Is UnboundID LDAP SDK support tls mutual authentication?

[JadenKong]

Hi, recently I try to use UnboundID to do tls, and I found one-way is work with correct client's trustStore and server's keyStore.
But in two-way scenario, I set up client's keyStore and server's trustStore and it seems is not working, it can connected successfully not matter what value is in this two params. Did I miss something? Can you provide some example for mutual authentication? Thanks!

[dirmgr]

The LDAP SDK does support mutual TLS authentication. This is actually handled by the JVM's underlying support for TLS, and the only real requirement is to provide a key manager when initializing the SSL context. If you're using SSLUtil, then that means you need to provide a non-null key manager (like KeyStoreKeyManager) to the constructor.

If you're not able to successfully establish a connection when you provide a key manager but you can when there's no key manager, then that almost certainly means that the server doesn't trust the certificate that the client is presenting to it. Although you may be able to get some useful debugging information from the client (for example, by making sure that the "javax.net.debug" system property is set to "all" in the JVM before attempting any network communication), this is much more likely to be an issue with the server's configuration. The process for troubleshooting that will be specific to whatever type of directory server you're using, but I'd recommend using whatever logging or debugging facilities that server provides to see if it offers any clue as to what might be going on.

[JadenKong]

Hi @dirmgr ,thanks for your rely. I think maybe the problem is in embedded server. In my situation, I use InMemoryDirectoryServer as embedded LDAPS server, it can not set Need Client Auth in SSLServerSocketFactory level because it need to set setNeedClientAuth(true) to per socket. And maybe that's why I can't do mutual TLS authentication, it only can do the Server authenticate.

[dirmgr]

You're right. The in-memory directory server didn't support mutual TLS authentication. However, I have just committed a change that added it. It'll be included in the next release, but you could get it now by checking out and building the code for yourself.

Another option you could use would be to create your own custom SSL socket factory that wraps another socket factory and calls setWantClientAuth or setNeedClientAuth on the socket before returning it to the caller.

[dirmgr]

By the way, the way to use this in the new code is to use the new requestClientCertificate and requireClientCertificate arguments when creating an InMemoryListenerConfig object.

[JadenKong]

That's great, thanks your patient and suggestions.