配置LDAPS Wildfly 25 Elytron

Question

我试图在Wildfly25上的Elytron上配置LDAPS，我不知道我错过了什么。

2021-10-12 09:54:53,597 DEBUG [org.wildfly.security] (default task-1) Could not create [class javax.naming.ldap.InitialLdapContext]. Failed to connect to LDAP server.: javax.naming.CommunicationException: LDAP.example:636 [Root exception is java.net.SocketTimeoutException: Read timed out]
at java.naming/com.sun.jndi.ldap.Connection.<init>(Connection.java:253)
at java.naming/com.sun.jndi.ldap.LdapClient.<init>(LdapClient.java:137)
at java.naming/com.sun.jndi.ldap.LdapClient.getInstance(LdapClient.java:1616)

            <dir-contexts>
            <dir-context name="ldap-connection" url="LDAPS://LDAP.example:636" authentication-level="simple" principal="CN=......." ssl-context="LocalhostSslContext">
                <credential-reference clear-text="pass"/>
            </dir-context>
        </dir-contexts>

Answer 1

多亏了苏珊的例子，我发现了问题，并使这个工作。问题是我使用truststore的方式，在我像这样重新配置它后，它工作了。完整示例：https://github.com/wildfly/wildfly-core/blob/main/elytron/src/test/resources/org/wildfly/extension/elytron/ldap.xml

摘录：

<subsystem xmlns="urn:wildfly:elytron:14.0" final-providers="combined-providers" disallowed-providers="OracleUcrypto">
...
<tls>
                <key-stores>
                    ...
                    <key-store name="TrustStore">
                        <credential-reference clear-text="secret"/>
                        <implementation type="JKS"/>
                        <file path="truststore.jks" relative-to="jboss.server.config.dir"/>
                    </key-store>
                </key-stores>
                ...
                <trust-managers>
                    <trust-manager name="TrustManager" key-store="TrustStore"/>
                </trust-managers>
                ...
                <client-ssl-contexts>
                    <client-ssl-context name="LdapSslContext" protocols="SSLv2 SSLv3 TLSv1 TLSv1.3 TLSv1.2 TLSv1.1" trust-manager="TrustManager"/>
                </client-ssl-contexts>
            </tls>
            <dir-contexts>
                <dir-context name="ldap-connection" url="ldaps://ldap.example:636" principal="CN=user...." ssl-context="LdapSslContext">
                    <credential-reference clear-text="secret"/>
                </dir-context>
            </dir-contexts>
        </subsystem>