CA Directory - Why is ldapsearch returning garbled attribute values with a double colan (::) before the value?

Products

• CA Directory
• CA Security Command Center
• CA Data Protection (DataMinder)
• CA User Activity Reporting

Issue/Introduction

Seen several cases where ldapsearch is returning "garbled" attribute values:
In this case, for example (below), the mail and userPassword physical attribute values are incorrect.

version: 1

dn: uid=your_userid,ou=your_ou,dc=your_dc,dc=your_dc
objectClass: top
objectClass: person
objectClass: organizationalPerson
objectClass: inetOrgPerson
objectClass: IDMPerson
mail:: <EncryptedString>
userPassword:: <EncryptedString>

Notice the double colon (::) before the values.
When this problem occurs there is always a double colon by the attribute.
When viewing these from JXplorer LDAP browser, the values are correct.
When entries are dumped using an ldapsearch or from JXplorer using an LDIF dump the values are incorrect.
This problem also frequently occurs in users with accent characters.

Environment

Release:
Component: ETRDIR

Resolution

The data is not "garbled". It is just encoded. The values in LDIF where a double colon "::" follows the attribute name mean that the value is a Base64 encoded value.

The LDIF spec rfc2849 describes the use of Base64 encoded values:
http://www.ietf.org/rfc/rfc2849.txt

There are online Base64 Encoders/Decoders such as below that can be used to decode your attribute values. These can be search on Google.

e.g.
https://www.base64encode.org/
https://www.base64decode.org/

https://www.base64encode.net/
https://www.base64decode.net/

After running these values through the decoder, you may find the values show that they all have a trailing whitespace and Per rfc2849, values or distinguished names that end with SPACE SHOULD be base-64 encoded. If your values have accent characters then they will also be Base64 encoded.