[java-identity-provider] branch master updated: IDP-1209 warn on jvm trust

[Daniel Fisher]

This is an automated email from the git hooks/post-receive script.

dfisher pushed a commit to branch master
in repository java-identity-provider.

View the commit online:
http://git.shibboleth.net/view/?p=java-identity-provider.git;a=commit;h=25aa1cf09a5e29bb37f927db61eec5af71375ae4

The following commit(s) were added to refs/heads/master by this push:
       new  25aa1cf   IDP-1209 warn on jvm trust
25aa1cf is described below

commit 25aa1cf09a5e29bb37f927db61eec5af71375ae4
Author: Daniel Fisher <dfisher at gmail.com>
AuthorDate: Fri Sep 15 00:46:45 2017 -0400

    IDP-1209 warn on jvm trust
---
 .../resolver/dc/ldap/impl/LDAPDataConnector.java   | 36 ++++++++++++++++++++++
 1 file changed, 36 insertions(+)

diff --git a/idp-attribute-resolver-impl/src/main/java/net/shibboleth/idp/attribute/resolver/dc/ldap/impl/LDAPDataConnector.java b/idp-attribute-resolver-impl/src/main/java/net/shibboleth/idp/attribute/resolver/dc/ldap/impl/LDAPDataConnector.java
index e461898..a19413b 100644
--- a/idp-attribute-resolver-impl/src/main/java/net/shibboleth/idp/attribute/resolver/dc/ldap/impl/LDAPDataConnector.java
+++ b/idp-attribute-resolver-impl/src/main/java/net/shibboleth/idp/attribute/resolver/dc/ldap/impl/LDAPDataConnector.java
@@ -30,11 +30,18 @@ import net.shibboleth.idp.attribute.resolver.dc.impl.AbstractSearchDataConnector
 import net.shibboleth.utilities.java.support.component.ComponentInitializationException;
 import net.shibboleth.utilities.java.support.component.ComponentSupport;
 import net.shibboleth.utilities.java.support.logic.Constraint;
+import net.shibboleth.utilities.java.support.primitive.DeprecationSupport;
+import net.shibboleth.utilities.java.support.primitive.DeprecationSupport.ObjectType;
 
+import org.ldaptive.Connection;
+import org.ldaptive.ConnectionConfig;
 import org.ldaptive.ConnectionFactory;
 import org.ldaptive.LdapException;
 import org.ldaptive.SearchExecutor;
 import org.ldaptive.SearchResult;
+import org.ldaptive.ssl.X509SSLContextInitializer;
+import org.ldaptive.ssl.SslConfig;
+import org.ldaptive.ssl.SSLContextInitializer;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -144,6 +151,35 @@ public class LDAPDataConnector extends AbstractSearchDataConnector<ExecutableSea
             log.error("{} Invalid connector configuration", getLogPrefix(), e);
             throw new ComponentInitializationException(getLogPrefix() + " Invalid connector configuration", e);
         }
+
+        // TODO: remove deprecation warning in v4
+        Connection conn = null;
+        try {
+            conn = connectionFactory.getConnection();
+            final ConnectionConfig connConfig = conn.getConnectionConfig();
+            if (connConfig.getUseStartTLS() ||
+                    connConfig.getUseSSL() ||
+                    connConfig.getLdapUrl().toLowerCase().contains("ldaps://")) {
+                final SslConfig sslConfig = connConfig.getSslConfig();
+                if (sslConfig != null) {
+                    final SSLContextInitializer cxtInit = sslConfig.getCredentialConfig() != null ?
+                        sslConfig.getCredentialConfig().createSSLContextInitializer() : null;
+                    if (cxtInit instanceof X509SSLContextInitializer) {
+                        if (((X509SSLContextInitializer) cxtInit).getTrustCertificates() == null) {
+                            DeprecationSupport.warn(
+                                ObjectType.CONFIGURATION, "Use of default JVM trust store",
+                                    getLogPrefix(), "trustFile attribute");
+                        }
+                    }
+                }
+            }
+        } catch (final Exception e) {
+            log.warn("{} Error inspecting SSL configuration", getLogPrefix(), e);
+        } finally {
+            if (conn != null) {
+                conn.close();
+            }
+        }
     }
 
     /**

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.