mirror of
https://github.com/spring-projects/spring-boot.git
synced 2026-09-21 16:19:42 +00:00
Moritz Halbritter
969f1c03bf
Configure the SSL bundle through the context source's base environment rather than a DirContextAuthenticationStrategy. The strategy is not consulted when read-only operations use an anonymous environment, which is the default when no username is set, so LDAPS connections silently used the JVM's default trust material. It was also bypassed entirely when a custom strategy bean was defined. Register an SSL bundle update handler so that reloaded key and trust material is used by subsequent connections. Target LDAPS rather than StartTLS by setting the JNDI java.naming.ldap.factory.socket property, and fail at startup if a bundle is combined with a non-ldaps URL or with a socket factory that has also been set through spring.ldap.base-environment. Delegate all socket factory methods so that a configured connect timeout is applied. Add spring.ldap.ssl.enabled to use the platform's default trust and key material without a bundle, default the URL to ldaps://localhost:636 when SSL is enabled, and register the reflection hint that JNDI needs to load the socket factory by name in a native image. Cover the result with integration tests that search over LDAPS against OpenLDAP and LLDAP containers, including certificates that are untrusted or issued to a different host. See gh-51382