msalle

> My push ^ is a stylistic nit to use early returns in favor of else blocks— I'll take a look at the tests with @jazzsequence but I'd guess there...

Hi all, the problem is that it's GEANT Personal CA 4 certificate, not the IGTF-MICS version (you should be able to choose that when getting a certificate from the GEANT...

I agree a clear error message would definitely be good. Also, if it is IGTF only, it should not have the GEANT Personal CA 4 configured as acceptable CA, but...

Ah, right. The client is probably sending both the EEC and the "GEANT Personal CA 4" certificates. The latter (see https://crt.sh/?caid=160144) is issued by the same CA as the "GEANT...

> I was not aware of that IGTF policy, but [#1007](https://github.com/indigo-iam/iam/issues/1007) was filed because if you tried to unlink one old certificate from your user profile, all certificates with that...

I'm not sure why you would want to pin/store a specific certificate? In grid use-cases we never do that, a user is identified by its subjectDN (and in non-IGTF the...

Hmm, but the fact remains that everyone with a TCS

> Instead of pointing to [#1007](https://github.com/indigo-iam/iam/issues/1007), which I consider correctly fixed for how things are done at the moment, you should have pointed to commit [e0180df](https://github.com/indigo-iam/iam/commit/e0180dffa2ac7bd1a6a4f6776968243e96536745) :-), where the following...

> Hi all, I keep having to solve issues for DTeam / Ops VO users with new certificates from different CAs, as also discussed in [#527](https://github.com/indigo-iam/iam/issues/527). Mind that we need...