DATAGO-116001: event-management-agent: Configure JCSMP to use default JDK truststore for Event Portal connections #282
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,18 @@ | ||
| package com.solace.maas.ep.event.management.agent.plugin.common.util; | ||
|
|
||
| import org.springframework.stereotype.Component; | ||
|
|
||
| @Component | ||
| public class EnvironmentUtil { | ||
|
|
||
| /** | ||
| * Checks if custom CA certificates are present via the CUSTOM_CA_CERTS_PRESENT environment variable. | ||
| * Currently, Only Private CEMAs are capable of importing and using custom ca certs for operating ep runtime operations | ||
| * on brokers that may be setup with certs signed by custom ca | ||
| * @return true if CUSTOM_CA_CERTS_PRESENT is set to "1", false otherwise | ||
| */ | ||
| public boolean isCustomCACertPresent() { | ||
| String customCaCertsPresent = System.getenv("CUSTOM_CA_CERTS_PRESENT"); | ||
| return "1".equals(customCaCertsPresent); | ||
| } | ||
| } |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change | ||||
|---|---|---|---|---|---|---|
|
|
@@ -4,6 +4,7 @@ | |||||
| import com.solace.maas.ep.event.management.agent.plugin.jacoco.ExcludeFromJacocoGeneratedReport; | ||||||
| import com.solace.maas.ep.event.management.agent.plugin.messagingService.MessagingServiceConnectionProperties; | ||||||
| import com.solace.maas.ep.event.management.agent.plugin.messagingService.MessagingServiceUsersProperties; | ||||||
| import com.solace.maas.ep.event.management.agent.plugin.common.util.EnvironmentUtil; | ||||||
| import com.solace.messaging.config.SolaceConstants; | ||||||
| import com.solace.messaging.config.SolaceProperties; | ||||||
| import com.solacesystems.solclientj.core.handle.SessionHandle; | ||||||
|
|
@@ -16,8 +17,11 @@ | |||||
| import org.springframework.boot.autoconfigure.condition.ConditionalOnProperty; | ||||||
| import org.springframework.context.annotation.Configuration; | ||||||
|
|
||||||
| import java.io.File; | ||||||
| import java.net.InetAddress; | ||||||
| import java.net.UnknownHostException; | ||||||
| import java.nio.file.Path; | ||||||
| import java.nio.file.Paths; | ||||||
| import java.util.ArrayList; | ||||||
| import java.util.List; | ||||||
| import java.util.NoSuchElementException; | ||||||
|
|
@@ -38,6 +42,7 @@ public class VMRProperties { | |||||
| private static final String SOLACE_PROXY_PASSWORD = "solace.proxy.password"; | ||||||
|
|
||||||
| private final EventPortalPluginProperties eventPortalPluginProperties; | ||||||
| private final EnvironmentUtil environmentUtil; | ||||||
|
|
||||||
| /** | ||||||
| * The host used to connect to the VMR | ||||||
|
|
@@ -74,8 +79,9 @@ public class VMRProperties { | |||||
| */ | ||||||
|
|
||||||
| @Autowired | ||||||
| public VMRProperties(EventPortalPluginProperties eventPortalPluginProperties, EnvironmentUtil environmentUtil) { | ||||||
| this.eventPortalPluginProperties = eventPortalPluginProperties; | ||||||
| this.environmentUtil = environmentUtil; | ||||||
| } | ||||||
|
|
||||||
| public void parseVmrProperties() { | ||||||
|
|
@@ -122,9 +128,44 @@ public Properties getVmrProperties() { | |||||
| properties.setProperty(SolaceProperties.AuthenticationProperties.SCHEME_BASIC_PASSWORD, password); | ||||||
| properties.setProperty(SolaceProperties.ClientProperties.NAME, clientName); | ||||||
|
|
||||||
| //We will always use the default jks truststore for connecting to the EVMR | ||||||
|
There was a problem hiding this comment. The comment states 'We will always use the default jks truststore' but the implementation only configures it when
Suggested change
Collaborator
There was a problem hiding this comment. I agree with this comment 👍 |
||||||
| configureDefaultTrustStore(properties); | ||||||
|
|
||||||
| return properties; | ||||||
| } | ||||||
|
|
||||||
| private void configureDefaultTrustStore(Properties properties) { | ||||||
| if (properties == null) { | ||||||
| log.warn("Properties object is null"); | ||||||
| return; | ||||||
| } | ||||||
|
|
||||||
| if (!environmentUtil.isCustomCACertPresent()) { | ||||||
| log.debug("Custom CA certificates not present. Skipping explicit default truststore configuration."); | ||||||
moodiRealist marked this conversation as resolved.
Outdated
Show resolved
Hide resolved
|
||||||
| return; | ||||||
| } | ||||||
|
|
||||||
| setDefaultTrustStore(properties); | ||||||
| } | ||||||
|
|
||||||
| void setDefaultTrustStore(Properties properties) { | ||||||
| String javaHome = System.getProperty("java.home"); | ||||||
| if (StringUtils.isBlank(javaHome)) { | ||||||
| log.warn("java.home system property is not set. Cannot configure default truststore for JCSMP."); | ||||||
| return; | ||||||
| } | ||||||
| Path defaultTrustStorePath = Paths.get(javaHome, "lib", "security", "cacerts"); | ||||||
| File trustStoreFile = defaultTrustStorePath.toFile(); | ||||||
|
|
||||||
| if (!trustStoreFile.exists() || !trustStoreFile.canRead()) { | ||||||
| log.warn("Default truststore not found or not readable at: {}. JCSMP connection may fail.", defaultTrustStorePath); | ||||||
| return; | ||||||
| } | ||||||
|
|
||||||
| log.debug("Custom CA certificates present. Explicitly configuring EVMR connection to use default truststore: {}", defaultTrustStorePath); | ||||||
moodiRealist marked this conversation as resolved.
Outdated
Show resolved
Hide resolved
|
||||||
| properties.setProperty(SolaceProperties.TransportLayerSecurityProperties.TRUST_STORE_PATH, defaultTrustStorePath.toString()); | ||||||
| } | ||||||
|
|
||||||
|
Comment on lines
151
to
168
Contributor
Author
There was a problem hiding this comment. package private to help in testing |
||||||
| public List<String> getRTOSessionProperties() { | ||||||
| parseVmrProperties(); | ||||||
|
|
||||||
|
|
||||||
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Can we use
@MockitoBeanin here as well?