[java-identity-provider] branch master updated: IDP-1558 - Setting to disable TLS name check in LDAPConnector

[Scott Cantor]

This is an automated email from the git hooks/post-receive script.

scantor pushed a commit to branch master
in repository java-identity-provider.

View the commit online:
http://git.shibboleth.net/view/?p=java-identity-provider.git;a=commit;h=14491f08b6877671fa17477f1c9bfacdcde44291

The following commit(s) were added to refs/heads/master by this push:
       new  14491f0   IDP-1558 - Setting to disable TLS name check in LDAPConnector
14491f0 is described below

commit 14491f08b6877671fa17477f1c9bfacdcde44291
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Thu Feb 20 11:27:31 2020 -0500

    IDP-1558 - Setting to disable TLS name check in LDAPConnector
    
    https://issues.shibboleth.net/jira/browse/IDP-1558
---
 .../resolver/spring/dc/ldap/impl/LDAPDataConnectorParser.java    | 9 +++++++++
 .../dc/ldap/resolver/ldap-attribute-resolver-v2-hybrid.xml       | 2 +-
 .../src/main/resources/schema/shibboleth-attribute-resolver.xsd  | 7 +++++++
 3 files changed, 17 insertions(+), 1 deletion(-)

diff --git a/idp-attribute-resolver-spring/src/main/java/net/shibboleth/idp/attribute/resolver/spring/dc/ldap/impl/LDAPDataConnectorParser.java b/idp-attribute-resolver-spring/src/main/java/net/shibboleth/idp/attribute/resolver/spring/dc/ldap/impl/LDAPDataConnectorParser.java
index 5878988..aa0f0bb 100644
--- a/idp-attribute-resolver-spring/src/main/java/net/shibboleth/idp/attribute/resolver/spring/dc/ldap/impl/LDAPDataConnectorParser.java
+++ b/idp-attribute-resolver-spring/src/main/java/net/shibboleth/idp/attribute/resolver/spring/dc/ldap/impl/LDAPDataConnectorParser.java
@@ -47,6 +47,7 @@ import org.ldaptive.pool.PooledConnectionFactory;
 import org.ldaptive.pool.SearchValidator;
 import org.ldaptive.sasl.Mechanism;
 import org.ldaptive.sasl.SaslConfig;
+import org.ldaptive.ssl.AllowAnyHostnameVerifier;
 import org.ldaptive.ssl.SslConfig;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
@@ -260,6 +261,14 @@ public class LDAPDataConnectorParser extends AbstractDataConnectorParser {
                 connectionConfig.addPropertyValue("responseTimeout", Duration.ofSeconds(3));
             }
             final BeanDefinitionBuilder sslConfig = BeanDefinitionBuilder.genericBeanDefinition(SslConfig.class);
+            
+            final Boolean checkTLSNames = AttributeSupport.getAttributeValueAsBoolean(
+                    configElement.getAttributeNodeNS(null, "checkTLSNames"));
+            if (checkTLSNames != null && !checkTLSNames) {
+                log.warn("{} TLS server certificate name checking is disabled!", getLogPrefix());
+                sslConfig.addPropertyValue("hostnameVerifier", new AllowAnyHostnameVerifier());
+            }
+            
             sslConfig.addPropertyValue("credentialConfig", createCredentialConfig(parserContext));
             connectionConfig.addPropertyValue("sslConfig", sslConfig.getBeanDefinition());
             final BeanDefinitionBuilder connectionInitializer =
diff --git a/idp-attribute-resolver-spring/src/test/resources/net/shibboleth/idp/attribute/resolver/spring/dc/ldap/resolver/ldap-attribute-resolver-v2-hybrid.xml b/idp-attribute-resolver-spring/src/test/resources/net/shibboleth/idp/attribute/resolver/spring/dc/ldap/resolver/ldap-attribute-resolver-v2-hybrid.xml
index 67321e5..46149fc 100644
--- a/idp-attribute-resolver-spring/src/test/resources/net/shibboleth/idp/attribute/resolver/spring/dc/ldap/resolver/ldap-attribute-resolver-v2-hybrid.xml
+++ b/idp-attribute-resolver-spring/src/test/resources/net/shibboleth/idp/attribute/resolver/spring/dc/ldap/resolver/ldap-attribute-resolver-v2-hybrid.xml
@@ -4,7 +4,7 @@
 
     <DataConnector id="myLDAP" xsi:type="LDAPDirectory" ldapURL="ldap://localhost:10389"
         baseDN="ou=people,dc=shibboleth,dc=net" principal="cn=Directory Manager" principalCredential="password"
-        useStartTLS="true" searchTimeLimit="PT7S"
+        useStartTLS="true" checkTLSNames="false" searchTimeLimit="PT7S"
         executableSearchBuilderRef="filter" mappingStrategyRef="mappings" validatorRef="validator" noRetryDelay="PT5M"
         connectTimeout="PT2S" responseTimeout="PT4S">
         <StartTLSTrustCredential xsi:type="security:X509Inline" xmlns:security="urn:mace:shibboleth:2.0:security"
diff --git a/idp-schema/src/main/resources/schema/shibboleth-attribute-resolver.xsd b/idp-schema/src/main/resources/schema/shibboleth-attribute-resolver.xsd
index bfcee8a..3a69052 100644
--- a/idp-schema/src/main/resources/schema/shibboleth-attribute-resolver.xsd
+++ b/idp-schema/src/main/resources/schema/shibboleth-attribute-resolver.xsd
@@ -974,6 +974,13 @@
                         </documentation>
                     </annotation>
                 </attribute>
+                <attribute name="checkTLSNames" type="resolver:string">
+                    <annotation>
+                        <documentation>
+                            Whether to do hostname/certificate checking during TLS. Defaults to true.
+                        </documentation>
+                    </annotation>
+                </attribute>
                 <attribute name="authCert" type="resolver:string">
                     <annotation>
                         <documentation>

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.