From 44bd7db59ee568a5e8d3b44219e9cf19ead356de Mon Sep 17 00:00:00 2001 From: Ioannis Kakavas Date: Fri, 28 Dec 2018 11:19:58 +0200 Subject: [PATCH] [TEST] Pass a clientSSLContext in LdapTestCase If we don't explicitly sett the client SSLSocketFactory when creating an InMemoryDirectoryServer and setting its SSL config, it will result in using a TrustAllTrustManager(that extends X509TrustManager) which is not allowed in a FIPS 140 JVM. Instead, we get the SSLSocketFactory from the existing SSLContext and pass that to be used. Resolves #37013 --- .../xpack/security/authc/ldap/support/LdapTestCase.java | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/x-pack/plugin/security/src/test/java/org/elasticsearch/xpack/security/authc/ldap/support/LdapTestCase.java b/x-pack/plugin/security/src/test/java/org/elasticsearch/xpack/security/authc/ldap/support/LdapTestCase.java index 8e9fed97d08..2c0b2f77166 100644 --- a/x-pack/plugin/security/src/test/java/org/elasticsearch/xpack/security/authc/ldap/support/LdapTestCase.java +++ b/x-pack/plugin/security/src/test/java/org/elasticsearch/xpack/security/authc/ldap/support/LdapTestCase.java @@ -44,6 +44,7 @@ import javax.net.ssl.KeyManager; import javax.net.ssl.KeyManagerFactory; import javax.net.ssl.SSLContext; import javax.net.ssl.SSLServerSocketFactory; +import javax.net.ssl.SSLSocketFactory; import javax.net.ssl.X509ExtendedKeyManager; import java.security.AccessController; import java.security.KeyStore; @@ -86,8 +87,9 @@ public abstract class LdapTestCase extends ESTestCase { X509ExtendedKeyManager keyManager = CertParsingUtils.keyManager(ks, ldapPassword, KeyManagerFactory.getDefaultAlgorithm()); final SSLContext context = SSLContext.getInstance("TLSv1.2"); context.init(new KeyManager[] { keyManager }, null, null); - SSLServerSocketFactory socketFactory = context.getServerSocketFactory(); - listeners.add(InMemoryListenerConfig.createLDAPSConfig("ldaps", socketFactory)); + SSLServerSocketFactory serverSocketFactory = context.getServerSocketFactory(); + SSLSocketFactory clientSocketFactory = context.getSocketFactory(); + listeners.add(InMemoryListenerConfig.createLDAPSConfig("ldaps", null, 0, serverSocketFactory, clientSocketFactory)); } serverConfig.setListenerConfigs(listeners); InMemoryDirectoryServer ldapServer = new InMemoryDirectoryServer(serverConfig);