Package org.exoplatform.services.organization.idm.ldap

Class SniAwareLdapSocketFactory

java.lang.Object

javax.net.SocketFactory

javax.net.ssl.SSLSocketFactory

org.exoplatform.services.organization.idm.ldap.SniAwareLdapSocketFactory

All Implemented Interfaces:

Comparator<SniAwareLdapSocketFactory>

public class SniAwareLdapSocketFactory
extends SSLSocketFactory
implements Comparator<SniAwareLdapSocketFactory>

SSL socket factory for ldaps:// connections whose host name (e.g. a CNAME, or a name backed by round-robin DNS) resolves to more than one server address.

The JDK's default socket handling only ever connects to a single address for a host name and never retries other addresses behind the same name if that first attempt fails. This factory instead enumerates every address behind the configured host name (via InetAddress.getAllByName(java.lang.String)) and tries each in turn, while still performing the TLS handshake - SNI and certificate hostname verification - against the original host name rather than the numeric address actually connected to.

This distinction matters: verifying against a raw IP address instead of the configured host name would silently defeat hostname verification (most server certificates are not issued for IP addresses), which is why the original host name is always passed through to the delegate factory's SSLSocketFactory.createSocket(Socket, String, int, boolean).

Enabled by setting exo.ldap.sni.enabled=true; the connect timeout (ms) used for each candidate address can be tuned with exo.ldap.sni.connect.timeout. When unset, it falls back to whatever com.sun.jndi.ldap.connect.timeout value is already configured - either as a customJNDIConnectionParameters entry (the way this timeout is shipped by default) or as a JVM system property - so switching SNI on does not silently replace a timeout the admin already set, and finally defaults to 10000 if neither is present. See connectTimeoutMs() for the exact precedence.

Registered via the standard JNDI LDAP java.naming.ldap.factory.socket connection property, whose contract requires a public static getDefault() method (mirroring SSLSocketFactory.getDefault()) - the JNDI LDAP provider obtains the factory instance by reflectively invoking that method, not the class constructor.

Implements Comparator (comparing purely on class identity) because com.sun.jndi.ldap.LdapPoolManager only allows pooling LDAP connections that use a custom socket factory when that factory's class implements java.util.Comparator - without it, enabling this feature would silently disable com.sun.jndi.ldap.connect.pool.

Field Summary

Fields

Modifier and Type	Field	Description
static final int	DEFAULT_CONNECT_TIMEOUT_MS
static final String	JNDI_LDAP_CONNECT_TIMEOUT_SYSTEM_PROP
static final String	SNI_CONNECT_TIMEOUT_PROP
static final String	SNI_ENABLED_PROP
static final String	SOCKET_FACTORY_JNDI_PROPERTY

Constructor Summary

Constructors

Modifier	Constructor	Description
protected	SniAwareLdapSocketFactory()

Method Summary

Modifier and Type	Method	Description
int	compare(SniAwareLdapSocketFactory first, SniAwareLdapSocketFactory second)	All instances are considered equal: this is a stateless singleton, and the comparison only exists to satisfy com.sun.jndi.ldap.LdapPoolManager's pooling eligibility check.
protected Socket	connectPlain(InetSocketAddress candidate, int timeoutMs)	Opens a plain TCP connection to a single candidate address.
static int	connectTimeoutMs()	Resolves the connect timeout (ms) used for each candidate address, in order of precedence: the explicit exo.ldap.sni.connect.timeout property, then whatever com.sun.jndi.ldap.connect.timeout value was hinted from the store's customJNDIConnectionParameters (see hintCustomJndiConnectTimeout(String)), then the JVM system property of the same name, then 10000.
protected Socket	connectWithFailover(String host, int port)	Overridable (rather than private) so tests can drive this method directly - including the TLS upgrade step - against a fake delegate factory, instead of only re-testing a copy of its retry loop.
Socket	createSocket(String host, int port)
Socket	createSocket(String host, int port, InetAddress localAddress, int localPort)
Socket	createSocket(InetAddress host, int port)
Socket	createSocket(InetAddress address, int port, InetAddress localAddress, int localPort)
Socket	createSocket(Socket s, String host, int port, boolean autoClose)
protected SSLSocketFactory	delegate()	Overridable (rather than private/static) so tests can substitute a fake TLS delegate and exercise connectWithFailover(String, int) without a real certificate/handshake.
static SocketFactory	getDefault()	Required by the JNDI LDAP java.naming.ldap.factory.socket contract: the configured class is instantiated by invoking this static method, not its constructor.
String[]	getDefaultCipherSuites()
String[]	getSupportedCipherSuites()
static void	hintCustomJndiConnectTimeout(String value)	Called once, when the SNI socket factory gets registered, with the raw com.sun.jndi.ldap.connect.timeout value found (if any) in the store's customJNDIConnectionParameters - this is how that timeout is actually shipped/configured (a JNDI env entry copied verbatim into the LDAP context), as opposed to a JVM system property.
static boolean	isEnabled()
protected List<InetSocketAddress>	resolveCandidates(String host, int port)	Enumerates every candidate address behind host, paired with the target port.

Methods inherited from class javax.net.ssl.SSLSocketFactory

createSocket

Methods inherited from class javax.net.SocketFactory

createSocket

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Methods inherited from interface java.util.Comparator

equals, reversed, thenComparing, thenComparing, thenComparing, thenComparingDouble, thenComparingInt, thenComparingLong

Field Details

SNI_ENABLED_PROP

public static final String SNI_ENABLED_PROP

See Also:

• Constant Field Values

SNI_CONNECT_TIMEOUT_PROP

public static final String SNI_CONNECT_TIMEOUT_PROP

See Also:

• Constant Field Values

SOCKET_FACTORY_JNDI_PROPERTY

public static final String SOCKET_FACTORY_JNDI_PROPERTY

See Also:

• Constant Field Values

JNDI_LDAP_CONNECT_TIMEOUT_SYSTEM_PROP

public static final String JNDI_LDAP_CONNECT_TIMEOUT_SYSTEM_PROP

See Also:

• Constant Field Values

DEFAULT_CONNECT_TIMEOUT_MS

public static final int DEFAULT_CONNECT_TIMEOUT_MS

See Also:

• Constant Field Values

Constructor Details

SniAwareLdapSocketFactory

protected SniAwareLdapSocketFactory()

Method Details

getDefault

public static SocketFactory getDefault()

Required by the JNDI LDAP java.naming.ldap.factory.socket contract: the configured class is instantiated by invoking this static method, not its constructor.

isEnabled

public static boolean isEnabled()

hintCustomJndiConnectTimeout

public static void hintCustomJndiConnectTimeout(String value)

Called once, when the SNI socket factory gets registered, with the raw com.sun.jndi.ldap.connect.timeout value found (if any) in the store's customJNDIConnectionParameters - this is how that timeout is actually shipped/configured (a JNDI env entry copied verbatim into the LDAP context), as opposed to a JVM system property.

connectTimeoutMs

public static int connectTimeoutMs()

Resolves the connect timeout (ms) used for each candidate address, in order of precedence: the explicit exo.ldap.sni.connect.timeout property, then whatever com.sun.jndi.ldap.connect.timeout value was hinted from the store's customJNDIConnectionParameters (see hintCustomJndiConnectTimeout(String)), then the JVM system property of the same name, then 10000.

compare

public int compare(SniAwareLdapSocketFactory first,
 SniAwareLdapSocketFactory second)

All instances are considered equal: this is a stateless singleton, and the comparison only exists to satisfy com.sun.jndi.ldap.LdapPoolManager's pooling eligibility check.

Specified by:

compare in interface Comparator<SniAwareLdapSocketFactory>

createSocket

public Socket createSocket(String host,
 int port)
                    throws IOException

Specified by:

createSocket in class SocketFactory

Throws:

IOException

createSocket

public Socket createSocket(String host,
 int port,
 InetAddress localAddress,
 int localPort)
                    throws IOException

Specified by:

createSocket in class SocketFactory

Throws:

IOException

createSocket

public Socket createSocket(InetAddress host,
 int port)
                    throws IOException

Specified by:

createSocket in class SocketFactory

Throws:

IOException

createSocket

public Socket createSocket(InetAddress address,
 int port,
 InetAddress localAddress,
 int localPort)
                    throws IOException

Specified by:

createSocket in class SocketFactory

Throws:

IOException

createSocket

public Socket createSocket(Socket s,
 String host,
 int port,
 boolean autoClose)
                    throws IOException

Specified by:

createSocket in class SSLSocketFactory

Throws:

IOException

getDefaultCipherSuites

public String[] getDefaultCipherSuites()

Specified by:

getDefaultCipherSuites in class SSLSocketFactory

getSupportedCipherSuites

public String[] getSupportedCipherSuites()

Specified by:

getSupportedCipherSuites in class SSLSocketFactory

connectWithFailover

protected Socket connectWithFailover(String host,
 int port)
                              throws IOException

Overridable (rather than private) so tests can drive this method directly - including the TLS upgrade step - against a fake delegate factory, instead of only re-testing a copy of its retry loop.

Throws:

IOException

resolveCandidates

protected List<InetSocketAddress> resolveCandidates(String host,
 int port)
                                             throws UnknownHostException

Enumerates every candidate address behind host, paired with the target port. Overridable so tests can verify the mapping without depending on real multi-homed DNS entries.

Throws:

UnknownHostException

connectPlain

protected Socket connectPlain(InetSocketAddress candidate,
 int timeoutMs)
                       throws IOException

Opens a plain TCP connection to a single candidate address. Overridable so the failover/skip-on-failure iteration can be exercised with real loopback sockets in tests, without requiring a TLS handshake.

Throws:

IOException

delegate

protected SSLSocketFactory delegate()

Overridable (rather than private/static) so tests can substitute a fake TLS delegate and exercise connectWithFailover(String, int) without a real certificate/handshake.