Skip to content

Commit eac08ed

Browse files
davidradldavidradl
authored
HTTP-119 Pickup up public CAs when there are no security options configured (#128)
Signed-off-by: davidradl <david_radley@uk.ibm.com>
1 parent d712792 commit eac08ed

File tree

3 files changed

+39
-17
lines changed

3 files changed

+39
-17
lines changed

‎CHANGELOG.md

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,7 @@
44

55
### Added
66

7+
- Added support for built in JVM certificates if no security is configured.
78
- Added support for OIDC Bearer tokens.
89

910
### Fixed

‎README.md

Lines changed: 19 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -392,18 +392,21 @@ An example of such a mask would be `3XX, 4XX, 5XX`. In this case, all 300s, 400s
392392
Many status codes can be defined in one value, where each code should be separated with comma, for example:
393393
`401, 402, 403`. In this example, codes 401, 402 and 403 would not be interpreted as error codes.
394394

395-
## TLS and mTLS support
396-
Both Http Sink and Lookup Source connectors supports Https communication using TLS 1.2 and mTLS.
395+
## TLS (more secure replacement for SSL) and mTLS support
396+
397+
Both Http Sink and Lookup Source connectors support HTTPS communication using TLS 1.2 and mTLS.
397398
To enable Https communication simply use `https` protocol in endpoint's URL.
398-
If certificate used by HTTP server is self-signed, or it is signed byt not globally recognize CA
399-
you would have to add this certificate to connector's keystore as trusted certificate.
400-
In order to do so, use `gid.connector.http.security.cert.server` connector property,
401-
which value is a path to the certificate. You can also use your organization's CA Root certificate.
402-
You can specify many certificate, separating each path with `,`.
403-
404-
You can also configure connector to use mTLS. For this simply use `gid.connector.http.security.cert.client`
405-
and `gid.connector.http.security.key.client` connector properties to specify path to certificate and
406-
private key that should be used by connector. Key MUST be in `PCKS8` format. Both PEM and DER keys are
399+
400+
To specify certificate(s) to be used by the server, use `gid.connector.http.security.cert.server` connector property;
401+
the value is a comma separated list of paths to certificate(s), for example you can use your organization's CA
402+
Root certificate, or a self-signed certificate.
403+
404+
Note that if there are no security properties for a `https` url then, the JVMs default certificates are
405+
used - allowing use of globally recognized CAs without the need for configuration.
406+
407+
You can also configure the connector to use mTLS. For this simply use `gid.connector.http.security.cert.client`
408+
and `gid.connector.http.security.key.client` connector properties to specify paths to the certificate and
409+
private key. The key MUST be in `PCKS8` format. Both PEM and DER keys are
407410
allowed.
408411

409412
All properties can be set via Sink's builder `.setProperty(...)` method or through Sink and Source table DDL.
@@ -415,7 +418,7 @@ To enable this option use `gid.connector.http.security.cert.server.allowSelfSign
415418
## Basic Authentication
416419
The connector supports Basic Authentication using a HTTP `Authorization` header.
417420
The header value can be set via properties, similarly as for other headers. The connector converts the passed value to Base64 and uses it for the request.
418-
If the used value starts with the prefix `Basic `, or `gid.connector.http.source.lookup.use-raw-authorization-header`
421+
If the used value starts with the prefix `Basic`, or `gid.connector.http.source.lookup.use-raw-authorization-header`
419422
is set to `'true'`, it will be used as header value as is, without any extra modification.
420423

421424
## OIDC Bearer Authentication
@@ -452,13 +455,13 @@ be requested if the current time is later than the cached token expiry time minu
452455
| lookup.max-retries | optional | The max retry times if the lookup failed; default is 3. See the following <a href="#lookup-cache">Lookup Cache</a> section for more details. |
453456
| gid.connector.http.lookup.error.code | optional | List of HTTP status codes that should be treated as errors by HTTP Source, separated with comma. |
454457
| gid.connector.http.lookup.error.code.exclude | optional | List of HTTP status codes that should be excluded from the `gid.connector.http.lookup.error.code` list, separated with comma. |
455-
| gid.connector.http.security.cert.server | optional | Path to trusted HTTP server certificate that should be add to connectors key store. More than one path can be specified using `,` as path delimiter. |
458+
| gid.connector.http.security.cert.server | optional | Comma separated paths to trusted HTTP server certificates that should be added to the connectors trust store. |
456459
| gid.connector.http.security.cert.client | optional | Path to trusted certificate that should be used by connector's HTTP client for mTLS communication. |
457460
| gid.connector.http.security.key.client | optional | Path to trusted private key that should be used by connector's HTTP client for mTLS communication. |
458461
| gid.connector.http.security.cert.server.allowSelfSigned | optional | Accept untrusted certificates for TLS communication. |
459-
| gid.connector.http.security.oidc.token.request | optional | OIDC `Token Request` body in `application/x-www-form-urlencoded` encoding |
460-
| gid.connector.http.security.oidc.token.endpoint.url | optional | OIDC `Token Endpoint` url, to which the token request will be issued |
461-
| gid.connector.http.security.oidc.token.expiry.reduction | optional | OIDC tokens will be requested if the current time is later than the cached token expiry time minus this value. |
462+
| gid.connector.http.security.oidc.token.request | optional | OIDC `Token Request` body in `application/x-www-form-urlencoded` encoding |
463+
| gid.connector.http.security.oidc.token.endpoint.url | optional | OIDC `Token Endpoint` url, to which the token request will be issued |
464+
| gid.connector.http.security.oidc.token.expiry.reduction | optional | OIDC tokens will be requested if the current time is later than the cached token expiry time minus this value. |
462465
| gid.connector.http.source.lookup.request.timeout | optional | Sets HTTP request timeout in seconds. If not specified, the default value of 30 seconds will be used. |
463466
| gid.connector.http.source.lookup.request.thread-pool.size | optional | Sets the size of pool thread for HTTP lookup request processing. Increasing this value would mean that more concurrent requests can be processed in the same time. If not specified, the default value of 8 threads will be used. |
464467
| gid.connector.http.source.lookup.response.thread-pool.size | optional | Sets the size of pool thread for HTTP lookup response processing. Increasing this value would mean that more concurrent requests can be processed in the same time. If not specified, the default value of 4 threads will be used. |

‎src/main/java/com/getindata/connectors/http/internal/utils/JavaNetHttpClientFactory.java

Lines changed: 19 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,7 @@
22

33
import java.net.http.HttpClient;
44
import java.net.http.HttpClient.Redirect;
5+
import java.security.NoSuchAlgorithmException;
56
import java.util.ArrayList;
67
import java.util.List;
78
import java.util.Properties;
@@ -73,7 +74,8 @@ public static HttpClient createClient(Properties properties, Executor executor)
7374
* @return new {@link SSLContext} instance.
7475
*/
7576
private static SSLContext getSslContext(Properties properties) {
76-
SecurityContext securityContext = createSecurityContext(properties);
77+
String keyStorePath =
78+
properties.getProperty(HttpConnectorConfigConstants.KEY_STORE_PATH, "");
7779

7880
boolean selfSignedCert = Boolean.parseBoolean(
7981
properties.getProperty(HttpConnectorConfigConstants.ALLOW_SELF_SIGNED, "false"));
@@ -88,6 +90,22 @@ private static SSLContext getSslContext(Properties properties) {
8890
String clientPrivateKey = properties
8991
.getProperty(HttpConnectorConfigConstants.CLIENT_PRIVATE_KEY, "");
9092

93+
if (StringUtils.isNullOrWhitespaceOnly(keyStorePath)
94+
&& !selfSignedCert
95+
// checking the property in this way so that serverTrustedCerts is not left and null
96+
// or empty, which causes the http client to error.
97+
&& (properties.getProperty(HttpConnectorConfigConstants.SERVER_TRUSTED_CERT)
98+
== null)
99+
&& StringUtils.isNullOrWhitespaceOnly(clientCert)
100+
&& StringUtils.isNullOrWhitespaceOnly(clientPrivateKey)) {
101+
try {
102+
return SSLContext.getDefault();
103+
} catch (NoSuchAlgorithmException e) {
104+
throw new RuntimeException(e);
105+
}
106+
}
107+
108+
SecurityContext securityContext = createSecurityContext(properties);
91109
for (String cert : serverTrustedCerts) {
92110
if (!StringUtils.isNullOrWhitespaceOnly(cert)) {
93111
securityContext.addCertToTrustStore(cert);

0 commit comments

Comments
 (0)