dirmgr
commented
3 years ago I assume that you’re asking about writing LDAP clients. In that case, the LDAP SDK has always supported mutual TLS. To use it, you need to have access to a key store containing the client certificate chain. If you’re using the SSLUtil class, then you can do that by providing an appropriate key manager to the SSLUtil constructor, and then use that SSLUtil object to create an SSLSocketFactory for use when creating an LDAPConnection or LDAPConnectionPool. For example:
KeyStoreKeyManager keyManager = new KeyStoreKeyManager(pathToKeyStore,
keyStorePIN, keyStoreFormat, certificateAlias);
TrustStoreTrustManager trustManager = new TrustStoreTrustManager(
(pathToTrustStore, trustStorePIN, trustStoreFormat,
examineValidityDates);
SSLUtil sslUtil = new SSLUtil(keyManager, trustManager);
LDAPConnection conn = new LDAPConnection(sslUtil.createSSLSocketFactory(),
serverAddress, serverPort);There are several places in the LDAP SDK where we do something like this, but one good place to look for an example would be the LDAPCommandLineTool.createSSLUtil method. That method creates an SSLUtil object based on the arguments provided when running a command-line tool.
Note that the above code will just cause the client to send a certificate chain to the server if one is requested. If you actually want to use that certificate chain for LDAP authentication, then you need to perform a SASL bind on that connection with the EXTERNAL mechanism. That is as simple as:
BindResult bindResult = conn.bind(new EXTERNALBindRequest());If you’re asking about the in-memory directory server that the LDAP SDK provides, then support for mutual TLS authentication was only added fairly recently, in the 5.1.2 release. In that case, you should use the requestClientCertificate and requireClientCertificate arguments when creating an InMemoryListenerConfig object for the TLS-enabled listener.
sherry442
Hi, Are there any examples on how to unboundid-ldapsdk in Java for mutual TLS? Could you please provide information on which version of unboundid-ldapsdk supports mutual TLS?