Class StartTlsResponse

public abstract class StartTlsResponse
extends Object
implements ExtendedResponse

This class implements the LDAPv3 Extended Response for StartTLS as defined in Lightweight Directory Access Protocol (v3): Extension for Transport Layer Security The object identifier for StartTLS is 1.3.6.1.4.1.1466.20037 and no extended response value is defined.

The Start TLS extended request and response are used to establish a TLS connection over the existing LDAP connection associated with the JNDI context on which extendedOperation() is invoked. Typically, a JNDI program uses the StartTLS extended request and response classes as follows.

import javax.naming.ldap.*;

// Open an LDAP association
LdapContext ctx = new InitialLdapContext();

// Perform a StartTLS extended operation
StartTlsResponse tls =
    (StartTlsResponse) ctx.extendedOperation(new StartTlsRequest());

// Open a TLS connection (over the existing LDAP association) and get details
// of the negotiated TLS session: cipher suite, peer certificate, ...
SSLSession session = tls.negotiate();

// ... use ctx to perform protected LDAP operations

// Close the TLS connection (revert back to the underlying LDAP association)
tls.close();

// ... use ctx to perform unprotected LDAP operations

// Close the LDAP association
ctx.close;

Fields

OID

public static final String OID

The StartTLS extended response's assigned object identifier is 1.3.6.1.4.1.1466.20037.

See Also:

Constant Field Values

Constructors

StartTlsResponse

protected StartTlsResponse()

Constructs a StartTLS extended response. A concrete subclass must have a public no-arg constructor.

Methods

getID

public String getID()

Retrieves the StartTLS response's object identifier string.

Specified by:

getID in interface ExtendedResponse

Returns:

The object identifier string, "1.3.6.1.4.1.1466.20037".

getEncodedValue

public byte[] getEncodedValue()

Retrieves the StartTLS response's ASN.1 BER encoded value. Since the response has no defined value, null is always returned.

Specified by:

getEncodedValue in interface ExtendedResponse

Returns:

The null value.

setEnabledCipherSuites

public abstract void setEnabledCipherSuites(String[] suites)

Overrides the default list of cipher suites enabled for use on the TLS connection. The cipher suites must have already been listed by SSLSocketFactory.getSupportedCipherSuites() as being supported. Even if a suite has been enabled, it still might not be used because the peer does not support it, or because the requisite certificates (and private keys) are not available.

Parameters:

suites - The non-null list of names of all the cipher suites to enable.

See Also:

negotiate()

setHostnameVerifier

public abstract void setHostnameVerifier(HostnameVerifier verifier)

Sets the hostname verifier used by negotiate() after the TLS handshake has completed and the default hostname verification has failed. setHostnameVerifier() must be called before negotiate() is invoked for it to have effect. If called after negotiate(), this method does not do anything.

Parameters:

verifier - The non-null hostname verifier callback.

See Also:

negotiate()

negotiate

public abstract SSLSession negotiate()
                              throws IOException

Returns:

The negotiated SSL session

Throws:

IOException - If an IO error was encountered while establishing the TLS session.

See Also:

setEnabledCipherSuites(java.lang.String[]), setHostnameVerifier(javax.net.ssl.HostnameVerifier)

negotiate

public abstract SSLSession negotiate(SSLSocketFactory factory)
                              throws IOException

Parameters:

factory - The possibly null SSL socket factory to use. If null, the default SSL socket factory is used.

Returns:

The negotiated SSL session

Throws:

IOException - If an IO error was encountered while establishing the TLS session.

See Also:

setEnabledCipherSuites(java.lang.String[]), setHostnameVerifier(javax.net.ssl.HostnameVerifier)

close

public abstract void close()
                    throws IOException

Closes the TLS connection gracefully and reverts back to the underlying connection.

Throws:

IOException - If an IO error was encountered while closing the TLS connection