From 4bde889c2271b289322fb4c2ae7e6eb1394a2888 Mon Sep 17 00:00:00 2001 From: "adar.dorham" Date: Thu, 20 Aug 2026 21:05:15 +0300 Subject: [PATCH] COUN-5104 - Enable JVM default TLS protocols --- README.md | 4 +-- source/ddc-core/pom.xml | 2 +- .../java/com/imperva/ddc/core/Driver.java | 26 +++++++++++++++++++ source/ddc-service/pom.xml | 4 +-- source/pom.xml | 2 +- startingkit/ddckit/pom.xml | 2 +- 6 files changed, 33 insertions(+), 7 deletions(-) diff --git a/README.md b/README.md index 449d271..1813451 100644 --- a/README.md +++ b/README.md @@ -74,13 +74,13 @@ DDC is a Maven project (binaries are deployed in Maven Central) so you can impor ddc-core com.imperva.ddc - 7.4.0.0.0.0 + 7.5.0.0.0.0 ddc-service com.imperva.ddc - 7.4.0.0.0.0 + 7.5.0.0.0.0 ~~~ diff --git a/source/ddc-core/pom.xml b/source/ddc-core/pom.xml index 4989a4f..e496dc4 100644 --- a/source/ddc-core/pom.xml +++ b/source/ddc-core/pom.xml @@ -6,7 +6,7 @@ com.imperva.ddc domain-directory-controller - 7.4.0.0.0.0 + 7.5.0.0.0.0 ddc-core diff --git a/source/ddc-core/src/main/java/com/imperva/ddc/core/Driver.java b/source/ddc-core/src/main/java/com/imperva/ddc/core/Driver.java index a5dc37c..4f209a9 100644 --- a/source/ddc-core/src/main/java/com/imperva/ddc/core/Driver.java +++ b/source/ddc-core/src/main/java/com/imperva/ddc/core/Driver.java @@ -18,9 +18,13 @@ import org.apache.directory.ldap.client.api.exception.InvalidConnectionException; import org.slf4j.Logger; import org.slf4j.LoggerFactory; +import javax.net.ssl.SSLContext; +import javax.net.ssl.SSLEngine; import javax.net.ssl.TrustManager; import javax.net.ssl.X509TrustManager; +import java.security.GeneralSecurityException; import java.util.ArrayList; +import java.util.Arrays; import java.util.List; import java.util.Map; @@ -30,6 +34,8 @@ */ class Driver extends DriverBase { private static final Logger LOGGER = LoggerFactory.getLogger(Driver.class.getName()); + private static final String[] FALLBACK_TLS_PROTOCOLS = new String[]{"TLSv1.2", "TLSv1.3"}; + private static final String[] JVM_TLS_PROTOCOLS = resolveJvmTlsProtocols(); @Override LdapConnectionResult connect(Endpoint endpoint) { @@ -210,6 +216,7 @@ LdapNetworkConnection ldapNetworkConnectionGetInstance(String host, Integer port ldapConnectionConfig.setUseSsl(isSecuredConnection); ldapConnectionConfig.setLdapHost(host); ldapConnectionConfig.setLdapPort(port); + ldapConnectionConfig.setEnabledProtocols(JVM_TLS_PROTOCOLS.clone()); Boolean ignoreChainException = isIgnoreSSLValidations == null ? Boolean.parseBoolean(DDCProperties.getInstance().getProperty("ignore.ssl.cert.chain.exception")) : isIgnoreSSLValidations; if (isSecuredConnection && ignoreChainException) { TrustManager[] trustAllCerts = new TrustManager[]{ @@ -231,4 +238,23 @@ public void checkServerTrusted( } return new LdapNetworkConnection(ldapConnectionConfig); } + + /** + * Resolves the TLS protocols enabled by the JVM for client connections. + * This honors the runtime's TLS configuration and allows supported protocol + * versions, including TLS 1.3, to be used without maintaining a fixed list. + * Falls back to TLS 1.2 and TLS 1.3 if the JVM defaults cannot be resolved. + */ + private static String[] resolveJvmTlsProtocols() { + try { + SSLContext sslContext = SSLContext.getInstance("TLS"); + sslContext.init(null, null, null); + SSLEngine sslEngine = sslContext.createSSLEngine(); + sslEngine.setUseClientMode(true); + return sslEngine.getEnabledProtocols(); + } catch (GeneralSecurityException | RuntimeException e) { + LOGGER.warn("Could not read the JVM default TLS protocols, falling back to {}", Arrays.toString(FALLBACK_TLS_PROTOCOLS), e); + return FALLBACK_TLS_PROTOCOLS.clone(); + } + } } diff --git a/source/ddc-service/pom.xml b/source/ddc-service/pom.xml index efd2c4f..efe0986 100644 --- a/source/ddc-service/pom.xml +++ b/source/ddc-service/pom.xml @@ -5,7 +5,7 @@ com.imperva.ddc domain-directory-controller - 7.4.0.0.0.0 + 7.5.0.0.0.0 ddc-service @@ -14,7 +14,7 @@ com.imperva.ddc ddc-core - 7.4.0.0.0.0 + 7.5.0.0.0.0 diff --git a/source/pom.xml b/source/pom.xml index 019ff1d..5a0fec3 100644 --- a/source/pom.xml +++ b/source/pom.xml @@ -6,7 +6,7 @@ pom com.imperva.ddc domain-directory-controller - 7.4.0.0.0.0 + 7.5.0.0.0.0 Domain Directory Controller DDC is an Active Directory Java SDK designed to simplify AD interaction for small, medium and large projects. diff --git a/startingkit/ddckit/pom.xml b/startingkit/ddckit/pom.xml index 7f20b4f..7dd1781 100644 --- a/startingkit/ddckit/pom.xml +++ b/startingkit/ddckit/pom.xml @@ -54,7 +54,7 @@ com.imperva.ddc ddc-service - 7.4.0.0.0.0 + 7.5.0.0.0.0