[java-identity-provider] branch master updated: IDP-1418 Force explicit definition of TLS trust for LDAP

[Rod Widdowson]

This is an automated email from the git hooks/post-receive script.

rdw pushed a commit to branch master
in repository java-identity-provider.

View the commit online:
http://git.shibboleth.net/view/?p=java-identity-provider.git;a=commit;h=ea28eddbccc30ffd2f0aed28d217065a5966264b

The following commit(s) were added to refs/heads/master by this push:
       new  ea28edd   IDP-1418 Force explicit definition of TLS trust for LDAP
ea28edd is described below

commit ea28eddbccc30ffd2f0aed28d217065a5966264b
Author: Rod Widdowson <rdw at steadingsoftware.com>
AuthorDate: Sat Jun 15 13:23:16 2019 +0100

    IDP-1418 Force explicit definition of TLS trust for LDAP
    
    https://issues.shibboleth.net/jira/browse/IDP-1418
---
 .../resolver/dc/ldap/impl/LDAPDataConnector.java        | 17 +++++++++++------
 1 file changed, 11 insertions(+), 6 deletions(-)

diff --git a/idp-attribute-resolver-impl/src/main/java/net/shibboleth/idp/attribute/resolver/dc/ldap/impl/LDAPDataConnector.java b/idp-attribute-resolver-impl/src/main/java/net/shibboleth/idp/attribute/resolver/dc/ldap/impl/LDAPDataConnector.java
index 4ad038a..7d71e9a 100644
--- a/idp-attribute-resolver-impl/src/main/java/net/shibboleth/idp/attribute/resolver/dc/ldap/impl/LDAPDataConnector.java
+++ b/idp-attribute-resolver-impl/src/main/java/net/shibboleth/idp/attribute/resolver/dc/ldap/impl/LDAPDataConnector.java
@@ -17,6 +17,7 @@
 
 package net.shibboleth.idp.attribute.resolver.dc.ldap.impl;
 
+import java.security.GeneralSecurityException;
 import java.util.Map;
 
 import javax.annotation.Nonnull;
@@ -124,7 +125,6 @@ public class LDAPDataConnector extends AbstractSearchDataConnector<ExecutableSea
         defaultMappingStrategy = false;
     }
 
-// CheckStyle: CyclomaticComplexity OFF
     /** {@inheritDoc} */
     @Override protected void doInitialize() throws ComponentInitializationException {
         if (connectionFactory == null) {
@@ -150,8 +150,14 @@ public class LDAPDataConnector extends AbstractSearchDataConnector<ExecutableSea
             log.error("{} Invalid connector configuration", getLogPrefix(), e);
             throw new ComponentInitializationException(getLogPrefix() + " Invalid connector configuration", e);
         }
+        policeForJVMTrust();
+    }
 
-        // TODO: remove deprecation warning in v4
+// CheckStyle: CyclomaticComplexity OFF
+    /** Police SSL for JVM trust.
+     * @throws ComponentInitializationException if we detect an SSL issue
+     */
+    private void policeForJVMTrust() throws ComponentInitializationException {
         Connection conn = null;
         try {
             conn = connectionFactory.getConnection();
@@ -171,8 +177,8 @@ public class LDAPDataConnector extends AbstractSearchDataConnector<ExecutableSea
                     }
                 }
             }
-        } catch (final Exception e) {
-            log.debug("{} Error inspecting SSL configuration", getLogPrefix(), e);
+        } catch (final GeneralSecurityException | LdapException e) {
+            throw new ComponentInitializationException(getLogPrefix() + " Failed to inspect SLL implementation", e);
         } finally {
             if (conn != null) {
                 try {
@@ -183,8 +189,7 @@ public class LDAPDataConnector extends AbstractSearchDataConnector<ExecutableSea
             }
         }
     }
-// CheckStyle: CyclomaticComplexity ON
-
+ // CheckStyle: CyclomaticComplexity ON
 
     /**
      * Attempts to retrieve attributes from the LDAP.

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.