Skip to content

Added test for a custom X509TrustManager #1570

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 1 commit into from
Jun 20, 2023
Merged

Added test for a custom X509TrustManager #1570

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
22 changes: 21 additions & 1 deletion marklogic-client-api/src/test/java/com/marklogic/client/test/CheckSSLConnectionTest.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,7 +10,6 @@

import javax.net.ssl.SSLContext;
import javax.net.ssl.SSLException;
import javax.net.ssl.SSLHandshakeException;
import javax.net.ssl.TrustManager;

import static org.junit.jupiter.api.Assertions.assertEquals;
Expand Down Expand Up @@ -54,6 +53,27 @@ void trustAllManager() throws Exception {
assertNull(result.getErrorMessage());
}

/**
* Demonstrates using a custom X509TrustManager that only accepts the issuer of the public certificate associated
* with the certificate template created via RequireSSLExtension.
*/
@Test
void customTrustManager() {
if (Common.USE_REVERSE_PROXY_SERVER) {
return;
}

DatabaseClient client = Common.newClientBuilder()
.withSSLProtocol("TLSv1.2")
.withTrustManager(RequireSSLExtension.newTrustManager())
.withSSLHostnameVerifier(DatabaseClientFactory.SSLHostnameVerifier.ANY)
.build();

DatabaseClient.ConnectionResult result = client.checkConnection();
assertEquals(0, result.getStatusCode());
assertNull(result.getErrorMessage());
}

@Test
void defaultSslContext() throws Exception {
DatabaseClient client = Common.newClientBuilder()
Expand Down
40 changes: 40 additions & 0 deletions marklogic-client-api/src/test/java/com/marklogic/client/test/junit5/RequireSSLExtension.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,10 +5,17 @@
import com.marklogic.mgmt.ManageClient;
import com.marklogic.mgmt.resource.appservers.ServerManager;
import com.marklogic.mgmt.resource.security.CertificateTemplateManager;
import com.marklogic.rest.util.Fragment;
import org.junit.jupiter.api.extension.AfterAllCallback;
import org.junit.jupiter.api.extension.BeforeAllCallback;
import org.junit.jupiter.api.extension.ExtensionContext;

import javax.net.ssl.X509TrustManager;
import java.io.ByteArrayInputStream;
import java.security.cert.CertificateException;
import java.security.cert.CertificateFactory;
import java.security.cert.X509Certificate;

/**
* Use this on tests that require an app server to require SSL connections. The app server will be modified to require
* SSL connections before any test runs and will then be restored back to normal after all tests in the test class run.
Expand Down Expand Up @@ -52,6 +59,39 @@ public void afterAll(ExtensionContext context) {
new CertificateTemplateManager(manageClient).delete(TEMPLATE);
}

/**
* @return a trust manager that accepts the public certificate associated with the certificate template created
* by this class.
*/
public static X509TrustManager newTrustManager() {
return new X509TrustManager() {
@Override
public void checkClientTrusted(X509Certificate[] chain, String authType) {
}

@Override
public void checkServerTrusted(X509Certificate[] chain, String authType) {
}

@Override
public X509Certificate[] getAcceptedIssuers() {
return new X509Certificate[]{getCertificate()};
}
};
}

private static X509Certificate getCertificate() {
CertificateTemplateManager mgr = new CertificateTemplateManager(Common.newManageClient());

Fragment response = mgr.getCertificatesForTemplate(TEMPLATE_NAME);
String cert = response.getElementValue("/msec:certificate-list/msec:certificate/msec:pem");
Copy link
Contributor Author

@rjrudin rjrudin Jun 13, 2023

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@BillFarber Could reproduce this in mlxprs if needed, though I don't know how to make a certificate / trust manager in Node or what the equivalent is. But this is the key part - after generating a temporary certificate, you can download it and get the pem via the above code.

Copy link
Contributor

@BillFarber BillFarber Jun 13, 2023

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I've been thinking that we need to add a test or two to exercise certs, but I haven't written any stories for it.

try {
return (X509Certificate) CertificateFactory.getInstance("X.509").generateCertificate(new ByteArrayInputStream(cert.getBytes()));
} catch (CertificateException e) {
throw new RuntimeException("Unable to generate X509Certificate: " + e.getMessage(), e);
}
}

private void setSslCertificateTemplate(String templateName) {
new ServerManager(manageClient).save(
Common.newServerPayload()
Expand Down