summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorJames Moger <james.moger@gitblit.com>2012-08-09 09:49:06 -0400
committerJames Moger <james.moger@gitblit.com>2012-08-09 09:49:06 -0400
commitcbd0caa7f95ea331ecd7b6daf71b11854f14e4ee (patch)
tree5baa1cc5bb7985c1b78ed872fa0cc807cec94737
parentd039557ca49041789db6404ecdb75776ccbb3c05 (diff)
parent845b532f90092638606c71a446bef10e5a45f3af (diff)
downloadgitblit-cbd0caa7f95ea331ecd7b6daf71b11854f14e4ee.tar.gz
gitblit-cbd0caa7f95ea331ecd7b6daf71b11854f14e4ee.zip
Merge branch 'ldap+tls' of https://github.com/StephenKing/gitblit
-rw-r--r--distrib/gitblit.properties2
-rw-r--r--src/com/gitblit/LdapUserService.java19
2 files changed, 19 insertions, 2 deletions
diff --git a/distrib/gitblit.properties b/distrib/gitblit.properties
index 70718b67..a5a47b78 100644
--- a/distrib/gitblit.properties
+++ b/distrib/gitblit.properties
@@ -797,6 +797,8 @@ federation.sets =
#
# URL of the LDAP server.
+# To use encrypted transport, use either ldaps:// URL for SSL or ldap+tls:// to
+# send StartTLS command.
#
# SINCE 1.0.0
realm.ldap.server = ldap://localhost
diff --git a/src/com/gitblit/LdapUserService.java b/src/com/gitblit/LdapUserService.java
index 61de01d9..38376b81 100644
--- a/src/com/gitblit/LdapUserService.java
+++ b/src/com/gitblit/LdapUserService.java
@@ -30,12 +30,15 @@ import com.gitblit.models.UserModel;
import com.gitblit.utils.ArrayUtils;
import com.gitblit.utils.StringUtils;
import com.unboundid.ldap.sdk.Attribute;
+import com.unboundid.ldap.sdk.ExtendedResult;
import com.unboundid.ldap.sdk.LDAPConnection;
import com.unboundid.ldap.sdk.LDAPException;
import com.unboundid.ldap.sdk.LDAPSearchException;
+import com.unboundid.ldap.sdk.ResultCode;
import com.unboundid.ldap.sdk.SearchResult;
import com.unboundid.ldap.sdk.SearchResultEntry;
import com.unboundid.ldap.sdk.SearchScope;
+import com.unboundid.ldap.sdk.extensions.StartTLSExtendedRequest;
import com.unboundid.util.ssl.SSLUtil;
import com.unboundid.util.ssl.TrustAllTrustManager;
@@ -81,10 +84,22 @@ public class LdapUserService extends GitblitUserService {
if (ldapPort == -1) // Default Port
ldapPort = 389;
- return new LDAPConnection(ldapUrl.getHost(), ldapPort, bindUserName, bindPassword);
+ LDAPConnection conn = new LDAPConnection(ldapUrl.getHost(), ldapPort, bindUserName, bindPassword);
+
+ if (ldapUrl.getScheme().equalsIgnoreCase("ldap+tls")) {
+ SSLUtil sslUtil = new SSLUtil(new TrustAllTrustManager());
+
+ ExtendedResult extendedResult = conn.processExtendedOperation(
+ new StartTLSExtendedRequest(sslUtil.createSSLContext()));
+
+ if (extendedResult.getResultCode() != ResultCode.SUCCESS) {
+ throw new LDAPException(extendedResult.getResultCode());
+ }
+ }
+ return conn;
}
} catch (URISyntaxException e) {
- logger.error("Bad LDAP URL, should be in the form: ldap(s)://<server>:<port>", e);
+ logger.error("Bad LDAP URL, should be in the form: ldap(s|+tls)://<server>:<port>", e);
} catch (GeneralSecurityException e) {
logger.error("Unable to create SSL Connection", e);
} catch (LDAPException e) {