Configure the SSL bundle through the context source's base environment
rather than a DirContextAuthenticationStrategy. The strategy is not
consulted when read-only operations use an anonymous environment,
which is the default when no username is set, so LDAPS connections
silently used the JVM's default trust material. It was also bypassed
entirely when a custom strategy bean was defined.
Register an SSL bundle update handler so that reloaded key and trust
material is used by subsequent connections.
Target LDAPS rather than StartTLS by setting the JNDI
java.naming.ldap.factory.socket property, and fail at startup if a
bundle is combined with a non-ldaps URL or with a socket factory that
has also been set through spring.ldap.base-environment. Delegate all
socket factory methods so that a configured connect timeout is
applied.
Add spring.ldap.ssl.enabled to use the platform's default trust and
key material without a bundle, default the URL to
ldaps://localhost:636 when SSL is enabled, and register the reflection
hint that JNDI needs to load the socket factory by name in a native
image. Cover the result with integration tests that search over LDAPS
against OpenLDAP and LLDAP containers, including certificates that are
untrusted or issued to a different host.
See gh-51382
Tomcat's SSL configuration is applied to an `SSLHostConfig` for each
host name. When an SSL bundle was updated, a new `SSLHostConfig` was
created and used to replace the existing one for that host name,
discarding any customizations that had been applied to it (for example
by a `TomcatConnectorCustomizer`).
Reuse the existing `SSLHostConfig` for the host name when one is
present, applying the updated bundle to it rather than replacing it. The
existing `SSLHostConfigCertificate` is also reused, as adding a second
certificate with an undefined type to an `SSLHostConfig` is rejected by
Tomcat.
See gh-51290
Signed-off-by: Scott Frederick <scottyfred@gmail.com>
The task loaded the auto-configuration metadata twice and wrote every
module's adoc file twice. When `load()` and `writeNavAdoc()` were
introduced, the pre-existing loop that read each metadata file and
called `writeModuleAdoc()` was left in place, so each file was
generated once from `load()` and then again, identically, by the loop.
Remove the redundant loop. The generated output is unchanged.
See gh-51438
Signed-off-by: Alexander Makarov <alexander.makarov@nightsong.li>
Fix regression caused by commit d26b6895 which caused
`doHealthCheck()` to only call `builder.up()` when the LDAP
server's protocol version (`java.naming.ldap.version`) could be
read from the JNDI environment.
See gh-51441
Signed-off-by: 2heunxun <seapeon@naver.com>
Derive logging.pattern.correlation from the configured MDC keys so that
log correlation keeps working when the keys are customized, instead of
silently rendering a blank correlation field.
Reject empty MDC keys and only clear Brave's default correlation fields
when the keys have been customized, so that applications using the
defaults are unaffected if Brave adds a default field.
Replace the tests that asserted on bean wiring with integration tests
covering the MDC contents, plus a smoke test for the log output.
See gh-50595
Moritz Halbritter
Phillip Webb
dhruv9b
Scott Frederick
Manu Sridharan
chisanw
Alexander Makarov
2heunxun
Phil Clay
Andy Wilkinson