major
minor
major
minor
minor
#27073
LDAPAccessService: connection establishment using the host name instead of the IP address
To create a directory context, the endpoint is specified in the configuration using the "provider-url" parameter or the alias %LDAP_PROVIDER_URL%. This value ultimately populates the environment variable javax.naming.Context.PROVIDER_URL ("java.naming.provider.url") for evaluation by the Java backend (javax.naming.directory.InitialDirContext).
In fact, however, the configured value is not passed directly to the Java backend. Instead, this URL is explicitly parsed, the hostname it contains is extracted, and the associated IP addresses are resolved. The hostname in the URL is replaced with the (first) IP address, and the connection is then explicitly established using that IP address. If an error occurs, the next IP address found is used.
Problem
If LDAP Secure (LDAP-S, port 636) is used, server certificates from the Java keystore are used. These certificates typically know the hostname but not the server’s IP address. If the connection is explicitly established using the IP address, no matching certificate is found.
Solution
The connection should be established directly using the provider-url specified in the configuration.
Test
Demo deployment with LDAP connection: User accounts are imported correctly, and users can log in.