[java-identity-provider] branch maint-3.4 updated: IDP-1418 issue a deprecation warning if useStartTLS is specified but trustFile isn't

[Rod Widdowson]

This is an automated email from the git hooks/post-receive script.

rdw pushed a commit to branch maint-3.4
in repository java-identity-provider.

View the commit online:
http://git.shibboleth.net/view/?p=java-identity-provider.git;a=commit;h=d22c99b8020caa6629140062ed59bbad5a183fb6

The following commit(s) were added to refs/heads/maint-3.4 by this push:
       new  d22c99b   IDP-1418 issue a deprecation warning if useStartTLS is specified but trustFile isn't
d22c99b is described below

commit d22c99b8020caa6629140062ed59bbad5a183fb6
Author: Rod Widdowson <rdw at steadingsoftware.com>
AuthorDate: Wed Mar 20 16:16:07 2019 +0000

    IDP-1418 issue a deprecation warning if useStartTLS is specified but trustFile isn't
    
    https://issues.shibboleth.net/jira/browse/IDP-1418
---
 .../dc/ldap/impl/CredentialConfigFactoryBean.java  | 30 ++++++++++++++++++++++
 .../dc/ldap/impl/LDAPDataConnectorParser.java      | 14 +++++++---
 2 files changed, 41 insertions(+), 3 deletions(-)

diff --git a/idp-attribute-resolver-spring/src/main/java/net/shibboleth/idp/attribute/resolver/spring/dc/ldap/impl/CredentialConfigFactoryBean.java b/idp-attribute-resolver-spring/src/main/java/net/shibboleth/idp/attribute/resolver/spring/dc/ldap/impl/CredentialConfigFactoryBean.java
index 27f4542..0cab8a8 100644
--- a/idp-attribute-resolver-spring/src/main/java/net/shibboleth/idp/attribute/resolver/spring/dc/ldap/impl/CredentialConfigFactoryBean.java
+++ b/idp-attribute-resolver-spring/src/main/java/net/shibboleth/idp/attribute/resolver/spring/dc/ldap/impl/CredentialConfigFactoryBean.java
@@ -24,6 +24,8 @@ import javax.annotation.Nonnull;
 import javax.annotation.Nullable;
 
 import net.shibboleth.ext.spring.factory.AbstractComponentAwareFactoryBean;
+import net.shibboleth.utilities.java.support.primitive.DeprecationSupport;
+import net.shibboleth.utilities.java.support.primitive.DeprecationSupport.ObjectType;
 
 import org.ldaptive.ssl.CredentialConfig;
 import org.ldaptive.ssl.CredentialConfigFactory;
@@ -47,6 +49,9 @@ public class CredentialConfigFactoryBean extends AbstractComponentAwareFactoryBe
     /** Our authentication credential for the LDAP connection. */
     @Nullable private Credential authCredential;
 
+    /** Did the user specify useStartTLS? */
+    private boolean useStartTLS;
+
     /** {@inheritDoc} */
     @Override public Class<?> getObjectType() {
         return CredentialConfig.class;
@@ -56,6 +61,13 @@ public class CredentialConfigFactoryBean extends AbstractComponentAwareFactoryBe
     @Override protected CredentialConfig doCreateInstance() throws Exception {
         X509Certificate[] trustCerts = null;
 
+        if (getUseStartTLS() && trustCredential == null) {
+            DeprecationSupport.warnOnce(ObjectType.ATTRIBUTE,
+                    "useStartTLS=\"true\"' without 'trustFile",
+                    null,
+                    "by adding an explicit trustFile");
+        }
+
         if (trustCredential != null) {
             if (trustCredential instanceof X509Credential) {
                 final X509Credential cred = (X509Credential) trustCredential;
@@ -86,6 +98,24 @@ public class CredentialConfigFactoryBean extends AbstractComponentAwareFactoryBe
     }
 
     /**
+     * Get the useStartTLS setting the Data Connector.
+     *
+     * @return the specified value
+     */
+    @Nullable public boolean  getUseStartTLS() {
+        return useStartTLS;
+    }
+
+    /**
+     * Set the useStartTLS setting the Data Connector.
+     *
+     * @param value the Value specified
+     */
+    public void setUseStartTLS(@Nullable final boolean value) {
+        useStartTLS = value;
+    }
+
+    /**
      * Get the authentication credential for the LDAP connection.
      * 
      * @return Returns the authnCredential.
diff --git a/idp-attribute-resolver-spring/src/main/java/net/shibboleth/idp/attribute/resolver/spring/dc/ldap/impl/LDAPDataConnectorParser.java b/idp-attribute-resolver-spring/src/main/java/net/shibboleth/idp/attribute/resolver/spring/dc/ldap/impl/LDAPDataConnectorParser.java
index 1f9b680..b8ecb94 100644
--- a/idp-attribute-resolver-spring/src/main/java/net/shibboleth/idp/attribute/resolver/spring/dc/ldap/impl/LDAPDataConnectorParser.java
+++ b/idp-attribute-resolver-spring/src/main/java/net/shibboleth/idp/attribute/resolver/spring/dc/ldap/impl/LDAPDataConnectorParser.java
@@ -313,7 +313,7 @@ public class LDAPDataConnectorParser extends AbstractWarningDataConnectorParser
                 connectionConfig.addPropertyValue("responseTimeout", 3000);
             }
             final BeanDefinitionBuilder sslConfig = BeanDefinitionBuilder.genericBeanDefinition(SslConfig.class);
-            sslConfig.addPropertyValue("credentialConfig", createCredentialConfig(parserContext));
+            sslConfig.addPropertyValue("credentialConfig", createCredentialConfig(parserContext, useStartTLS));
             connectionConfig.addPropertyValue("sslConfig", sslConfig.getBeanDefinition());
             final BeanDefinitionBuilder connectionInitializer =
                     BeanDefinitionBuilder.genericBeanDefinition(BindConnectionInitializer.class);
@@ -344,12 +344,19 @@ public class LDAPDataConnectorParser extends AbstractWarningDataConnectorParser
          * Read StartTLS trust and authentication credentials.
          * 
          * @param parserContext bean definition parsing context
+         * @param useStartTLS the value of useStartTls (if specified)
          * @return credential config
          */
-        @Nonnull protected BeanDefinition createCredentialConfig(@Nonnull final ParserContext parserContext) {
+        // CheckStyle: CyclomaticComplexity|MethodLength OFF
+        @Nonnull protected BeanDefinition createCredentialConfig(@Nonnull final ParserContext parserContext,
+                @Nullable final String useStartTLS) {
             final BeanDefinitionBuilder result =
                     BeanDefinitionBuilder.genericBeanDefinition(CredentialConfigFactoryBean.class);
 
+            if (useStartTLS != null) {
+                result.addPropertyValue("useStartTLS", useStartTLS);
+            }
+
             final List<Element> trustElements =
                     ElementSupport.getChildElements(configElement, new QName(DataConnectorNamespaceHandler.NAMESPACE,
                             "StartTLSTrustCredential"));
@@ -414,7 +421,8 @@ public class LDAPDataConnectorParser extends AbstractWarningDataConnectorParser
 
             return result.getBeanDefinition();
         }
-        
+        // CheckStyle: CyclomaticComplexity|MethodLength ON
+
         /**
          * Get the textual content of the <FilterTemplate>.
          * 

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.