Is it possible to configure the Grails spring-security-ldap plugin to use STARTTLS?
Grails version 4
spring-security-core:4.0.3
spring-security-ldap:4.0.0.M1
I have tried to configure this in a CustomLdapContextInitializer.groovy in src/main/groovy and the bean added in resources.groovy:
package RIMS
import .springframework.ldap.core.support.LdapContextSource
import javax.naming.ldap.InitialLdapContext
import javax.naming.ldap.LdapContext
import javax.naming.ldap.StartTlsRequest
import javax.naming.ldap.StartTlsResponse
import javax.ssl.SSLSession
class CustomLdapContextInitializer {
LdapContextSource ldapContextSource
String managerDn
String managerPassword
String server
SSLSession session
void setManagerDn(managerDn){
this.managerDn = managerDn
}
void setManagerPassword(managerPassword){
this.managerPassword = managerPassword
}
void setServer(server){
this.server = server
}
CustomLdapContextInitializer(LdapContextSource ldapContextSource) {
this.ldapContextSource = ldapContextSource
this.setManagerDn(ldapContextSource.userDn)
this.setManagerPassword(ldapContextSource.password)
this.initializeContext()
}
void initializeContext() {
LdapContext ctx = (InitialLdapContext) ldapContextSource.getContext(this.managerDn, this.managerPassword)
StartTlsResponse tls = (StartTlsResponse) ctx.extendedOperation(new StartTlsRequest())
session = tls.negotiate()
}
}
But I get an error when the app starts:
2025-02-17 12:26:17.519 WARN --- [ restartedMain] ConfigServletWebServerApplicationContext : Exception encountered during context initialization - cancelling refresh attempt: .springframework.beans.factory.BeanCreationException: Error creating bean with name 'customLdapContextInitializer': Bean instantiation via constructor failed; nested exception is .springframework.beans.BeanInstantiationException: Failed to instantiate [RIMS.CustomLdapContextInitializer]: Constructor threw exception; nested exception is javax.ssl.SSLHandshakeException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
The certificate has been added into the java keystore and is not a self signed certificate.