From bf1b583596b82ff2be5b775766f5fb803de7ef61 Mon Sep 17 00:00:00 2001 From: Moritz Halbritter Date: Wed, 26 Aug 2026 12:15:40 +0200 Subject: [PATCH] Fail fast if ssl.enabled = true without an SSL bundle Setting spring.ldap.embedded.ssl.enabled without an SSL bundle started a plain LDAP listener silently. It now fails at startup as a bundle is required to provide the server's certificate and private key. Closes gh-51471 --- .../antora/modules/reference/pages/data/nosql.adoc | 4 ++++ .../embedded/EmbeddedLdapAutoConfiguration.java | 11 +++++++---- .../embedded/EmbeddedLdapProperties.java | 2 +- .../embedded/EmbeddedLdapAutoConfigurationTests.java | 11 +++++++++++ 4 files changed, 23 insertions(+), 5 deletions(-) diff --git a/documentation/spring-boot-docs/src/docs/antora/modules/reference/pages/data/nosql.adoc b/documentation/spring-boot-docs/src/docs/antora/modules/reference/pages/data/nosql.adoc index 08f3760d7c3..c9772280051 100644 --- a/documentation/spring-boot-docs/src/docs/antora/modules/reference/pages/data/nosql.adoc +++ b/documentation/spring-boot-docs/src/docs/antora/modules/reference/pages/data/nosql.adoc @@ -809,3 +809,7 @@ spring: ssl: bundle: "example" ---- + +The bundle must provide the server's certificate and private key. + +NOTE: An SSL bundle is required for LDAPS. Setting configprop:spring.ldap.embedded.ssl.enabled[] without configprop:spring.ldap.embedded.ssl.bundle[] fails at startup. diff --git a/module/spring-boot-ldap/src/main/java/org/springframework/boot/ldap/autoconfigure/embedded/EmbeddedLdapAutoConfiguration.java b/module/spring-boot-ldap/src/main/java/org/springframework/boot/ldap/autoconfigure/embedded/EmbeddedLdapAutoConfiguration.java index f35fe581f3e..bf42ee114a5 100644 --- a/module/spring-boot-ldap/src/main/java/org/springframework/boot/ldap/autoconfigure/embedded/EmbeddedLdapAutoConfiguration.java +++ b/module/spring-boot-ldap/src/main/java/org/springframework/boot/ldap/autoconfigure/embedded/EmbeddedLdapAutoConfiguration.java @@ -132,11 +132,14 @@ public final class EmbeddedLdapAutoConfiguration implements DisposableBean { private @Nullable SslBundle getSslBundle(@Nullable SslBundles sslBundles) { Ssl ssl = this.embeddedProperties.getSsl(); - if (ssl.isEnabled() && StringUtils.hasLength(ssl.getBundle())) { - Assert.notNull(sslBundles, "SSL bundle name has been set but no SSL bundles found in context"); - return sslBundles.getBundle(ssl.getBundle()); + if (!ssl.isEnabled()) { + return null; } - return null; + String bundle = ssl.getBundle(); + Assert.state(StringUtils.hasLength(bundle), "SSL is enabled but no SSL bundle has been set. " + + "An SSL bundle providing the server's certificate and private key is required for LDAPS"); + Assert.notNull(sslBundles, "SSL bundle name has been set but no SSL bundles found in context"); + return sslBundles.getBundle(bundle); } private void setSchema(InMemoryDirectoryServerConfig config) { diff --git a/module/spring-boot-ldap/src/main/java/org/springframework/boot/ldap/autoconfigure/embedded/EmbeddedLdapProperties.java b/module/spring-boot-ldap/src/main/java/org/springframework/boot/ldap/autoconfigure/embedded/EmbeddedLdapProperties.java index c361ed7592d..b7c4a381447 100644 --- a/module/spring-boot-ldap/src/main/java/org/springframework/boot/ldap/autoconfigure/embedded/EmbeddedLdapProperties.java +++ b/module/spring-boot-ldap/src/main/java/org/springframework/boot/ldap/autoconfigure/embedded/EmbeddedLdapProperties.java @@ -141,7 +141,7 @@ public class EmbeddedLdapProperties { /** * Whether to enable SSL support. Enabled automatically if "bundle" is provided - * unless specified otherwise. + * unless specified otherwise. A "bundle" is required when enabled. */ private @Nullable Boolean enabled; diff --git a/module/spring-boot-ldap/src/test/java/org/springframework/boot/ldap/autoconfigure/embedded/EmbeddedLdapAutoConfigurationTests.java b/module/spring-boot-ldap/src/test/java/org/springframework/boot/ldap/autoconfigure/embedded/EmbeddedLdapAutoConfigurationTests.java index f25a153d33b..f8fdb04d440 100644 --- a/module/spring-boot-ldap/src/test/java/org/springframework/boot/ldap/autoconfigure/embedded/EmbeddedLdapAutoConfigurationTests.java +++ b/module/spring-boot-ldap/src/test/java/org/springframework/boot/ldap/autoconfigure/embedded/EmbeddedLdapAutoConfigurationTests.java @@ -411,6 +411,17 @@ class EmbeddedLdapAutoConfigurationTests { }); } + @Test + void whenSslIsEnabledWithoutAnSslBundleThenStartFails() { + this.contextRunner + .withPropertyValues("spring.ldap.embedded.port:0", "spring.ldap.embedded.base-dn:dc=spring,dc=org", + "spring.ldap.embedded.ssl.enabled:true") + .run((context) -> { + assertThat(context).hasFailed(); + assertThat(context).getFailure().hasMessageContaining("SSL is enabled but no SSL bundle has been set"); + }); + } + @Test void sslIsNotEnabledWhenBundleIsEmpty() { EmbeddedLdapProperties properties = new EmbeddedLdapProperties();