Bump OpenICF to 2.1.0-SNAPSHOT and fix CodeQL note-level findings

openidm-quartz-fragment/src/main/java/org/forgerock/openidm/quartz/impl/RepoJobStore.java

@@ -1380,7 +1380,6 @@ public void triggeredJobComplete(SchedulingContext context, Trigger trigger,
             JobDetail jobDetail, int triggerInstCode) throws JobPersistenceException {
         synchronized(lock) {
             logger.debug("Job {} has completed", jobDetail.getFullName());
-            String jobKey = getJobNameKey(jobDetail);
             JobWrapper jw = getJobWrapper(jobDetail.getGroup(), jobDetail.getName());
             JsonValue triggerValue = getTriggerFromRepo(trigger.getGroup(), trigger.getName());
             TriggerWrapper tw = null;

openidm-ui/openidm-ui-admin/src/main/js/org/forgerock/openidm/ui/admin/role/TemporalConstraintsFormView.js

@@ -172,7 +172,6 @@ define([
         },
         adjustDateToTimezone : function (e) {
             var newTimezone = $(e.target).val(),
-                constraint = $(e.target).closest(".temporalConstraint"),
                 formValue;
 
             this.data.timezone = newTimezone;

openidm-util/src/main/java/org/forgerock/openidm/util/CertUtil.java

@@ -12,6 +12,7 @@
  * information: "Portions copyright [year] [name of copyright owner]".
  *
  * Copyright 2016 ForgeRock AS.
+ * Portions Copyright 2026 3A Systems, LLC.
  */
 package org.forgerock.openidm.util;
 
@@ -28,6 +29,7 @@
 import java.util.List;
 
 import org.apache.commons.lang3.tuple.Pair;
+import org.bouncycastle.asn1.DERPrintableString;
 import org.bouncycastle.asn1.x500.X500NameBuilder;
 import org.bouncycastle.asn1.x500.style.BCStyle;
 import org.bouncycastle.cert.X509v3CertificateBuilder;
@@ -81,7 +83,8 @@ public static Pair<X509Certificate, PrivateKey> generateCertificate(String commo
      * @param organization the subject's organization name
      * @param organizationUnit the subject's organization unit name
      * @param stateOrProvince the subject's state or province
-     * @param country the subject's country code
+     * @param country the subject's two-letter ISO 3166-1 country code, "None" for the default certificates'
+     *     placeholder, or {@code null} to omit it
      * @param locality the subject's locality
      * @param algorithm the algorithm to use
      * @param keySize the keysize to use
@@ -102,7 +105,13 @@ public static Pair<X509Certificate, PrivateKey> generateCertificate(String commo
 
         // Generate self-signed certificate
         X500NameBuilder builder = new X500NameBuilder(BCStyle.INSTANCE);
-        builder.addRDN(BCStyle.C, country);
+        // Preserve the default subject DN used by OpenDJ password sync. BouncyCastle 1.85+
+        // rejects the legacy "None" placeholder when it encodes C from a string.
+        if ("None".equals(country)) {
+            builder.addRDN(BCStyle.C, new DERPrintableString(country));
+        } else if (country != null) {
+            builder.addRDN(BCStyle.C, country);
+        }
         builder.addRDN(BCStyle.ST, stateOrProvince);
         builder.addRDN(BCStyle.L, locality);
         builder.addRDN(BCStyle.OU, organizationUnit);

openidm-util/src/test/java/org/forgerock/openidm/util/CertUtilTest.java

@@ -0,0 +1,95 @@
+/*
+ * The contents of this file are subject to the terms of the Common Development and
+ * Distribution License (the License). You may not use this file except in compliance with the
+ * License.
+ *
+ * You can obtain a copy of the License at legal/CDDLv1.0.txt. See the License for the
+ * specific language governing permission and limitations under the License.
+ *
+ * When distributing Covered Software, include this CDDL Header Notice in each file and include
+ * the License file at legal/CDDLv1.0.txt. If applicable, add the following below the CDDL
+ * Header, with the fields enclosed by brackets [] replaced by your own identifying
+ * information: "Portions copyright [year] [name of copyright owner]".
+ *
+ * Copyright 2026 3A Systems, LLC.
+ */
+package org.forgerock.openidm.util;
+
+import static org.assertj.core.api.Assertions.assertThat;
+
+import java.security.PrivateKey;
+import java.security.Security;
+import java.security.cert.X509Certificate;
+import javax.security.auth.x500.X500Principal;
+
+import org.apache.commons.lang3.tuple.Pair;
+import org.bouncycastle.asn1.ASN1ObjectIdentifier;
+import org.bouncycastle.asn1.x500.X500Name;
+import org.bouncycastle.asn1.x500.style.BCStyle;
+import org.bouncycastle.asn1.x500.style.IETFUtils;
+import org.bouncycastle.cert.jcajce.JcaX509CertificateHolder;
+import org.bouncycastle.jce.provider.BouncyCastleProvider;
+import org.testng.annotations.BeforeClass;
+import org.testng.annotations.Test;
+
+public class CertUtilTest {
+
+    private static final String ALGORITHM = "RSA";
+    private static final int KEY_SIZE = 2048;
+    private static final String SIGNATURE_ALGORITHM = "SHA512WithRSAEncryption";
+
+    @BeforeClass
+    public void addBouncyCastleProvider() {
+        Security.addProvider(new BouncyCastleProvider());
+    }
+
+    @Test
+    public void testGenerateCertificateWithCommonNameOnlyKeepsPlaceholderCountry() throws Exception {
+        final Pair<X509Certificate, PrivateKey> pair = CertUtil.generateCertificate("localhost",
+                ALGORITHM, KEY_SIZE, SIGNATURE_ALGORITHM, null, null);
+
+        final X500Name subject = subjectOf(pair.getKey());
+        assertThat(valueOf(subject, BCStyle.C)).isEqualTo("None");
+        assertThat(valueOf(subject, BCStyle.CN)).isEqualTo("localhost");
+    }
+
+    @Test
+    public void testGenerateCertificateKeepsDefaultSubject() throws Exception {
+        // the placeholders DefaultKeyStoreInitializer passes for the default certificates
+        final Pair<X509Certificate, PrivateKey> pair = CertUtil.generateCertificate("localhost",
+                "OpenIDM Self-Signed Certificate", "None", "None", "None", "None",
+                ALGORITHM, KEY_SIZE, SIGNATURE_ALGORITHM, null, null);
+
+        final X500Name subject = subjectOf(pair.getKey());
+        assertThat(pair.getKey().getSubjectX500Principal()).isEqualTo(new X500Principal(
+                "CN=localhost, O=OpenIDM Self-Signed Certificate, OU=None, L=None, ST=None, C=None"));
+        assertThat(valueOf(subject, BCStyle.O)).isEqualTo("OpenIDM Self-Signed Certificate");
+        assertThat(valueOf(subject, BCStyle.OU)).isEqualTo("None");
+    }
+
+    @Test
+    public void testGenerateCertificateOmitsNullCountry() throws Exception {
+        final Pair<X509Certificate, PrivateKey> pair = CertUtil.generateCertificate("localhost",
+                "Example", "IT", "California", null, "San Francisco",
+                ALGORITHM, KEY_SIZE, SIGNATURE_ALGORITHM, null, null);
+
+        assertThat(subjectOf(pair.getKey()).getRDNs(BCStyle.C)).isEmpty();
+    }
+
+    @Test
+    public void testGenerateCertificateKeepsCountryCode() throws Exception {
+        final Pair<X509Certificate, PrivateKey> pair = CertUtil.generateCertificate("localhost",
+                "Example", "IT", "California", "US", "San Francisco",
+                ALGORITHM, KEY_SIZE, SIGNATURE_ALGORITHM, null, null);
+
+        assertThat(valueOf(subjectOf(pair.getKey()), BCStyle.C)).isEqualTo("US");
+    }
+
+    private static X500Name subjectOf(X509Certificate cert) throws Exception {
+        return new JcaX509CertificateHolder(cert).getSubject();
+    }
+
+    private static String valueOf(X500Name name, ASN1ObjectIdentifier attribute) {
+        return IETFUtils.valueToString(name.getRDNs(attribute)[0].getFirst().getValue());
+    }
+}

openidm-zip/src/main/resources/bin/defaults/script/auth/populateAsManagedUser.js

@@ -56,7 +56,6 @@
 
     var _ = require("lib/lodash"),
         queryFilter = require("auth/queryFilter"),
-        propertyMapping = properties.propertyMapping,
         managedUser;
 
 

pom.xml

@@ -393,7 +393,7 @@
             <dependency>
                 <groupId>org.openidentityplatform</groupId>
                 <artifactId>openicf</artifactId>
-                <version>2.0.4</version>
+                <version>2.1.0-SNAPSHOT</version>
                 <type>pom</type>
                 <scope>import</scope>
             </dependency>