多LDAP场景下Google LDAP自定义SSLSocketFactory失效问题求助

核心问题分析 #

你的自定义SSLSocketFactory被忽略，主要有以下几个关键原因：

1. JDK17+ LDAPS协议的Socket工厂逻辑变更：com.sun.jndi.ldap.LdapCtxFactory在使用ssl协议时，会优先调用系统默认SSL上下文，绕过java.naming.ldap.factory.socket配置；改用starttls协议可触发自定义工厂的加载。
2. 自定义KeyManager未加载有效证书：原代码中的MyKeyManager仅返回空的证书链和私钥，无法完成Google LDAP要求的客户端证书认证，即使工厂被加载也无法正常连接。
3. GraalVM类加载限制：若在原生镜像模式下测试，未配置反射元数据会导致自定义类无法被实例化。

修正步骤 #

1. 调整LDAP安全协议 #

将Context.SECURITY_PROTOCOL从ssl改为starttls，确保自定义Socket工厂被触发。

2. 修复KeyManager加载实际证书 #

修改MyKeyManager，从指定KeyStore中读取客户端证书和私钥，而非返回空值。

3. 确保自定义类的可访问性 #

若使用GraalVM原生镜像，需添加反射配置确保自定义工厂、KeyManager、TrustManager能被正确加载。

修正后的测试代码 #

import java.io.Console;
import java.io.File;
import java.io.FileInputStream;
import java.io.IOException;
import java.io.InputStream;
import java.net.InetAddress;
import java.net.Socket;
import java.security.KeyStore;
import java.security.Principal;
import java.security.PrivateKey;
import java.security.SecureRandom;
import java.security.cert.CertificateException;
import java.security.cert.X509Certificate;
import java.util.Enumeration;
import java.util.Properties;

import javax.naming.Context;
import javax.naming.directory.InitialDirContext;
import javax.net.ssl.KeyManager;
import javax.net.ssl.SSLContext;
import javax.net.ssl.SSLSocketFactory;
import javax.net.ssl.TrustManager;
import javax.net.ssl.TrustManagerFactory;
import javax.net.ssl.X509KeyManager;
import javax.net.ssl.X509TrustManager;


public class LDAPIT {

    public static final String JAVA_NAMING_LDAP_FACTORY_SOCKET = "java.naming.ldap.factory.socket";

    public static void main(final String[] args) {
        final LDAPIT test = new LDAPIT();
        try {
            test.run();
        } catch (final Exception e) {
            throw new RuntimeException(e);
        }
    }

    public void run() throws Exception {
        final Console cnsl = System.console();
        if (cnsl == null) {
            throw new RuntimeException("Console is null");
        }

        final String url = cnsl.readLine("Enter URL: ");
        final String user = cnsl.readLine("Enter username : ");
        final String password = String.valueOf(cnsl.readPassword("Enter password : "));
        final String keyStorePath = cnsl.readLine("Enter KeyStore path: ");
        final String keyStorePass = String.valueOf(cnsl.readPassword("Enter KeyStore password: "));

        System.out.println("Start Trying to Connect to LDAP: " + url);
        System.out.println("With User: " + user);

        final Properties props = new Properties();
        props.put(Context.INITIAL_CONTEXT_FACTORY, "com.sun.jndi.ldap.LdapCtxFactory");
        props.put(Context.PROVIDER_URL, url);
        props.put(Context.SECURITY_PRINCIPAL, user);
        props.put(Context.SECURITY_AUTHENTICATION, "simple");
        // 改用starttls协议触发自定义Socket工厂
        props.put(Context.SECURITY_PROTOCOL, "starttls");
        props.put(JAVA_NAMING_LDAP_FACTORY_SOCKET, MySSLSocketFactory.class.getName());
        // 传递KeyStore参数给自定义工厂
        System.setProperty("custom.keystore.path", keyStorePath);
        System.setProperty("custom.keystore.pass", keyStorePass);

        props.put(Context.SECURITY_CREDENTIALS, password);

        try {
            System.out.println("Connecting to LDAP Server");
            final InitialDirContext idc = new InitialDirContext(props);
            System.out.println("Successfully connected to LDAP");
            idc.close();
        } catch (final Exception e) {
            e.printStackTrace();
        }

        System.out.println("End Trying to Connect to LDAP");
    }

    public static class MySSLSocketFactory extends SSLSocketFactory {

        private SSLSocketFactory socketFactory;

        public MySSLSocketFactory() {
            try {
                String keyStorePath = System.getProperty("custom.keystore.path");
                String keyStorePass = System.getProperty("custom.keystore.pass");

                // 加载Google LDAP的PKCS12格式KeyStore
                KeyStore keyStore = KeyStore.getInstance("PKCS12");
                try (FileInputStream fis = new FileInputStream(keyStorePath)) {
                    keyStore.load(fis, keyStorePass.toCharArray());
                }

                // 初始化KeyManager
                MyKeyManager keyManager = new MyKeyManager(keyStore, keyStorePass);
                KeyManager[] keyManagers = {keyManager};

                // 初始化TrustManager
                MyTrustManager trustManager = new MyTrustManager(keyStore);
                TrustManager[] trustManagers = {trustManager};

                // 创建SSL上下文
                SSLContext ctx = SSLContext.getInstance("TLSv1.3");
                ctx.init(keyManagers, trustManagers, new SecureRandom());

                socketFactory = ctx.getSocketFactory();
                System.out.println("自定义SSLSocketFactory初始化完成");
            } catch (final Exception ex) {
                ex.printStackTrace();
                throw new RuntimeException("初始化自定义Socket工厂失败", ex);
            }
        }

        @Override
        public String[] getDefaultCipherSuites() {
            return socketFactory.getDefaultCipherSuites();
        }

        @Override
        public String[] getSupportedCipherSuites() {
            return socketFactory.getSupportedCipherSuites();
        }

        @Override
        public Socket createSocket(Socket socket, String string, int i, boolean bln) throws IOException {
            System.out.println("调用createSocket(Socket, String, int, boolean)");
            return socketFactory.createSocket(socket, string, i, bln);
        }

        @Override
        public Socket createSocket(final Socket s, final InputStream consumed, final boolean autoClose) throws IOException {
            System.out.println("调用createSocket(Socket, InputStream, Boolean)");
            return socketFactory.createSocket(s, consumed, autoClose);
        }

        @Override
        public Socket createSocket() throws IOException {
            System.out.println("调用createSocket()");
            return socketFactory.createSocket();
        }

        @Override
        public Socket createSocket(String string, int i) throws IOException {
            System.out.println("调用createSocket(String, int)");
            return socketFactory.createSocket(string, i);
        }

        @Override
        public Socket createSocket(String string, int i, InetAddress ia, int i1) throws IOException {
            System.out.println("调用createSocket(String, int, InetAddress, int)");
            return socketFactory.createSocket(string, i, ia, i1);
        }

        @Override
        public Socket createSocket(InetAddress ia, int i) throws IOException {
            System.out.println("调用createSocket(InetAddress, int)");
            return socketFactory.createSocket(ia, i);
        }

        @Override
        public Socket createSocket(InetAddress ia, int i, InetAddress ia1, int i1) throws IOException {
            System.out.println("调用createSocket(InetAddress, InetAddress, int)");
            return socketFactory.createSocket(ia, i, ia1, i1);
        }

    }

    public static class MyKeyManager implements X509KeyManager {

        private KeyStore keyStore;
        private String keyStorePass;
        private String clientAlias;

        public MyKeyManager(KeyStore keyStore, String keyStorePass) throws Exception {
            this.keyStore = keyStore;
            this.keyStorePass = keyStorePass;
            // 获取KeyStore中的客户端证书别名
            Enumeration<String> aliases = keyStore.aliases();
            while (aliases.hasMoreElements()) {
                String alias = aliases.nextElement();
                if (keyStore.isKeyEntry(alias)) {
                    this.clientAlias = alias;
                    System.out.println("找到客户端证书别名: " + alias);
                    break;
                }
            }
        }

        @Override
        public String[] getClientAliases(final String keyType, final Principal[] issuers) {
            System.out.println("调用getClientAliases");
            return clientAlias == null ? new String[0] : new String[]{clientAlias};
        }

        @Override
        public String chooseClientAlias(final String[] keyType, final Principal[] issuers, final Socket socket) {
            System.out.println("调用chooseClientAlias");
            return clientAlias;
        }

        @Override
        public String[] getServerAliases(final String keyType, final Principal[] issuers) {
            return new String[0];
        }

        @Override
        public String chooseServerAlias(final String keyType, final Principal[] issuers, final Socket socket) {
            return null;
        }

        @Override
        public X509Certificate[] getCertificateChain(final String alias) {
            System.out.println("调用getCertificateChain，别名: " + alias);
            try {
                return (X509Certificate[]) keyStore.getCertificateChain(alias);
            } catch (Exception e) {
                e.printStackTrace();
                return new X509Certificate[0];
            }
        }

        @Override
        public PrivateKey getPrivateKey(final String alias) {
            System.out.println("调用getPrivateKey，别名: " + alias);
            try {
                return (PrivateKey) keyStore.getKey(alias, keyStorePass.toCharArray());
            } catch (Exception e) {
                e.printStackTrace();
                return null;
            }
        }

    }

    public static class MyTrustManager implements X509TrustManager {

        private X509TrustManager trustManager;

        public MyTrustManager(KeyStore keyStore) throws Exception {
            TrustManagerFactory tmf = TrustManagerFactory.getInstance(TrustManagerFactory.getDefaultAlgorithm());
            tmf.init(keyStore);
            for (TrustManager tm : tmf.getTrustManagers()) {
                if (tm instanceof X509TrustManager) {
                    this.trustManager = (X509TrustManager) tm;
                    break;
                }
            }
            if (trustManager == null) {
                throw new RuntimeException("未找到X509TrustManager");
            }
            System.out.println("自定义TrustManager初始化完成");
        }

        @Override
        public void checkClientTrusted(final X509Certificate[] chain, final String authType) throws CertificateException {
            trustManager.checkClientTrusted(chain, authType);
        }

        @Override
        public void checkServerTrusted(final X509Certificate[] chain, final String authType) throws CertificateException {
            trustManager.checkServerTrusted(chain, authType);
        }

        @Override
        public X509Certificate[] getAcceptedIssuers() {
            return trustManager.getAcceptedIssuers();
        }
    }
}

额外说明 #

• KeyStore格式适配：Google LDAP凭证为PKCS12格式，加载时需指定KeyStore.getInstance("PKCS12")，避免JKS格式不兼容问题。
• GraalVM原生镜像配置：若编译为原生镜像，需在reflect-config.json中添加以下反射配置：

[
  {
    "name": "LDAPIT$MySSLSocketFactory",
    "allDeclaredConstructors": true,
    "allDeclaredMethods": true
  },
  {
    "name": "LDAPIT$MyKeyManager",
    "allDeclaredConstructors": true,
    "allDeclaredMethods": true
  },
  {
    "name": "LDAPIT$MyTrustManager",
    "allDeclaredConstructors": true,
    "allDeclaredMethods": true
  }
]

• 多LDAP服务器适配：可通过为每个LDAP连接创建独立SSL上下文，或在自定义SocketFactory中根据目标地址选择对应KeyStore，实现多实例隔离。

内容的提问来源于stack exchange，提问作者PMinearo