Fail fast if ssl.enabled = true without an SSL bundle

Setting spring.ldap.embedded.ssl.enabled without an SSL bundle started a
plain LDAP listener silently. It now fails at startup as a bundle is
required to provide the server's certificate and private key.

Closes gh-51471

documentation/spring-boot-docs/src/docs/antora/modules/reference/pages/data/nosql.adoc

@@ -809,3 +809,7 @@ spring:
       ssl:
         bundle: "example"
 ----
+
+The bundle must provide the server's certificate and private key.
+
+NOTE: An SSL bundle is required for LDAPS. Setting configprop:spring.ldap.embedded.ssl.enabled[] without configprop:spring.ldap.embedded.ssl.bundle[] fails at startup.

module/spring-boot-ldap/src/main/java/org/springframework/boot/ldap/autoconfigure/embedded/EmbeddedLdapAutoConfiguration.java

@@ -132,11 +132,14 @@ public final class EmbeddedLdapAutoConfiguration implements DisposableBean {
 
 	private @Nullable SslBundle getSslBundle(@Nullable SslBundles sslBundles) {
 		Ssl ssl = this.embeddedProperties.getSsl();
-		if (ssl.isEnabled() && StringUtils.hasLength(ssl.getBundle())) {
+		if (!ssl.isEnabled()) {
-			Assert.notNull(sslBundles, "SSL bundle name has been set but no SSL bundles found in context");
+			return null;
-			return sslBundles.getBundle(ssl.getBundle());
 		}
-		return null;
+		String bundle = ssl.getBundle();
+		Assert.state(StringUtils.hasLength(bundle), "SSL is enabled but no SSL bundle has been set. "
+				+ "An SSL bundle providing the server's certificate and private key is required for LDAPS");
+		Assert.notNull(sslBundles, "SSL bundle name has been set but no SSL bundles found in context");
+		return sslBundles.getBundle(bundle);
 	}
 
 	private void setSchema(InMemoryDirectoryServerConfig config) {

module/spring-boot-ldap/src/main/java/org/springframework/boot/ldap/autoconfigure/embedded/EmbeddedLdapProperties.java

@@ -141,7 +141,7 @@ public class EmbeddedLdapProperties {
 
 		/**
 		 * Whether to enable SSL support. Enabled automatically if "bundle" is provided
-		 * unless specified otherwise.
+		 * unless specified otherwise. A "bundle" is required when enabled.
 		 */
 		private @Nullable Boolean enabled;
 

module/spring-boot-ldap/src/test/java/org/springframework/boot/ldap/autoconfigure/embedded/EmbeddedLdapAutoConfigurationTests.java

@@ -411,6 +411,17 @@ class EmbeddedLdapAutoConfigurationTests {
 		});
 	}
 
+	@Test
+	void whenSslIsEnabledWithoutAnSslBundleThenStartFails() {
+		this.contextRunner
+			.withPropertyValues("spring.ldap.embedded.port:0", "spring.ldap.embedded.base-dn:dc=spring,dc=org",
+					"spring.ldap.embedded.ssl.enabled:true")
+			.run((context) -> {
+				assertThat(context).hasFailed();
+				assertThat(context).getFailure().hasMessageContaining("SSL is enabled but no SSL bundle has been set");
+			});
+	}
+
 	@Test
 	void sslIsNotEnabledWhenBundleIsEmpty() {
 		EmbeddedLdapProperties properties = new EmbeddedLdapProperties();