-
Notifications
You must be signed in to change notification settings - Fork 102
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Add the choice of whether to perform certificate verification when co…
…nnect to ldaps://
- Loading branch information
longping_tang
authored and
longping_tang
committed
Apr 22, 2021
1 parent
b6a971f
commit d5a64d8
Showing
5 changed files
with
142 additions
and
6 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
96 changes: 96 additions & 0 deletions
96
src/main/java/jenkins/security/plugins/ldap/BlindSSLSocketFactory.java
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,96 @@ | ||
| package jenkins.security.plugins.ldap; | ||
|
|
||
| import javax.net.SocketFactory; | ||
| import javax.net.ssl.SSLContext; | ||
| import javax.net.ssl.SSLSocketFactory; | ||
| import javax.net.ssl.TrustManager; | ||
| import javax.net.ssl.X509TrustManager; | ||
| import java.io.IOException; | ||
| import java.net.InetAddress; | ||
| import java.net.Socket; | ||
| import java.net.UnknownHostException; | ||
| import java.security.GeneralSecurityException; | ||
| import java.security.SecureRandom; | ||
| import java.security.cert.X509Certificate; | ||
|
|
||
| public class BlindSSLSocketFactory extends SSLSocketFactory { | ||
| private static final BlindSSLSocketFactory INSTANCE; | ||
|
|
||
| static { | ||
| final X509TrustManager dummyTrustManager = | ||
| new X509TrustManager() { | ||
| @Override | ||
| public X509Certificate[] getAcceptedIssuers() { | ||
| return null; | ||
| } | ||
|
|
||
| @Override | ||
| public void checkClientTrusted(X509Certificate[] chain, String authType) {} | ||
|
|
||
| @Override | ||
| public void checkServerTrusted(X509Certificate[] chain, String authType) {} | ||
| }; | ||
| try { | ||
| final SSLContext context = SSLContext.getInstance("SSL"); | ||
| final TrustManager[] trustManagers = {dummyTrustManager}; | ||
| final SecureRandom rng = new SecureRandom(); | ||
| context.init(null, trustManagers, rng); | ||
| INSTANCE = new BlindSSLSocketFactory(context.getSocketFactory()); | ||
| } catch (GeneralSecurityException e) { | ||
| throw new RuntimeException("Cannot create BlindSslSocketFactory", e); | ||
| } | ||
| } | ||
|
|
||
| public static SocketFactory getDefault() { | ||
| return INSTANCE; | ||
| } | ||
|
|
||
| private final SSLSocketFactory sslFactory; | ||
|
|
||
| private BlindSSLSocketFactory(SSLSocketFactory sslFactory) { | ||
| this.sslFactory = sslFactory; | ||
| } | ||
|
|
||
| @Override | ||
| public Socket createSocket(Socket s, String host, int port, boolean autoClose) | ||
| throws IOException { | ||
| return sslFactory.createSocket(s, host, port, autoClose); | ||
| } | ||
|
|
||
| @Override | ||
| public String[] getDefaultCipherSuites() { | ||
| return sslFactory.getDefaultCipherSuites(); | ||
| } | ||
|
|
||
| @Override | ||
| public String[] getSupportedCipherSuites() { | ||
| return sslFactory.getSupportedCipherSuites(); | ||
| } | ||
|
|
||
| @Override | ||
| public Socket createSocket() throws IOException { | ||
| return sslFactory.createSocket(); | ||
| } | ||
|
|
||
| @Override | ||
| public Socket createSocket(String host, int port) throws IOException, UnknownHostException { | ||
| return sslFactory.createSocket(host, port); | ||
| } | ||
|
|
||
| @Override | ||
| public Socket createSocket(InetAddress host, int port) throws IOException { | ||
| return sslFactory.createSocket(host, port); | ||
| } | ||
|
|
||
| @Override | ||
| public Socket createSocket(String host, int port, InetAddress localHost, int localPort) | ||
| throws IOException, UnknownHostException { | ||
| return sslFactory.createSocket(host, port, localHost, localPort); | ||
| } | ||
|
|
||
| @Override | ||
| public Socket createSocket(InetAddress address, int port, InetAddress localAddress, int localPort) | ||
| throws IOException { | ||
| return sslFactory.createSocket(address, port, localAddress, localPort); | ||
| } | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
9 changes: 9 additions & 0 deletions
9
src/main/resources/jenkins/security/plugins/ldap/LDAPConfiguration/help-sslVerify.html
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,9 @@ | ||
| <div> | ||
| <p> | ||
| If checked and ldap server is an ldaps:// style URL, requiring the certificate to be verified. | ||
| </p> | ||
| <p> | ||
| If unchecked (the default), Jenkins will not verify the server certificate when it connects to | ||
| perform a query. | ||
| </p> | ||
| </div> |