[java-identity-provider] branch master updated: IDP-1558 - Setting to disable TLS name check in LDAPConnector

[Scott Cantor]

This is an automated email from the git hooks/post-receive script.

scantor pushed a commit to branch master
in repository java-identity-provider.

View the commit online:
http://git.shibboleth.net/view/?p=java-identity-provider.git;a=commit;h=e6cb4e88a7a1e73a6a95c03dfc8590b6c5a171b7

The following commit(s) were added to refs/heads/master by this push:
       new  e6cb4e8   IDP-1558 - Setting to disable TLS name check in LDAPConnector
e6cb4e8 is described below

commit e6cb4e88a7a1e73a6a95c03dfc8590b6c5a171b7
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Thu Feb 20 12:00:02 2020 -0500

    IDP-1558 - Setting to disable TLS name check in LDAPConnector
    
    https://issues.shibboleth.net/jira/browse/IDP-1558
    
    Added parity in LDAP Authenticator factory bean.
---
 .../authn/config/LDAPAuthenticationFactoryBean.java    | 18 ++++++++++++++++++
 1 file changed, 18 insertions(+)

diff --git a/idp-authn-api/src/main/java/net/shibboleth/idp/authn/config/LDAPAuthenticationFactoryBean.java b/idp-authn-api/src/main/java/net/shibboleth/idp/authn/config/LDAPAuthenticationFactoryBean.java
index c01eed5..569a265 100644
--- a/idp-authn-api/src/main/java/net/shibboleth/idp/authn/config/LDAPAuthenticationFactoryBean.java
+++ b/idp-authn-api/src/main/java/net/shibboleth/idp/authn/config/LDAPAuthenticationFactoryBean.java
@@ -51,6 +51,7 @@ import org.ldaptive.pool.IdlePruneStrategy;
 import org.ldaptive.pool.PoolConfig;
 import org.ldaptive.pool.PooledConnectionFactory;
 import org.ldaptive.pool.SearchValidator;
+import org.ldaptive.ssl.AllowAnyHostnameVerifier;
 import org.ldaptive.ssl.CredentialConfig;
 import org.ldaptive.ssl.SslConfig;
 import org.slf4j.Logger;
@@ -134,6 +135,9 @@ public class LDAPAuthenticationFactoryBean extends AbstractFactoryBean<Authentic
   /** Whether to use LDAPS for connections. */
   private boolean useSSL;
 
+  /** Whether to use the allow-all hostname verifier. */
+  private boolean checkTLSNames;
+
   /** Wait time for connects. */
   private Duration connectTimeout;
 
@@ -208,6 +212,11 @@ public class LDAPAuthenticationFactoryBean extends AbstractFactoryBean<Authentic
 
   /** Whether to use account state data as defined by the EDirectory schema. */
   private boolean isEDirectory;
+  
+  /** Constructor. */
+  public LDAPAuthenticationFactoryBean() {
+    checkTLSNames = true;
+  }
 
   public void setAuthenticatorType(@Nonnull @NotEmpty final String type) {
     authenticatorType = AuthenticatorType.fromLabel(type);
@@ -228,6 +237,10 @@ public class LDAPAuthenticationFactoryBean extends AbstractFactoryBean<Authentic
   public void setUseSSL(final boolean b) {
     useSSL = b;
   }
+  
+  public void setCheckTLSNames(final boolean b) {
+      checkTLSNames = b;
+  }
 
   public void setConnectTimeout(@Nullable final Duration timeout) {
     connectTimeout = timeout;
@@ -347,6 +360,11 @@ public class LDAPAuthenticationFactoryBean extends AbstractFactoryBean<Authentic
     default:
       break;
     }
+    
+    if (!checkTLSNames) {
+        log.warn("LDAP Authenticator configured to bypass TLS hostname checking!");
+        config.setHostnameVerifier(new AllowAnyHostnameVerifier());
+    }
     return config;
   }
 

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.