You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@tika.apache.org by ta...@apache.org on 2026/07/29 19:54:28 UTC
(tika) branch simplify-grpc-tls created (now 89ef16c48d)
This is an automated email from the ASF dual-hosted git repository.
tballison pushed a change to branch simplify-grpc-tls
in repository https://gitbox.apache.org/repos/asf/tika.git
at 89ef16c48d simplify tls
This branch includes the following new commits:
new 89ef16c48d simplify tls
The 1 revisions listed above as "new" are entirely new to this
repository and will be described in separate emails. The revisions
listed as "add" were already present in the repository and have only
been added to this reference.
(tika) 01/01: simplify tls
Posted by ta...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
tballison pushed a commit to branch simplify-grpc-tls
in repository https://gitbox.apache.org/repos/asf/tika.git
commit 89ef16c48d4b2ce45bdb33fb789edb3dd74e2e85
Author: tallison <ta...@apache.org>
AuthorDate: Wed Jul 29 15:54:14 2026 -0400
simplify tls
---
docs/modules/ROOT/pages/using-tika/grpc/index.adoc | 9 +++++----
.../java/org/apache/tika/pipes/grpc/TikaGrpcServer.java | 11 ++++++-----
.../org/apache/tika/pipes/grpc/TikaGrpcServerTlsTest.java | 15 ++++++++++++---
3 files changed, 23 insertions(+), 12 deletions(-)
diff --git a/docs/modules/ROOT/pages/using-tika/grpc/index.adoc b/docs/modules/ROOT/pages/using-tika/grpc/index.adoc
index ef550e0e24..ab58eec64d 100644
--- a/docs/modules/ROOT/pages/using-tika/grpc/index.adoc
+++ b/docs/modules/ROOT/pages/using-tika/grpc/index.adoc
@@ -126,10 +126,11 @@ java -jar tika-grpc-<version>.jar --secure \
--trust-cert-collection ca.pem --client-auth-required
----
-Mutual TLS is opt-in: `--client-auth-required` is off by default, so it has no
-effect unless `--trust-cert-collection` is also given (a missing or non-existent
-trust-collection path is silently ignored). The default port is `50052`
-(`-p`/`--port`).
+`--client-auth-required` implies `--secure` -- it's included above for clarity,
+but TLS is enabled automatically whenever client authentication is required.
+`--trust-cert-collection` must point to a readable file when
+`--client-auth-required` is set; the server refuses to start otherwise. The
+default port is `50052` (`-p`/`--port`).
When running the Docker image, append these flags to the container command — they
are forwarded to the server — and mount the certificate files into the container.
diff --git a/tika-grpc/src/main/java/org/apache/tika/pipes/grpc/TikaGrpcServer.java b/tika-grpc/src/main/java/org/apache/tika/pipes/grpc/TikaGrpcServer.java
index 79f64ea539..f55b5bac1b 100644
--- a/tika-grpc/src/main/java/org/apache/tika/pipes/grpc/TikaGrpcServer.java
+++ b/tika-grpc/src/main/java/org/apache/tika/pipes/grpc/TikaGrpcServer.java
@@ -70,10 +70,10 @@ public class TikaGrpcServer {
@Parameter(names = {"--private-key-password"}, description = "Private key password, if needed")
private String privateKeyPassword;
- @Parameter(names = {"--trust-cert-collection"}, description = "The trust certificate collection (root certs). Example: ca.pem See: https://github.com/grpc/grpc-java/tree/b3ffb5078df361d7460786e134db7b5c00939246/examples/example-tls")
+ @Parameter(names = {"--trust-cert-collection"}, description = "The trust certificate collection (root certs). Required, and must be a readable file, when --client-auth-required is set. Example: ca.pem See: https://github.com/grpc/grpc-java/tree/b3ffb5078df361d7460786e134db7b5c00939246/examples/example-tls")
private File trustCertCollection;
- @Parameter(names = {"--client-auth-required"}, description = "Is Mutual TLS required?")
+ @Parameter(names = {"--client-auth-required"}, description = "Is Mutual TLS required? Implies --secure.")
private boolean clientAuthRequired;
@Parameter(names = {"-h", "-H", "--help"}, description = "Display help menu")
@@ -82,6 +82,10 @@ public class TikaGrpcServer {
public void start() throws Exception {
HealthStatusManager healthStatusManager = new HealthStatusManager();
ServerCredentials creds;
+ if (clientAuthRequired && !secure) {
+ LOGGER.info("--client-auth-required implies --secure; enabling TLS.");
+ secure = true;
+ }
if (secure) {
TlsServerCredentials.Builder channelCredBuilder = TlsServerCredentials.newBuilder();
channelCredBuilder.keyManager(certChain, privateKey, privateKeyPassword);
@@ -97,9 +101,6 @@ public class TikaGrpcServer {
}
creds = channelCredBuilder.build();
} else {
- if (clientAuthRequired) {
- throw new IllegalArgumentException("--client-auth-required requires --secure; refusing to start");
- }
creds = InsecureServerCredentials.create();
}
if (tikaConfig == null) {
diff --git a/tika-grpc/src/test/java/org/apache/tika/pipes/grpc/TikaGrpcServerTlsTest.java b/tika-grpc/src/test/java/org/apache/tika/pipes/grpc/TikaGrpcServerTlsTest.java
index d6edd326e7..71390d1ca9 100644
--- a/tika-grpc/src/test/java/org/apache/tika/pipes/grpc/TikaGrpcServerTlsTest.java
+++ b/tika-grpc/src/test/java/org/apache/tika/pipes/grpc/TikaGrpcServerTlsTest.java
@@ -30,7 +30,8 @@ import org.junit.jupiter.api.io.TempDir;
/**
* Covers the trust-cert-collection states that {@link TikaGrpcServer#start()} should refuse
* to start on when {@code --client-auth-required} is set: omitted, nonexistent, unreadable,
- * and invalid/corrupt content, plus {@code --client-auth-required} without {@code --secure}.
+ * and invalid/corrupt content. Also covers {@code --client-auth-required} without
+ * {@code --secure}, which implies {@code --secure} rather than being rejected.
*/
class TikaGrpcServerTlsTest {
private static final File CERT_CHAIN = Paths.get("src", "test", "resources", "certs", "server1.pem").toFile();
@@ -38,11 +39,19 @@ class TikaGrpcServerTlsTest {
private static final File VALID_TRUST_COLLECTION = Paths.get("src", "test", "resources", "certs", "ca.pem").toFile();
@Test
- void clientAuthRequiredWithoutSecureRefusesToStart() {
+ void clientAuthRequiredWithoutSecureImpliesSecureAndStarts() throws Exception {
TikaGrpcServer server = new TikaGrpcServer()
+ .setPort(0)
.setSecure(false)
+ .setCertChain(CERT_CHAIN)
+ .setPrivateKey(PRIVATE_KEY)
+ .setTrustCertCollection(VALID_TRUST_COLLECTION)
.setClientAuthRequired(true);
- assertThrows(IllegalArgumentException.class, server::start);
+ try {
+ server.start();
+ } finally {
+ server.stop();
+ }
}
@Test