t\tname := subject.Names[i]\n\t\toidString := name.Type.String()\n\t\ttypeName, ok := attributeTypeNames[oidString]\n\t\tif !ok {\n\t\t\treturn nil, fmt.Errorf(\"invalid type name: %+v\", name)\n\t\t}\n\t\tv, ok := name.Value.(string)\n\t\tif !ok {\n\t\t\treturn nil, fmt.Errorf(\"invalid type value: %+v\", v)\n\t\t}\n\t\trdn := &RelativeDN{\n\t\t\tAttributes: []*AttributeTypeAndValue{\n\t\t\t\t{\n\t\t\t\t\tType:  typeName,\n\t\t\t\t\tValue: v,\n\t\t\t\t},\n\t\t\t},\n\t\t}\n\t\tdn.RDNs = append(dn.RDNs, rdn)\n\t}\n\treturn dn, nil\n}\n","sourceCodeStart":40,"sourceCodeEnd":76,"githubUrl":"https://github.com/nats-io/nats-server/blob/3a66a489d262bf89b71a71c955c94920394532f3/internal/ldap/dn.go#L40-L76","documentation":"FromCertSubject converts an x509 certificate subject into the library's DN representation by mapping each RDN name's OID (name.Type.String()) through the attributeTypeNames lookup table. If an OID in the certificate subject has no entry in that table, the conversion fails since the library cannot express that attribute type.","triggerScenarios":"FromCertSubject is called with a cert whose subject.Names contains an attribute OID not present in attributeTypeNames (only common standard OIDs like CN, O, OU, C, ST, L, etc. are mapped).","commonSituations":"Certificates issued with unusual or custom extension attributes in the subject (e.g. enterprise-specific OIDs, emailAddress variants, serialNumber, DC components), or certificates from non-standard CAs using OIDs the table doesn't cover.","solutions":["Add the missing OID-to-name mapping to attributeTypeNames in internal/ldap/dn.go and rebuild.","Reissue/obtain a certificate whose subject uses only standard supported attributes.","Filter or transform the certificate subject before calling FromCertSubject to drop unsupported attributes.","Report the missing OID upstream so the table can be extended."],"exampleFix":"// before (dn.go)\nvar attributeTypeNames = map[string]string{\n\t\"2.5.4.3\": \"CN\",\n\t\"2.5.4.10\": \"O\",\n}\n// after\nvar attributeTypeNames = map[string]string{\n\t\"2.5.4.3\": \"CN\",\n\t\"2.5.4.10\": \"O\",\n\t\"0.9.2342.19200300.100.1.25\": \"DC\", // add missing OID\n}","handlingStrategy":"try-catch","validationCode":"for _, n := range cert.Subject.Names {\n\tif _, ok := attributeTypeNames[n.Type.String()]; !ok {\n\t\treturn fmt.Errorf(\"unsupported subject OID %s\", n.Type.String())\n\t}\n}","typeGuard":null,"tryCatchPattern":"dn, err := ldap.FromCertSubject(cert)\nif err != nil {\n\tif strings.Contains(err.Error(), \"invalid type name\") {\n\t\t// fall back to raw subject string or reissue the cert\n\t\treturn cert.Subject.String(), nil\n\t}\n\treturn \"\", err\n}","preventionTips":["Request certificates with only standard subject attributes (CN, O, OU, C, ST, L).","Inspect subject OIDs with `openssl x509 -text` before integration.","Extend attributeTypeNames for OIDs your CA legitimately uses."],"tags":["ldap","x509","certificate","dn","oid"],"backgroundTag":"unsupported-certificate-subject-attribute","analyzedSha":"3a66a489d262bf89b71a71c955c94920394532f3","analyzedAt":"2026-09-02T04:41:54.247Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}