Currently searching tokens with TEMP_LOST, PERM_LOST, or DAMAGED status will always produce no results:

$ pki <admin auth> tps-token-find --status <status>

This is because when a token is stored into the database, the token status is split into two attributes (status and reason):

• UNINITIALIZED -> status=uninitialized
• ACTIVE -> status=active
• TEMP_LOST -> status=lost and reason=onHold
• PERM_LOST -> status=lost and reason=keyCompromise
• DAMAGED -> status=lost and reason=destroyed
• TERMINATED -> status=terminated

Notice that the TEMP_LOST, PERM_LOST, and DAMAGED are mapped into the same "lost" status, so searching with filter (status=<value>) will not match any entries in the database.

One option is to change the REST service to generate different filters depending on the status. So for UNINITIALIZED, ACTIVE, and TERMINATED it will use (status=<value>), but for the others it will use (&(status=<status>)(reason=<reason>)).

However, if a 3rd-party application wants to accessing the database directly, it will need to know how to generate the correct search filter.

A better option would be to store the actual token status in the status attribute. That way the search can always be done simply with (status=<value>).

To avoid database migration, this change should be done before general release.