[java-identity-provider] branch maint-3.3 updated: IDP-1209 warn on jvm trust

[Daniel Fisher]

This is an automated email from the git hooks/post-receive script.

dfisher pushed a commit to branch maint-3.3
in repository java-identity-provider.

View the commit online:
http://git.shibboleth.net/view/?p=java-identity-provider.git;a=commit;h=b0ad76d3a6d05106262f191be95165a055e6a396

The following commit(s) were added to refs/heads/maint-3.3 by this push:
       new  b0ad76d   IDP-1209 warn on jvm trust
b0ad76d is described below

commit b0ad76d3a6d05106262f191be95165a055e6a396
Author: Daniel Fisher <dfisher at gmail.com>
AuthorDate: Fri Sep 29 01:00:42 2017 -0400

    IDP-1209 warn on jvm trust
    
    Merge from master without DeprecationSupport.
---
 .../resolver/dc/ldap/impl/LDAPDataConnector.java   | 34 ++++++++++++++++++++++
 1 file changed, 34 insertions(+)

diff --git a/idp-attribute-resolver-impl/src/main/java/net/shibboleth/idp/attribute/resolver/dc/ldap/impl/LDAPDataConnector.java b/idp-attribute-resolver-impl/src/main/java/net/shibboleth/idp/attribute/resolver/dc/ldap/impl/LDAPDataConnector.java
index 9ac3a59..3c9528d 100644
--- a/idp-attribute-resolver-impl/src/main/java/net/shibboleth/idp/attribute/resolver/dc/ldap/impl/LDAPDataConnector.java
+++ b/idp-attribute-resolver-impl/src/main/java/net/shibboleth/idp/attribute/resolver/dc/ldap/impl/LDAPDataConnector.java
@@ -32,10 +32,15 @@ import net.shibboleth.utilities.java.support.component.ComponentInitializationEx
 import net.shibboleth.utilities.java.support.component.ComponentSupport;
 import net.shibboleth.utilities.java.support.logic.Constraint;
 
+import org.ldaptive.Connection;
+import org.ldaptive.ConnectionConfig;
 import org.ldaptive.ConnectionFactory;
 import org.ldaptive.LdapException;
 import org.ldaptive.SearchExecutor;
 import org.ldaptive.SearchResult;
+import org.ldaptive.ssl.X509SSLContextInitializer;
+import org.ldaptive.ssl.SslConfig;
+import org.ldaptive.ssl.SSLContextInitializer;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -145,6 +150,35 @@ public class LDAPDataConnector extends AbstractSearchDataConnector<ExecutableSea
             log.error("{} Invalid connector configuration", getLogPrefix(), e);
             throw new ComponentInitializationException(getLogPrefix() + " Invalid connector configuration", e);
         }
+
+        // TODO: remove deprecation warning in v4
+        Connection conn = null;
+        try {
+            conn = connectionFactory.getConnection();
+            final ConnectionConfig connConfig = conn.getConnectionConfig();
+            if (connConfig.getUseStartTLS() ||
+                    connConfig.getUseSSL() ||
+                    connConfig.getLdapUrl().toLowerCase().contains("ldaps://")) {
+                final SslConfig sslConfig = connConfig.getSslConfig();
+                if (sslConfig != null) {
+                    final SSLContextInitializer cxtInit = sslConfig.getCredentialConfig() != null ?
+                        sslConfig.getCredentialConfig().createSSLContextInitializer() : null;
+                    if (cxtInit instanceof X509SSLContextInitializer) {
+                        if (((X509SSLContextInitializer) cxtInit).getTrustCertificates() == null) {
+                            log.warn(
+                                "{} Use of default JVM trust store will be removed in the next major version of " +
+                                    "this software; replacement is trustFile attribute", getLogPrefix());
+                        }
+                    }
+                }
+            }
+        } catch (final Exception e) {
+            log.warn("{} Error inspecting SSL configuration", getLogPrefix(), e);
+        } finally {
+            if (conn != null) {
+                conn.close();
+            }
+        }
     }
 
     /**

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.