Skip to content

Add check for ldap truststore password #11055

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
DaanHoogland merged 2 commits into from
Jun 19, 2025
Merged

Add check for ldap truststore password #11055

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
28a4861
Add check for ldap truststore password
Pearl1594 Jun 18, 2025
f44baf6
fix imports
Pearl1594 Jun 18, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
28 changes: 26 additions & 2 deletions ...user-authenticators/ldap/src/main/java/org/apache/cloudstack/ldap/LdapContextFactory.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -72,8 +72,32 @@ private void enableSSL(final Hashtable<String, String> environment, Long domainI
if (sslStatus) {
s_logger.info("LDAP SSL enabled.");
environment.put(Context.SECURITY_PROTOCOL, "ssl");
System.setProperty("javax.net.ssl.trustStore", _ldapConfiguration.getTrustStore(domainId));
System.setProperty("javax.net.ssl.trustStorePassword", _ldapConfiguration.getTrustStorePassword(domainId));
String trustStore = _ldapConfiguration.getTrustStore(domainId);
String trustStorePassword = _ldapConfiguration.getTrustStorePassword(domainId);

if (!validateTrustStore(trustStore, trustStorePassword)) {
throw new RuntimeException("Invalid truststore or truststore password");
}

System.setProperty("javax.net.ssl.trustStore", trustStore);
System.setProperty("javax.net.ssl.trustStorePassword", trustStorePassword);
}
}

private boolean validateTrustStore(String trustStore, String trustStorePassword) {
if (trustStore == null || trustStorePassword == null) {
return false;
}

try {
java.security.KeyStore.getInstance("JKS").load(
new java.io.FileInputStream(trustStore),
trustStorePassword.toCharArray()
);
return true;
} catch (Exception e) {
s_logger.warn("Failed to validate truststore: " + e.getMessage());
return false;
}
}

Expand Down
5 changes: 5 additions & 0 deletions ...ns/user-authenticators/ldap/src/main/java/org/apache/cloudstack/ldap/LdapManagerImpl.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -186,6 +186,11 @@ private LdapConfigurationResponse addConfigurationInternal(final String hostname
} catch (NamingException | IOException e) {
LOGGER.debug("NamingException while doing an LDAP bind", e);
throw new InvalidParameterValueException("Unable to bind to the given LDAP server");
} catch (RuntimeException e) {
if (e.getMessage().contains("Invalid truststore")) {
throw new InvalidParameterValueException("Invalid truststore or truststore password");
}
throw e;
} finally {
closeContext(context);
}
Expand Down
Loading