[java-identity-provider] branch master updated: IDP-1558 - Setting to disable TLS name check in LDAPConnector
Scott Cantor
cantor.2 at osu.edu
Fri Feb 21 15:18:03 EST 2020
This is an automated email from the git hooks/post-receive script.
scantor pushed a commit to branch master
in repository java-identity-provider.
View the commit online:
http://git.shibboleth.net/view/?p=java-identity-provider.git;a=commit;h=17e9b4b22170c01c7f5f73bad2311fafb255f673
The following commit(s) were added to refs/heads/master by this push:
new 17e9b4b IDP-1558 - Setting to disable TLS name check in LDAPConnector
17e9b4b is described below
commit 17e9b4b22170c01c7f5f73bad2311fafb255f673
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Fri Feb 21 15:17:27 2020 -0500
IDP-1558 - Setting to disable TLS name check in LDAPConnector
https://issues.shibboleth.net/jira/browse/IDP-1558
Reverse the setting for safety and consistency.
Complete indirection of parser to allow property use.
---
.../dc/ldap/impl/LDAPDataConnectorParser.java | 24 +++++++++++++++++-----
.../resolver/ldap-attribute-resolver-v2-hybrid.xml | 2 +-
.../config/LDAPAuthenticationFactoryBean.java | 13 ++++--------
.../schema/shibboleth-attribute-resolver.xsd | 4 ++--
4 files changed, 26 insertions(+), 17 deletions(-)
diff --git a/idp-attribute-resolver-spring/src/main/java/net/shibboleth/idp/attribute/resolver/spring/dc/ldap/impl/LDAPDataConnectorParser.java b/idp-attribute-resolver-spring/src/main/java/net/shibboleth/idp/attribute/resolver/spring/dc/ldap/impl/LDAPDataConnectorParser.java
index aa0f0bb..6dfb275 100644
--- a/idp-attribute-resolver-spring/src/main/java/net/shibboleth/idp/attribute/resolver/spring/dc/ldap/impl/LDAPDataConnectorParser.java
+++ b/idp-attribute-resolver-spring/src/main/java/net/shibboleth/idp/attribute/resolver/spring/dc/ldap/impl/LDAPDataConnectorParser.java
@@ -48,6 +48,7 @@ import org.ldaptive.pool.SearchValidator;
import org.ldaptive.sasl.Mechanism;
import org.ldaptive.sasl.SaslConfig;
import org.ldaptive.ssl.AllowAnyHostnameVerifier;
+import org.ldaptive.ssl.CertificateHostnameVerifier;
import org.ldaptive.ssl.SslConfig;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
@@ -262,11 +263,14 @@ public class LDAPDataConnectorParser extends AbstractDataConnectorParser {
}
final BeanDefinitionBuilder sslConfig = BeanDefinitionBuilder.genericBeanDefinition(SslConfig.class);
- final Boolean checkTLSNames = AttributeSupport.getAttributeValueAsBoolean(
- configElement.getAttributeNodeNS(null, "checkTLSNames"));
- if (checkTLSNames != null && !checkTLSNames) {
- log.warn("{} TLS server certificate name checking is disabled!", getLogPrefix());
- sslConfig.addPropertyValue("hostnameVerifier", new AllowAnyHostnameVerifier());
+ final String disableHostnameVerification =
+ configElement.getAttributeNS(null, "disableHostnameVerification");
+ if (disableHostnameVerification != null) {
+ final BeanDefinitionBuilder verifier =
+ BeanDefinitionBuilder.rootBeanDefinition(V2Parser.class, "buildHostnameVerifier");
+ verifier.addConstructorArgValue(disableHostnameVerification);
+ verifier.addConstructorArgValue(getLogPrefix());
+ sslConfig.addPropertyValue("hostnameVerifier", verifier.getBeanDefinition());
}
sslConfig.addPropertyValue("credentialConfig", createCredentialConfig(parserContext));
@@ -772,6 +776,16 @@ public class LDAPDataConnectorParser extends AbstractDataConnectorParser {
validator.setSearchRequest(searchRequest);
return validator;
}
+
+ @Nullable public static CertificateHostnameVerifier buildHostnameVerifier(
+ @Nullable final String disableHostnameVerification, @Nullable final String logPrefix) {
+ if (disableHostnameVerification != null && Boolean.valueOf(disableHostnameVerification)) {
+ LoggerFactory.getLogger(LDAPDataConnectorParser.class).warn(
+ "{} TLS server certificate name checking is disabled!", logPrefix);
+ return new AllowAnyHostnameVerifier();
+ }
+ return null;
+ }
/**
* Factory method for handling spring property replacement. Adds a {@link DnAttributeEntryHandler} by default.
diff --git a/idp-attribute-resolver-spring/src/test/resources/net/shibboleth/idp/attribute/resolver/spring/dc/ldap/resolver/ldap-attribute-resolver-v2-hybrid.xml b/idp-attribute-resolver-spring/src/test/resources/net/shibboleth/idp/attribute/resolver/spring/dc/ldap/resolver/ldap-attribute-resolver-v2-hybrid.xml
index 46149fc..34a13c3 100644
--- a/idp-attribute-resolver-spring/src/test/resources/net/shibboleth/idp/attribute/resolver/spring/dc/ldap/resolver/ldap-attribute-resolver-v2-hybrid.xml
+++ b/idp-attribute-resolver-spring/src/test/resources/net/shibboleth/idp/attribute/resolver/spring/dc/ldap/resolver/ldap-attribute-resolver-v2-hybrid.xml
@@ -4,7 +4,7 @@
<DataConnector id="myLDAP" xsi:type="LDAPDirectory" ldapURL="ldap://localhost:10389"
baseDN="ou=people,dc=shibboleth,dc=net" principal="cn=Directory Manager" principalCredential="password"
- useStartTLS="true" checkTLSNames="false" searchTimeLimit="PT7S"
+ useStartTLS="true" disableHostnameVerification="true" searchTimeLimit="PT7S"
executableSearchBuilderRef="filter" mappingStrategyRef="mappings" validatorRef="validator" noRetryDelay="PT5M"
connectTimeout="PT2S" responseTimeout="PT4S">
<StartTLSTrustCredential xsi:type="security:X509Inline" xmlns:security="urn:mace:shibboleth:2.0:security"
diff --git a/idp-authn-api/src/main/java/net/shibboleth/idp/authn/config/LDAPAuthenticationFactoryBean.java b/idp-authn-api/src/main/java/net/shibboleth/idp/authn/config/LDAPAuthenticationFactoryBean.java
index 569a265..81fc016 100644
--- a/idp-authn-api/src/main/java/net/shibboleth/idp/authn/config/LDAPAuthenticationFactoryBean.java
+++ b/idp-authn-api/src/main/java/net/shibboleth/idp/authn/config/LDAPAuthenticationFactoryBean.java
@@ -136,7 +136,7 @@ public class LDAPAuthenticationFactoryBean extends AbstractFactoryBean<Authentic
private boolean useSSL;
/** Whether to use the allow-all hostname verifier. */
- private boolean checkTLSNames;
+ private boolean disableHostnameVerification;
/** Wait time for connects. */
private Duration connectTimeout;
@@ -212,11 +212,6 @@ public class LDAPAuthenticationFactoryBean extends AbstractFactoryBean<Authentic
/** Whether to use account state data as defined by the EDirectory schema. */
private boolean isEDirectory;
-
- /** Constructor. */
- public LDAPAuthenticationFactoryBean() {
- checkTLSNames = true;
- }
public void setAuthenticatorType(@Nonnull @NotEmpty final String type) {
authenticatorType = AuthenticatorType.fromLabel(type);
@@ -238,8 +233,8 @@ public class LDAPAuthenticationFactoryBean extends AbstractFactoryBean<Authentic
useSSL = b;
}
- public void setCheckTLSNames(final boolean b) {
- checkTLSNames = b;
+ public void setDisableHostnameVerification(final boolean b) {
+ disableHostnameVerification = b;
}
public void setConnectTimeout(@Nullable final Duration timeout) {
@@ -361,7 +356,7 @@ public class LDAPAuthenticationFactoryBean extends AbstractFactoryBean<Authentic
break;
}
- if (!checkTLSNames) {
+ if (disableHostnameVerification) {
log.warn("LDAP Authenticator configured to bypass TLS hostname checking!");
config.setHostnameVerifier(new AllowAnyHostnameVerifier());
}
diff --git a/idp-schema/src/main/resources/schema/shibboleth-attribute-resolver.xsd b/idp-schema/src/main/resources/schema/shibboleth-attribute-resolver.xsd
index 3a69052..678f2ba 100644
--- a/idp-schema/src/main/resources/schema/shibboleth-attribute-resolver.xsd
+++ b/idp-schema/src/main/resources/schema/shibboleth-attribute-resolver.xsd
@@ -974,10 +974,10 @@
</documentation>
</annotation>
</attribute>
- <attribute name="checkTLSNames" type="resolver:string">
+ <attribute name="disableHostnameVerification" type="resolver:string">
<annotation>
<documentation>
- Whether to do hostname/certificate checking during TLS. Defaults to true.
+ Whether to disable hostname/certificate checking during TLS. Defaults to false.
</documentation>
</annotation>
</attribute>
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list