Configure the SSL bundle through the context source's base environment
rather than a DirContextAuthenticationStrategy. The strategy is not
consulted when read-only operations use an anonymous environment,
which is the default when no username is set, so LDAPS connections
silently used the JVM's default trust material. It was also bypassed
entirely when a custom strategy bean was defined.
Register an SSL bundle update handler so that reloaded key and trust
material is used by subsequent connections.
Target LDAPS rather than StartTLS by setting the JNDI
java.naming.ldap.factory.socket property, and fail at startup if a
bundle is combined with a non-ldaps URL or with a socket factory that
has also been set through spring.ldap.base-environment. Delegate all
socket factory methods so that a configured connect timeout is
applied.
Add spring.ldap.ssl.enabled to use the platform's default trust and
key material without a bundle, default the URL to
ldaps://localhost:636 when SSL is enabled, and register the reflection
hint that JNDI needs to load the socket factory by name in a native
image. Cover the result with integration tests that search over LDAPS
against OpenLDAP and LLDAP containers, including certificates that are
untrusted or issued to a different host.
See gh-51382
Tomcat's SSL configuration is applied to an `SSLHostConfig` for each
host name. When an SSL bundle was updated, a new `SSLHostConfig` was
created and used to replace the existing one for that host name,
discarding any customizations that had been applied to it (for example
by a `TomcatConnectorCustomizer`).
Reuse the existing `SSLHostConfig` for the host name when one is
present, applying the updated bundle to it rather than replacing it. The
existing `SSLHostConfigCertificate` is also reused, as adding a second
certificate with an undefined type to an `SSLHostConfig` is rejected by
Tomcat.
See gh-51290
Signed-off-by: Scott Frederick <scottyfred@gmail.com>
Fix regression caused by commit d26b6895 which caused
`doHealthCheck()` to only call `builder.up()` when the LDAP
server's protocol version (`java.naming.ldap.version`) could be
read from the JNDI environment.
See gh-51441
Signed-off-by: 2heunxun <seapeon@naver.com>
Derive logging.pattern.correlation from the configured MDC keys so that
log correlation keeps working when the keys are customized, instead of
silently rendering a blank correlation field.
Reject empty MDC keys and only clear Brave's default correlation fields
when the keys have been customized, so that applications using the
defaults are unaffected if Brave adds a default field.
Replace the tests that asserted on bean wiring with integration tests
covering the MDC contents, plus a smoke test for the log output.
See gh-50595
Allow `management.opentelemetry.otlp.compression` to act as a common
default for OTLP compression, mirroring the existing endpoint/headers
fallback. Tracing, logging and metrics exporters now fall back to it
when their own signal-specific compression property is unset.
See gh-50461
This moves the feature from a unconditional application listener that
can load gRPC types to an auto-configuration that backs off if the
necessary classes are not present.
Also updated the smoke tests to actually use the feature.
Closes gh-50825
The javadoc promises an IllegalArgumentException, but the method asserts
with Assert.state, which throws an IllegalStateException.
See gh-51175
Signed-off-by: wantaek <wantaekchoi@gmail.com>
This commit introduces new properties for configuring the HTTP headers
that should be used for forward support.
The new `server.netty.forwarded-headers.header-format` property allows
"standard" or "x_forwarded" to select "Forwarded" or "X-Forwarded-*"
headers.
This aligns the behavior of Netty server with the "FRAMEWORK" strategy.
Closes gh-51031
This commit introduces new properties for configuring the HTTP headers
that should be used for forward support.
The new `server.jetty.forwarded-headers.header-format` property allows
"standard" or "x_forwarded" to select "Forwarded" or "X-Forwarded-*"
headers.
This aligns the behavior of Jetty server with the "FRAMEWORK" strategy.
Closes gh-51148
Moritz Halbritter
dhruv9b
Phillip Webb
Scott Frederick
2heunxun
Phil Clay
somiljain2006
Stéphane Nicoll
jjh75607
Jonatan IvanovandStéphane Nicoll
Tran Ngoc Nhan
wantaek
Brian Clozel