diff --git a/README.md b/README.md
index 449d271..1813451 100644
--- a/README.md
+++ b/README.md
@@ -74,13 +74,13 @@ DDC is a Maven project (binaries are deployed in Maven Central) so you can impor
ddc-core
com.imperva.ddc
- 7.4.0.0.0.0
+ 7.5.0.0.0.0
ddc-service
com.imperva.ddc
- 7.4.0.0.0.0
+ 7.5.0.0.0.0
~~~
diff --git a/source/ddc-core/pom.xml b/source/ddc-core/pom.xml
index 4989a4f..e496dc4 100644
--- a/source/ddc-core/pom.xml
+++ b/source/ddc-core/pom.xml
@@ -6,7 +6,7 @@
com.imperva.ddc
domain-directory-controller
- 7.4.0.0.0.0
+ 7.5.0.0.0.0
ddc-core
diff --git a/source/ddc-core/src/main/java/com/imperva/ddc/core/Driver.java b/source/ddc-core/src/main/java/com/imperva/ddc/core/Driver.java
index a5dc37c..4f209a9 100644
--- a/source/ddc-core/src/main/java/com/imperva/ddc/core/Driver.java
+++ b/source/ddc-core/src/main/java/com/imperva/ddc/core/Driver.java
@@ -18,9 +18,13 @@
import org.apache.directory.ldap.client.api.exception.InvalidConnectionException;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
+import javax.net.ssl.SSLContext;
+import javax.net.ssl.SSLEngine;
import javax.net.ssl.TrustManager;
import javax.net.ssl.X509TrustManager;
+import java.security.GeneralSecurityException;
import java.util.ArrayList;
+import java.util.Arrays;
import java.util.List;
import java.util.Map;
@@ -30,6 +34,8 @@
*/
class Driver extends DriverBase {
private static final Logger LOGGER = LoggerFactory.getLogger(Driver.class.getName());
+ private static final String[] FALLBACK_TLS_PROTOCOLS = new String[]{"TLSv1.2", "TLSv1.3"};
+ private static final String[] JVM_TLS_PROTOCOLS = resolveJvmTlsProtocols();
@Override
LdapConnectionResult connect(Endpoint endpoint) {
@@ -210,6 +216,7 @@ LdapNetworkConnection ldapNetworkConnectionGetInstance(String host, Integer port
ldapConnectionConfig.setUseSsl(isSecuredConnection);
ldapConnectionConfig.setLdapHost(host);
ldapConnectionConfig.setLdapPort(port);
+ ldapConnectionConfig.setEnabledProtocols(JVM_TLS_PROTOCOLS.clone());
Boolean ignoreChainException = isIgnoreSSLValidations == null ? Boolean.parseBoolean(DDCProperties.getInstance().getProperty("ignore.ssl.cert.chain.exception")) : isIgnoreSSLValidations;
if (isSecuredConnection && ignoreChainException) {
TrustManager[] trustAllCerts = new TrustManager[]{
@@ -231,4 +238,23 @@ public void checkServerTrusted(
}
return new LdapNetworkConnection(ldapConnectionConfig);
}
+
+ /**
+ * Resolves the TLS protocols enabled by the JVM for client connections.
+ * This honors the runtime's TLS configuration and allows supported protocol
+ * versions, including TLS 1.3, to be used without maintaining a fixed list.
+ * Falls back to TLS 1.2 and TLS 1.3 if the JVM defaults cannot be resolved.
+ */
+ private static String[] resolveJvmTlsProtocols() {
+ try {
+ SSLContext sslContext = SSLContext.getInstance("TLS");
+ sslContext.init(null, null, null);
+ SSLEngine sslEngine = sslContext.createSSLEngine();
+ sslEngine.setUseClientMode(true);
+ return sslEngine.getEnabledProtocols();
+ } catch (GeneralSecurityException | RuntimeException e) {
+ LOGGER.warn("Could not read the JVM default TLS protocols, falling back to {}", Arrays.toString(FALLBACK_TLS_PROTOCOLS), e);
+ return FALLBACK_TLS_PROTOCOLS.clone();
+ }
+ }
}
diff --git a/source/ddc-service/pom.xml b/source/ddc-service/pom.xml
index efd2c4f..efe0986 100644
--- a/source/ddc-service/pom.xml
+++ b/source/ddc-service/pom.xml
@@ -5,7 +5,7 @@
com.imperva.ddc
domain-directory-controller
- 7.4.0.0.0.0
+ 7.5.0.0.0.0
ddc-service
@@ -14,7 +14,7 @@
com.imperva.ddc
ddc-core
- 7.4.0.0.0.0
+ 7.5.0.0.0.0
diff --git a/source/pom.xml b/source/pom.xml
index 019ff1d..5a0fec3 100644
--- a/source/pom.xml
+++ b/source/pom.xml
@@ -6,7 +6,7 @@
pom
com.imperva.ddc
domain-directory-controller
- 7.4.0.0.0.0
+ 7.5.0.0.0.0
Domain Directory Controller
DDC is an Active Directory Java SDK designed to simplify AD interaction for small, medium and large projects.
diff --git a/startingkit/ddckit/pom.xml b/startingkit/ddckit/pom.xml
index 7f20b4f..7dd1781 100644
--- a/startingkit/ddckit/pom.xml
+++ b/startingkit/ddckit/pom.xml
@@ -54,7 +54,7 @@
com.imperva.ddc
ddc-service
- 7.4.0.0.0.0
+ 7.5.0.0.0.0