[vharseko]

Summary

Code scanning triage of the open alerts on master.

Dependencies

• Import the openicf 2.1.0-SNAPSHOT BOM instead of 2.0.4.

The 2.1.0-SNAPSHOT deployed on 2026-10-29 pins OpenDJ 5.2.0 → commons 3.2.2. The build therefore gets jackson 2.18.11, bcprov 1.86 and freemarker 2.3.35, and xml-connector embeds lib/xercesImpl-2.12.2.jar. This fixes the Trivy findings on the build for #933, #935, #939, #940, #947–#963. Guava 33.7.2 (#1006) follows once OpenIdentityPlatform/OpenDJ#1243 and OpenIdentityPlatform/OpenICF#210 are merged and their snapshots redeployed. Alerts that the image scans also report on the published 7.1.2 images stay open until the next release image is scanned.

Default certificates with BouncyCastle 1.85+

bcprov 1.85, the first release with the fixes for CVE-2026-8763 and CVE-2026-13506, checks in BCStyle that the C (2.5.4.6) attribute is a two-letter ISO 3166-1 code. CertUtil.generateCertificate added C=None for the default certificates. Two callers failed with IllegalArgumentException: country code attribute 2.5.4.6 must be exactly 2 characters per ISO 3166-1 / X.520, got 4: 'None':

• DefaultKeyStoreInitializer, which creates the self-service and openidm-localhost certificates when the keystore lacks them (the 4 openidm-keystore test failures in the previous CI run);
• the generateCert action of KeystoreResourceProvider, through the short generateCertificate overload.

CertUtil encodes the legacy C=None placeholder directly, preserving the default subject DN used by OpenDJ password sync. A null country omits C; ordinary country codes still go through BouncyCastle's validation. CertUtilTest covers the full default DN, the short overload, a null country and a real country code.

SecurityResourceProvider.generateCSR also defaults to C=None, but it goes through X509Principal/X509Name, which bcprov 1.86 does not validate, so it is unchanged here.

CodeQL note-level findings

Alert	File	Change
#974 java/local-variable-is-never-read	RepoJobStore	Drop the unused jobKey local.
#967 js/unused-local-variable	populateAsManagedUser.js	Drop the unused propertyMapping.
#966 js/unused-local-variable	TemporalConstraintsFormView.js	Drop the unused constraint.

Dismissed as won't fix (1):

• #975 java/non-static-nested-class (RepoJobStore.TriggerComparator): the same finding as #444, dismissed in Fix CodeQL note-level Java cleanups #212. The class is protected in the exported org.forgerock.openidm.quartz.impl; making it static drops the outer instance from its constructor descriptor and breaks subclasses compiled against 7.1.2. An earlier revision of this PR made it static; that is reverted.

Dismissed as false positives (5):

• #972, #973 java/sensitive-log (MappedTableHandler, PostgreSQLMappedTableHandler): they log SQL templates that contain only placeholders. This is the same statement as the previously dismissed Admin-Password cannot be changed via self-service ui #10 and Does not work with OpenJDK 11 #12.
• #968, #969, #971 js/unused-local-variable (router-authz.js): the helpers are called by name from the customAuthz expressions in access.js.

Test plan

• In the previous revision, CertUtilTest failed against bcprov 1.86 before the initial fix, with the same message as CI, and passed after it.
• In the previous revision, full mvn -U verify locally on JDK 27 against openicf 2.1.0-20261029.125007-28: 49/49 modules, no test failures, including the 5 openidm-keystore tests and KeystoreResourceProviderTest testActionGenerateCert / testActionGenerateCSR. The zip ships bcprov 1.86, jackson 2.18.11, freemarker 2.3.35 and the xml-connector snapshot.
• node --check on both edited JS files
• After the review fix, mvn -o -pl openidm-util,openidm-keystore,openidm-security -am test on JDK 27 with bcprov 1.86: all 12 reactor modules passed, including 5 keystore and 18 security tests. The default-DN tests failed before the fix as expected.
• Full build in CI
• CodeQL on this PR closes #966, #967, #974

[vharseko]

@maximthomas, a new round since your approval of 4a792f3, in 6772c96:

• CI was red for a real reason, not because of a stale snapshot. The openicf 2.1.0-SNAPSHOT now pins OpenDJ 5.2.0 → commons 3.2.2, which brings bcprov 1.86. Since 1.85, BCStyle accepts only a two-letter ISO 3166-1 code for C, and CertUtil.generateCertificate added C=None to the default certificates. Keystore initialisation (DefaultKeyStoreInitializer) and the keystore generateCert action both failed with country code attribute 2.5.4.6 must be exactly 2 characters ... got 4: 'None'. CertUtil now leaves C out for null or "None", and CertUtilTest covers both overloads and a real country code. bcprov 1.85 is the first release with the fix for CVE-2026-8763, so the bump cannot go in without this change.
• TriggerComparator is non-static again. The first revision made it static for code scanning alert 975, but that is the same finding as alert 444, dismissed in Fix CodeQL note-level Java cleanups #212: the class is protected in an exported package, so the change breaks subclasses compiled against 7.1.2. Alert 975 is now dismissed as won't fix with the same comment.

A full local mvn -U verify on JDK 27 passes on all 49 modules. The description is updated to match.

[maximthomas]

praise: The fix for the bcprov 1.86 failure sits where the failure starts, and the description's claims hold.

• CertUtil.generateCertificate guards the C RDN on the one road that both default-certificate callers take (DefaultKeyStoreInitializer and the short overload used by generateCert). On the ubuntu-latest JDK 27 leg, openidm-keystore passes 5/5 on the shipped bcprov 1.86, and openidm-util goes from 156 to 159 tests with the same 5 skipped.
• The SecurityResourceProvider.generateCSR claim checks out. testActionGenerateCSR sends only alias and CN, so it takes the default C=None through X509Principal, and openidm-security passes 18/18 on the same leg.

---

issue (blocking): A fresh install now generates openidm-localhost without a C RDN, so the subject DN that the guide and OpenDJ's password-sync plugin configure no longer matches it.

openidm-util/src/main/java/org/forgerock/openidm/util/CertUtil.java:106-110, openidm-doc/src/main/asciidoc/integrators-guide/chap-passwords.adoc:439-440, :648

Both default roads pass "None". On a fresh install, openidm-localhost (DefaultKeyStoreInitializer.java:144) used to get CN=localhost, O=OpenIDM Self-Signed Certificate, OU=None, L=None, ST=None, C=None. It now gets the same DN without C. The integrator's guide still gives the old DN as the ds-cfg-certificate-subject-dn default and in the keytool output, and so does OpenDJ's shipped openidm-accountchange-plugin-sample-config:16. The plugin's findCertificateBySubject (OpenidmAccountStatusNotificationHandler.java:363-373) compares with X500Principal.equals. On a miss it throws ConfigException, the handler does not initialise, and no password syncs from OpenDJ. Existing installs keep their stored certificate. A probe on bcprov 1.86 shows that the placeholder can be encoded directly: the certificate builds and converts, and its subject equals new X500Principal(<guide DN>).

import org.bouncycastle.asn1.DERPrintableString;
...
        X500NameBuilder builder = new X500NameBuilder(BCStyle.INSTANCE);
        if ("None".equals(country)) {
            // "None" is the placeholder the default certificates use. BouncyCastle 1.85+ rejects it as a string
            // value for C, so it is encoded directly to keep the subject DN that the integrator's guide and the
            // OpenDJ password sync plugin configure
            builder.addRDN(BCStyle.C, new DERPrintableString(country));
        } else if (country != null) {
            builder.addRDN(BCStyle.C, country);
        }

Javadoc at :85: "the subject's two-letter ISO 3166-1 country code, "None" for the default certificates' placeholder, or {@code null} to omit it". In CertUtilTest, rename both tests to match. testGenerateCertificateOmitsNoneCountry asserts that pair.getKey().getSubjectX500Principal() equals new X500Principal("CN=localhost, O=OpenIDM Self-Signed Certificate, OU=None, L=None, ST=None, C=None"). testGenerateCertificateWithCommonNameOnlyHasNoCountry asserts that C is "None".

Or: keep the C-less DN. Then this PR updates chap-passwords.adoc:439-440 and :648, and the release note says that fresh installs must drop , C=None from the plugin's ds-cfg-certificate-subject-dn; OpenDJ's sample config needs the same change. Neither option was run against DefaultKeyStoreInitializerTest or KeystoreResourceProviderTest, or checked on bcprov versions other than 1.86.

---

suggestion (non-blocking): No test passes a null country, so nothing pins the country != null half of the guard.

openidm-util/src/main/java/org/forgerock/openidm/util/CertUtil.java:108, openidm-util/src/test/java/org/forgerock/openidm/util/CertUtilTest.java

All three cases pass a non-null country: "None" through both overloads, and "US". Deleting country != null && leaves the suite green (3/3 on a HEAD export). Under that mutant a null country throws an NPE from X500NameBuilder.addRDN, which breaks the Javadoc's "null omits C". BASE threw the same NPE, so this behaviour is new and nothing pins it.

    @Test
    public void testGenerateCertificateOmitsNullCountry() throws Exception {
        final Pair<X509Certificate, PrivateKey> pair = CertUtil.generateCertificate("localhost",
                "Example", "IT", "California", null, "San Francisco",
                ALGORITHM, KEY_SIZE, SIGNATURE_ALGORITHM, null, null);

        assertThat(subjectOf(pair.getKey()).getRDNs(BCStyle.C)).isEmpty();
    }

Pin: this case passes at the head, fails with the NPE under the mutant, and still holds with the fix above.

[vharseko]

@maximthomas, both points are addressed in 6fd50d0; the branch is also rebased on current master.

• CertUtil encodes the legacy C=None placeholder directly as a DERPrintableString, preserving the default certificate subject used by the guide and OpenDJ password sync. Other country codes still go through BouncyCastle's string validation, and null omits C.
• CertUtilTest checks the full default subject with X500Principal, the short overload's placeholder, a real country code, and the null case. Both placeholder tests fail before the fix.

On JDK 27 with bcprov 1.86, mvn -o -pl openidm-util,openidm-keystore,openidm-security -am test passes all 12 reactor modules, including 5 keystore and 18 security tests. The PR description is updated.

[maximthomas]

praise: The round-1 subject-DN regression is fixed where it started, and BouncyCastle still checks real country codes.

• CertUtil.generateCertificate (CertUtil.java:110-111) writes C=None as a DERPrintableString. On bcprov 1.86 this gives the same X500Name bytes that bcprov 1.84's string road wrote at the base, so openidm-localhost keeps the DN that OpenDJ password sync looks up.
• testGenerateCertificateKeepsDefaultSubject checks the whole default DN through X500Principal, and testGenerateCertificateOmitsNullCountry covers the country != null branch.
• At this head on bcprov 1.86, DefaultKeyStoreInitializerTest passes 2/2, KeystoreResourceProviderTest 4/4 and ManagedObjectApiDescriptionTest 10/10 (with api-descriptor 3.2.2).