Details
-
Bug
-
Resolution: Fixed
-
P3
-
9
-
b65
-
Verified
Backports
Issue | Fix Version | Assignee | Priority | Status | Resolution | Resolved In Build |
---|---|---|---|---|---|---|
JDK-8084927 | emb-9 | Valerie Peng | P3 | Resolved | Fixed | team |
Description
This bug requests that the means to support CertStore types beyond "Collection" be re-examined so that it will work cleanly with modules.
As things currently stand (early JDK 9) then reflection is used to load LDAPCertStoreHelper, if that succeeds then the "LDAP" type is supported, if it doesn't then the LDAP type is not supported. This approach is okay for Compact Profiles in JDK 8 but is problematic for modules because LDAPCertStoreHelper will not be exported by the JNDI/LDAP module.
One approach to consider is using ServiceLoader so that additional CertStore type can be added by deploying the appropriate service provider. If there are security concerns then the service type could be a type that is not exported -- see sun.util.xml.PlatformXmlPropertiesProvider for one example.
As things currently stand (early JDK 9) then reflection is used to load LDAPCertStoreHelper, if that succeeds then the "LDAP" type is supported, if it doesn't then the LDAP type is not supported. This approach is okay for Compact Profiles in JDK 8 but is problematic for modules because LDAPCertStoreHelper will not be exported by the JNDI/LDAP module.
One approach to consider is using ServiceLoader so that additional CertStore type can be added by deploying the appropriate service provider. If there are security concerns then the service type could be a type that is not exported -- see sun.util.xml.PlatformXmlPropertiesProvider for one example.
Attachments
Issue Links
- backported by
-
JDK-8084927 CertStore needs a way to add new CertStore types
-
- Resolved
-
- relates to
-
JDK-8134708 Certpath validation fails to load certs and CRLs if AIA and CRLDP extensions point to LDAP resources
-
- Closed
-
-
JDK-8075902 Update security provider docs for changes under 8038084 and 7191662
-
- Resolved
-
-
JDK-6889552 Sun provider should not require LDAP CertStore to be present
-
- Resolved
-