simplify tls (#2977)

Author: tballison

docs/modules/ROOT/pages/using-tika/grpc/index.adoc

@@ -126,10 +126,11 @@ java -jar tika-grpc-<version>.jar --secure \
   --trust-cert-collection ca.pem --client-auth-required
 ----
 
-Mutual TLS is opt-in: `--client-auth-required` is off by default, so it has no
-effect unless `--trust-cert-collection` is also given (a missing or non-existent
-trust-collection path is silently ignored). The default port is `50052`
-(`-p`/`--port`).
+`--client-auth-required` implies `--secure` -- it's included above for clarity,
+but TLS is enabled automatically whenever client authentication is required.
+`--trust-cert-collection` must point to a readable file when
+`--client-auth-required` is set; the server refuses to start otherwise. The
+default port is `50052` (`-p`/`--port`).
 
 When running the Docker image, append these flags to the container command — they
 are forwarded to the server — and mount the certificate files into the container.

tika-grpc/src/main/java/org/apache/tika/pipes/grpc/TikaGrpcServer.java

@@ -70,10 +70,10 @@ public class TikaGrpcServer {
     @Parameter(names = {"--private-key-password"}, description = "Private key password, if needed")
     private String privateKeyPassword;
 
-    @Parameter(names = {"--trust-cert-collection"}, description = "The trust certificate collection (root certs). Example: ca.pem See: https://github.com/grpc/grpc-java/tree/b3ffb5078df361d7460786e134db7b5c00939246/examples/example-tls")
+    @Parameter(names = {"--trust-cert-collection"}, description = "The trust certificate collection (root certs). Required, and must be a readable file, when --client-auth-required is set. Example: ca.pem See: https://github.com/grpc/grpc-java/tree/b3ffb5078df361d7460786e134db7b5c00939246/examples/example-tls")
     private File trustCertCollection;
 
-    @Parameter(names = {"--client-auth-required"}, description = "Is Mutual TLS required?")
+    @Parameter(names = {"--client-auth-required"}, description = "Is Mutual TLS required? Implies --secure.")
     private boolean clientAuthRequired;
 
     @Parameter(names = {"-h", "-H", "--help"}, description = "Display help menu")
@@ -82,6 +82,10 @@ public class TikaGrpcServer {
     public void start() throws Exception {
         HealthStatusManager healthStatusManager = new HealthStatusManager();
         ServerCredentials creds;
+        if (clientAuthRequired && !secure) {
+            LOGGER.info("--client-auth-required implies --secure; enabling TLS.");
+            secure = true;
+        }
         if (secure) {
             TlsServerCredentials.Builder channelCredBuilder = TlsServerCredentials.newBuilder();
             channelCredBuilder.keyManager(certChain, privateKey, privateKeyPassword);
@@ -97,9 +101,6 @@ public void start() throws Exception {
             }
             creds = channelCredBuilder.build();
         } else {
-            if (clientAuthRequired) {
-                throw new IllegalArgumentException("--client-auth-required requires --secure; refusing to start");
-            }
             creds = InsecureServerCredentials.create();
         }
         if (tikaConfig == null) {

tika-grpc/src/test/java/org/apache/tika/pipes/grpc/TikaGrpcServerTlsTest.java

@@ -30,19 +30,28 @@
 /**
  * Covers the trust-cert-collection states that {@link TikaGrpcServer#start()} should refuse
  * to start on when {@code --client-auth-required} is set: omitted, nonexistent, unreadable,
- * and invalid/corrupt content, plus {@code --client-auth-required} without {@code --secure}.
+ * and invalid/corrupt content. Also covers {@code --client-auth-required} without
+ * {@code --secure}, which implies {@code --secure} rather than being rejected.
  */
 class TikaGrpcServerTlsTest {
     private static final File CERT_CHAIN = Paths.get("src", "test", "resources", "certs", "server1.pem").toFile();
     private static final File PRIVATE_KEY = Paths.get("src", "test", "resources", "certs", "server1.key").toFile();
     private static final File VALID_TRUST_COLLECTION = Paths.get("src", "test", "resources", "certs", "ca.pem").toFile();
 
     @Test
-    void clientAuthRequiredWithoutSecureRefusesToStart() {
+    void clientAuthRequiredWithoutSecureImpliesSecureAndStarts() throws Exception {
         TikaGrpcServer server = new TikaGrpcServer()
+                .setPort(0)
                 .setSecure(false)
+                .setCertChain(CERT_CHAIN)
+                .setPrivateKey(PRIVATE_KEY)
+                .setTrustCertCollection(VALID_TRUST_COLLECTION)
                 .setClientAuthRequired(true);
-        assertThrows(IllegalArgumentException.class, server::start);
+        try {
+            server.start();
+        } finally {
+            server.stop();
+        }
     }
 
     @Test