You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@cloudstack.apache.org by pe...@apache.org on 2025/06/18 16:21:16 UTC
(cloudstack) branch add-check-for-truststore-password-ldap created (now c55c2c7e810)
This is an automated email from the ASF dual-hosted git repository.
pearl11594 pushed a change to branch add-check-for-truststore-password-ldap
in repository https://gitbox.apache.org/repos/asf/cloudstack.git
at c55c2c7e810 Add check for ldap truststore password
This branch includes the following new commits:
new c55c2c7e810 Add check for ldap truststore password
The 1 revisions listed above as "new" are entirely new to this
repository and will be described in separate emails. The revisions
listed as "add" were already present in the repository and have only
been added to this reference.
(cloudstack) 01/01: Add check for ldap truststore password
Posted by pe...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
pearl11594 pushed a commit to branch add-check-for-truststore-password-ldap
in repository https://gitbox.apache.org/repos/asf/cloudstack.git
commit c55c2c7e810a7206c833166563bae92d2041fa45
Author: Pearl Dsilva <pe...@gmail.com>
AuthorDate: Wed Jun 18 12:21:04 2025 -0400
Add check for ldap truststore password
---
.../apache/cloudstack/ldap/LdapContextFactory.java | 30 ++++++++++++++++++++--
.../apache/cloudstack/ldap/LdapManagerImpl.java | 5 ++++
2 files changed, 33 insertions(+), 2 deletions(-)
diff --git a/plugins/user-authenticators/ldap/src/main/java/org/apache/cloudstack/ldap/LdapContextFactory.java b/plugins/user-authenticators/ldap/src/main/java/org/apache/cloudstack/ldap/LdapContextFactory.java
index 0161adf9fda..e5f20c80f5d 100644
--- a/plugins/user-authenticators/ldap/src/main/java/org/apache/cloudstack/ldap/LdapContextFactory.java
+++ b/plugins/user-authenticators/ldap/src/main/java/org/apache/cloudstack/ldap/LdapContextFactory.java
@@ -72,8 +72,34 @@ public class LdapContextFactory {
if (sslStatus) {
s_logger.info("LDAP SSL enabled.");
environment.put(Context.SECURITY_PROTOCOL, "ssl");
- System.setProperty("javax.net.ssl.trustStore", _ldapConfiguration.getTrustStore(domainId));
- System.setProperty("javax.net.ssl.trustStorePassword", _ldapConfiguration.getTrustStorePassword(domainId));
+ String trustStore = _ldapConfiguration.getTrustStore(domainId);
+ String trustStorePassword = _ldapConfiguration.getTrustStorePassword(domainId);
+
+ // Validate truststore and password before setting system properties
+ if (!validateTrustStore(trustStore, trustStorePassword)) {
+ throw new RuntimeException("Invalid truststore or truststore password");
+ }
+
+ System.setProperty("javax.net.ssl.trustStore", trustStore);
+ System.setProperty("javax.net.ssl.trustStorePassword", trustStorePassword);
+ }
+ }
+
+ private boolean validateTrustStore(String trustStore, String trustStorePassword) {
+ if (trustStore == null || trustStorePassword == null) {
+ return false;
+ }
+
+ try {
+ // Try to load the truststore with the provided password
+ java.security.KeyStore.getInstance("JKS").load(
+ new java.io.FileInputStream(trustStore),
+ trustStorePassword.toCharArray()
+ );
+ return true;
+ } catch (Exception e) {
+ s_logger.warn("Failed to validate truststore: " + e.getMessage());
+ return false;
}
}
diff --git a/plugins/user-authenticators/ldap/src/main/java/org/apache/cloudstack/ldap/LdapManagerImpl.java b/plugins/user-authenticators/ldap/src/main/java/org/apache/cloudstack/ldap/LdapManagerImpl.java
index 6ed79a0c69f..352e439b50c 100644
--- a/plugins/user-authenticators/ldap/src/main/java/org/apache/cloudstack/ldap/LdapManagerImpl.java
+++ b/plugins/user-authenticators/ldap/src/main/java/org/apache/cloudstack/ldap/LdapManagerImpl.java
@@ -186,6 +186,11 @@ public class LdapManagerImpl extends ComponentLifecycleBase implements LdapManag
} catch (NamingException | IOException e) {
LOGGER.debug("NamingException while doing an LDAP bind", e);
throw new InvalidParameterValueException("Unable to bind to the given LDAP server");
+ } catch (RuntimeException e) {
+ if (e.getMessage().contains("Invalid truststore")) {
+ throw new InvalidParameterValueException("Invalid truststore or truststore password");
+ }
+ throw e;
} finally {
closeContext(context);
}