How to send a params to the SocketFactory in Ldap

Question

The meaning of following example code is not important, what I want to ask is how to send the "certFileName" in to socketFactory as a params, for I need to use different certFile to different endPoint, thanks

public class LdapConnection
{

    private String host = "1.2.3.4"; //the correct ip...
    private String baseDn = "dc=x,dc=y,dc=com"; //the correct base DN

    private String username = "myUsername";
    private String password = "myPassword";

    private String connectionUrl = null;

    public void connectLdaps() throws Exception
    {
        connectionUrl = "ldaps://" + host + "/" + baseDn;

        System.out.println("Trying to connect to " + connectionUrl + " using LDAPS protocol");

        Hashtable<String, String> env = new Hashtable<String, String>();
        env.put(Context.INITIAL_CONTEXT_FACTORY, "com.sun.jndi.ldap.LdapCtxFactory");
        env.put("java.naming.ldap.derefAliases", "finding");
        env.put(Context.PROVIDER_URL, connectionUrl);
        env.put(Context.SECURITY_AUTHENTICATION, "Simple");
        env.put(Context.SECURITY_PRINCIPAL, username);
        env.put(Context.SECURITY_CREDENTIALS, password);
        env.put("java.naming.ldap.factory.socket", MySocketFactory.class.getName());

        new InitialLdapContext(env, null);

        System.out.println("Connected successfully!");
    }

    public static void main(String[] args) throws Exception
    {
        LdapConnection ldapConnection = new LdapConnection();
        ldapConnection.connectLdaps();
    }

}

public class MySocketFactory extends SocketFactory
{
    private static MySocketFactory instance = null;
    private SSLContext sslContext = null;

    //I want to send this var from outside
    **private static String certFileName = "C:\\certs\\cert_by_hostname.cer";**

    public static SocketFactory getDefault()
    {
        if (instance == null)
        {
            try
            {
                instance = new MySocketFactory();
                instance.initFactory();
            }
            catch (Exception e)
            {
                e.printStackTrace();
                System.out.println("Returning null socket factory");
            }
        }

        return instance;
    }
}

may be like this way: what should I do in the "outside" code

public class MySocketFactory extends SocketFactory
{
    private MySocketFactory instance = null;
    private SSLContext sslContext = null;

    //I want to send this var from outside
    private String certFileName = null

    public MySocketFactory(String varCert)
    {
       certFileName = varCert;
    }
}

thanks!

Answer 1

I don’t believe there is a way to pass a variable from outside the code. Well, not in the usual way at least. You could use a work around though.

Instead of passing a variable directly, hard code the certFileName variable to read from a user-defined System property. Then set that user-defined system property outside the code.

For example:

You have:
private String certFileName = "C:\\certs\\cert_by_hostname.cer";

Instead do something like:
private String certFileName = System.getProperty("custom.ldap.cert.file.loc");

Now, you can set the custom.ldap.cert.file.loc property outside your code.

So, putting it all together you'll have something similar to this. I've placed calls to System.setProperty() and System.getProperty() at suitable places in your code:

public class LdapConnection
{

    private String host = "1.2.3.4"; //the correct ip...
    private String baseDn = "dc=x,dc=y,dc=com"; //the correct base DN

    private String username = "myUsername";
    private String password = "myPassword";

    private String certFileLocation = "C:\\certs\\cert_by_hostname.cer";

    private String connectionUrl = null;

    public void connectLdaps() throws Exception
    {
        connectionUrl = "ldaps://" + host + "/" + baseDn;

        System.out.println("Trying to connect to " + connectionUrl + " using LDAPS protocol");

        System.setProperty("custom.ldap.cert.file.loc", certFileLocation);

        Hashtable<String, String> env = new Hashtable<String, String>();
        env.put(Context.INITIAL_CONTEXT_FACTORY, "com.sun.jndi.ldap.LdapCtxFactory");
        env.put("java.naming.ldap.derefAliases", "finding");
        env.put(Context.PROVIDER_URL, connectionUrl);
        env.put(Context.SECURITY_AUTHENTICATION, "Simple");
        env.put(Context.SECURITY_PRINCIPAL, username);
        env.put(Context.SECURITY_CREDENTIALS, password);
        env.put("java.naming.ldap.factory.socket", MySocketFactory.class.getName());

        new InitialLdapContext(env, null);

        System.out.println("Connected successfully!");
    }

    public static void main(String[] args) throws Exception
    {
        LdapConnection ldapConnection = new LdapConnection();
        ldapConnection.connectLdaps();
    }

}


public class MySocketFactory extends SocketFactory
{
    private static MySocketFactory instance = null;
    private SSLContext sslContext = null;

    //Now reference the system property here. This system property is set outside.
    private String certFileName = System.getProperty("custom.ldap.cert.file.loc");

    public static SocketFactory getDefault()
    {
        if (instance == null)
        {
            try
            {
                instance = new MySocketFactory();
                instance.initFactory();
            }
            catch (Exception e)
            {
                e.printStackTrace();
                System.out.println("Returning null socket factory");
            }
        }

        return instance;
    }

    private void someMethodThatMakesUseOfTheCertFile()
    {
          //do something with the variable: certFileName
    }
}

A word of caution. You must set the System property to the cert file prior to calling:
new InitialLdapContext(env, null); This is very important.

Please note that if you need to keep changing the cert file name or location, you may do so, by first updating the System property and then calling: new InitialLdapContext(env, null);. However, if you are making connections to different LDAP directories in different threads, then you may be better of using ThreadLocal variables rather than System properties. The concept should be the same.

Finally, if the LDAP directories that you'll be connecting to are always known, then you could pre-download each of their public certificates, and put all of them in a single truststore. That way, your LDAP connection need only read a single truststore rather than multiple individual certificate files.

Using this approach, you could simply set the appropriate built-in system properties as others have suggested. For example:

System.setProperty("javax.net.ssl.trustStore", "/path/to/truststore");
System.setProperty("javax.net.ssl.trustStorePassword", "the truststore password");

If setting the appropriate built-in system properties is not an option for your particular situation, then the above-mentioned method of using custom System properties or ThreadLocals can be used to read from truststores too.

Answer 2

You don't need to write a socket factory at all. See the JSSE Reference Guide. Just set the appropriate system properties.