Certificate import successful, but App throws invalid DER-encoded certificate data exception

While implementing digital signature based authentication for OIM 11g, one of my team members ran into the following exception:

java.security.cert.CertificateParsingException: invalid DER-encoded certificate data
at sun.security.x509.X509CertImpl.parse(X509CertImpl.java:1701)
at sun.security.x509.X509CertImpl.(X509CertImpl.java:303)
at sun.security.provider.X509Factory.engineGenerateCertificate(X509Factory.java:104)
at java.security.cert.CertificateFactory.generateCertificate(CertificateFactory.java:305)
at com.bea.common.security.jdkutils.X509CertificateFactory.engineGenerateCertificate(X509CertificateFactory.java:118)
at java.security.cert.CertificateFactory.generateCertificate(CertificateFactory.java:305)
at sun.security.provider.certpath.X509CertPath.parsePKIPATH(X509CertPath.java:170)
at sun.security.provider.certpath.X509CertPath.(X509CertPath.java:133)
at sun.security.provider.X509Factory.engineGenerateCertPath(X509Factory.java:350)
at java.security.cert.CertificateFactory.generateCertPath(CertificateFactory.java:366)
at com.bea.common.security.jdkutils.X509CertificateFactory.engineGenerateCertPath(X509CertificateFactory.java:108)
at java.security.cert.CertificateFactory.generateCertPath(CertificateFactory.java:366)
at com.thortech.xl.crypto.tcSignatureMessage.readObject(tcSignatureMessage.java:100)

The surprising part was that this error did not show up when keytool was importing the certificate into default-keystore.jks. So it took a while to debug this issue. Finally resolved it.

The error was caused because the the subject DN that was provided using the -dname option did not conform to the X509 DN specification.
http://docs.oracle.com/javase/6/docs/technotes/tools/solaris/keytool.html#DName

Moral of the story: The format of the the subject DN is not validated by the keytool when you use the -dname option while generating a new key pair. Validate the DN format before running the tool or allow the tool to generate the DN.

Non commit / preview mode in OIM

I recently came across a very interesting OIM requirement. Can you configure OIM to work in non-commit mode / preview mode so that it only tells us what actions it will perform without actually performing the operation on the target system?

I could actually think a couple of ways to implement this through customizations. But I think this feature should be built into the product.

OIM Product Engineering team - if you are listening - please work on supporting this requirement. Customers will love it!