春季包1.3.1

为了使用TLS测试spring-ldap,我创建了一个接受所有证书的CustomSSLSocketFactory类(我知道与此有关的安全性问题)。

但是运行测试会导致

PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target


启用S​​SL调试后,会记录认为标准信任库:

trustStore is: [path_to_jre]\cacerts
trustStore type is : jks
trustStore provider is :
init truststore


这是执行测试的方式:

    LdapContextSource lcs = new LdapContextSource();

    lcs.setBase("[base]");
    lcs.setUserDn("[userDn]");
    lcs.setPassword("[password]");
    lcs.setPooled(false);
    lcs.setUrl("ldaps://[server-address]:636");

    DefaultTlsDirContextAuthenticationStrategy strategy = new DefaultTlsDirContextAuthenticationStrategy();
    strategy.setShutdownTlsGracefully(true);
    strategy.setSslSocketFactory(new CustomSSLSocketFactory());  // <-- not considered at all
    strategy.setHostnameVerifier(new HostnameVerifier(){

        @Override
        public boolean verify(String hostname, SSLSession session){

            return true;
        }
    });

    lcs.setAuthenticationStrategy(strategy);
    lcs.afterPropertiesSet();
    lcs.getContext("[principal]", "[credential]");


对于另一个测试,我像这样扩展了LdapContextSource:

public class ExtLdapContextSource extends LdapContextSource{

    public DirContext getContext(String principal, String credentials) {

        getAnonymousEnv().put("java.naming.security.protocol", "ssl");
        getAnonymousEnv().put("java.naming.ldap.factory.socket", "[package].CustomSSLSocketFactory");
        return super.getContext(principal, credentials);
    }
}


握手比预期的工作,但出现另一个错误:

javax.naming.NamingException: [LDAP: error code 1 - 00000000: LdapErr: DSID-0C090DF2, comment: TLS or SSL already in effect, data 0, v1db1
at com.sun.jndi.ldap.LdapCtx.mapErrorCode(Unknown Source)
at com.sun.jndi.ldap.LdapCtx.processReturnCode(Unknown Source)
at com.sun.jndi.ldap.LdapCtx.processReturnCode(Unknown Source)
at com.sun.jndi.ldap.LdapCtx.extendedOperation(Unknown Source)
at javax.naming.ldap.InitialLdapContext.extendedOperation(Unknown Source)
at org.springframework.ldap.core.support.AbstractTlsDirContextAuthenticationStrategy.processContextAfterCreation(AbstractTlsDirContextAuthenticationStrategy.java:133)
at org.springframework.ldap.core.support.AbstractContextSource.getContext(AbstractContextSource.java:109)


因此问题是:如何正确设置spring-ldap才能使其使用提供的SSLSocketFactory?

最佳答案

实际上由于ldaps-URL而失败。如果相应地设置了信任库,则异常表明无法建立TLS / SSL,因为它已经在运行(因此,ldaps-URL和DefaultTlsDirContextAuthenticationStrategy无法合并)。

同样,StartTLS是否在端口389上起作用似乎也取决于目录。

07-24 09:38
查看更多