-
Bug
-
Resolution: Fixed
-
Low (View bug fix roadmap)
-
5.2
-
None
-
5.02
-
Symptoms
When connecting a directory to LDAP via SSL you will see an error like this in the web browser:
Connection test failed. Response from the server:
localhost:636; nested exception is javax.naming.CommunicationException: localhost:636 [Root exception is java.lang.RuntimeException: Unable to set hostname verification on SSLSocket]
In the log file there will be an entry like this:
2012-11-18 18:46:38,147 QuartzWorker-1 ERROR [atlassian.crowd.directory.DbCachingDirectoryPoller] Error occurred while refreshing the cache for directory [ 10000 ].
com.atlassian.crowd.exception.OperationFailedException: org.springframework.ldap.CommunicationException: localhost:636; nested exception is javax.naming.CommunicationException: localhost:636 [Root exception is java.lang.RuntimeException: Unable to set hostname verification on SSLSocket]
at com.atlassian.crowd.directory.SpringLDAPConnector.searchEntitiesWithRequestControls(SpringLDAPConnector.java:416)
at com.atlassian.crowd.directory.SpringLDAPConnector.searchEntities(SpringLDAPConnector.java:384)
at com.atlassian.crowd.directory.SpringLDAPConnector.searchUserObjects(SpringLDAPConnector.java:574)
at com.atlassian.crowd.directory.SpringLDAPConnector.searchUsers(SpringLDAPConnector.java:944)
at com.atlassian.crowd.directory.ldap.cache.RemoteDirectoryCacheRefresher.findAllRemoteUsers(RemoteDirectoryCacheRefresher.java:41)
at com.atlassian.crowd.directory.ldap.cache.RemoteDirectoryCacheRefresher.synchroniseAllUsers(RemoteDirectoryCacheRefresher.java:60)
at com.atlassian.crowd.directory.ldap.cache.AbstractCacheRefresher.synchroniseAll(AbstractCacheRefresher.java:40)
at com.atlassian.crowd.directory.DbCachingRemoteDirectory.synchroniseCache(DbCachingRemoteDirectory.java:619)
at com.atlassian.crowd.manager.directory.DirectorySynchroniserImpl.synchronise(DirectorySynchroniserImpl.java:63)
at com.atlassian.crowd.directory.DbCachingDirectoryPoller.pollChanges(DbCachingDirectoryPoller.java:50)
at com.atlassian.crowd.manager.directory.monitor.poller.DirectoryPollerJob.execute(DirectoryPollerJob.java:34)
at org.quartz.core.JobRunShell.run(JobRunShell.java:195)
at com.atlassian.multitenant.quartz.MultiTenantThreadPool$MultiTenantRunnable.run(MultiTenantThreadPool.java:72)
at org.quartz.simpl.SimpleThreadPool$WorkerThread.run(SimpleThreadPool.java:520)
Caused by: org.springframework.ldap.CommunicationException: localhost:636; nested exception is javax.naming.CommunicationException: localhost:636 [Root exception is java.lang.RuntimeException: Unable to set hostname verification on SSLSocket]
at org.springframework.ldap.support.LdapUtils.convertLdapException(LdapUtils.java:98)
at org.springframework.ldap.core.support.AbstractContextSource.createContext(AbstractContextSource.java:266)
at org.springframework.ldap.core.support.AbstractContextSource.getContext(AbstractContextSource.java:106)
at org.springframework.ldap.core.support.AbstractContextSource.getReadWriteContext(AbstractContextSource.java:138)
at org.springframework.ldap.transaction.compensating.manager.TransactionAwareContextSourceProxy.getReadWriteContext(TransactionAwareContextSourceProxy.java:94)
at org.springframework.ldap.transaction.compensating.manager.TransactionAwareContextSourceProxy.getReadOnlyContext(TransactionAwareContextSourceProxy.java:65)
at org.springframework.ldap.core.LdapTemplate.search(LdapTemplate.java:287)
at org.springframework.ldap.core.LdapTemplate.search(LdapTemplate.java:237)
at org.springframework.ldap.core.LdapTemplate.search(LdapTemplate.java:624)
at org.springframework.ldap.core.LdapTemplate.search(LdapTemplate.java:535)
at com.atlassian.crowd.directory.ldap.LdapTemplateWithClassLoaderWrapper$1.call(LdapTemplateWithClassLoaderWrapper.java:56)
at com.atlassian.crowd.directory.ldap.LdapTemplateWithClassLoaderWrapper$1.call(LdapTemplateWithClassLoaderWrapper.java:53)
at com.atlassian.crowd.directory.ldap.LdapTemplateWithClassLoaderWrapper.invokeWithContextClassLoader(LdapTemplateWithClassLoaderWrapper.java:43)
at com.atlassian.crowd.directory.ldap.LdapTemplateWithClassLoaderWrapper.search(LdapTemplateWithClassLoaderWrapper.java:53)
at com.atlassian.crowd.directory.SpringLDAPConnector.searchEntitiesWithRequestControls(SpringLDAPConnector.java:412)
... 13 more
Caused by: javax.naming.CommunicationException: localhost:636 [Root exception is java.lang.RuntimeException: Unable to set hostname verification on SSLSocket]
at com.sun.jndi.ldap.Connection.<init>(Unknown Source)
at com.sun.jndi.ldap.LdapClient.<init>(Unknown Source)
at com.sun.jndi.ldap.LdapClient.getInstance(Unknown Source)
at com.sun.jndi.ldap.LdapCtx.connect(Unknown Source)
at com.sun.jndi.ldap.LdapCtx.<init>(Unknown Source)
at com.sun.jndi.ldap.LdapCtxFactory.getUsingURL(Unknown Source)
at com.sun.jndi.ldap.LdapCtxFactory.getUsingURLs(Unknown Source)
at com.sun.jndi.ldap.LdapCtxFactory.getLdapCtxInstance(Unknown Source)
at com.sun.jndi.ldap.LdapCtxFactory.getInitialContext(Unknown Source)
at javax.naming.spi.NamingManager.getInitialContext(Unknown Source)
at javax.naming.InitialContext.getDefaultInitCtx(Unknown Source)
at javax.naming.InitialContext.init(Unknown Source)
at javax.naming.ldap.InitialLdapContext.<init>(Unknown Source)
at org.springframework.ldap.core.support.LdapContextSource.getDirContextInstance(LdapContextSource.java:43)
at org.springframework.ldap.core.support.AbstractContextSource.createContext(AbstractContextSource.java:254)
... 26 more
Caused by: java.lang.RuntimeException: Unable to set hostname verification on SSLSocket
at com.atlassian.crowd.directory.ssl.LdapHostnameVerificationSSLSocketFactory.makeUseLdapVerification(LdapHostnameVerificationSSLSocketFactory.java:85)
at com.atlassian.crowd.directory.ssl.LdapHostnameVerificationSSLSocketFactory.createSocket(LdapHostnameVerificationSSLSocketFactory.java:125)
at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
at sun.reflect.NativeMethodAccessorImpl.invoke(Unknown Source)
at sun.reflect.DelegatingMethodAccessorImpl.invoke(Unknown Source)
at java.lang.reflect.Method.invoke(Unknown Source)
at com.sun.jndi.ldap.Connection.createSocket(Unknown Source)
... 41 more
Caused by: java.lang.NoSuchMethodException: sun.security.ssl.SSLSocketImpl.trySetHostnameVerification(java.lang.String)
at java.lang.Class.getMethod(Unknown Source)
at com.atlassian.crowd.directory.ssl.LdapHostnameVerificationSSLSocketFactory.makeUseLdapVerification(LdapHostnameVerificationSSLSocketFactory.java:80)
... 47 more
Steps to Reproduce
- Run JIRA using Java 7, not Java 6 - Java 7 is listed as a supported platform
- Import SSL certificate of the LDAP server into JIRA's JVM keystore as per normal procedure
- Add an LDAP directory, attempt to configure using SSL
- Observe the error message and log entry described above
Workaround
Use Java 6
- is caused by
-
-
- Closed
-
-
CWD-2740 Support running Crowd under JDK 7
- Closed
- is related to
-
-
- Closed
-
- relates to
-
- Closed
- is incorporated by
-
JRADEV-11821 Failed to load
[JRASERVER-30634] Can't connect to LDAP over SSL when using Java 7
Hi Mick,
This issue has been fixed and the fix will be available in the JIRA 6.0 release.
Mick Flanigan
added a comment - We are seeing issues as well and it is also affecting our Enterprise Tester to JIRA connections and LDAP. Urgency is high this gets fixed.
Mick Flanigan
added a comment - We are seeing issues as well and it is also affecting our Enterprise Tester to JIRA connections and LDAP. Urgency is high this gets fixed. Fixed by the crowd upgrade on master branch. Ready for QA.
Mark Moskovitz
added a comment - I completely agree. Please upgrade this to Major or Critical given that JIRA 6 is dropping Java 6 support:
https://confluence.atlassian.com/display/JIRA/End+of+Support+Announcements+for+JIRA
... and the latest EAP release seems to have Crowd 2.4.8:
https://confluence.atlassian.com/display/JIRA/JIRA+6.0+EAP+4+(m06)+Release+Notes
http://www.atlassian.com/software/jira/downloads/binary/atlassian-jira-6.0-m07.1.tar.gz
$ ls atlassian-jira-6.0-m07.1-standalone/**/embedded-crowd-core* atlassian-jira-6.0-m07.1-standalone/atlassian-jira/WEB-INF/lib/embedded-crowd-core-2.4.8.jar
I believe at least 2.5.0 is required to address this problem as 2.5.x fixed the Confluence-side problem for me.
I can't speak for others - but although we would appreciate a backport to JIRA 5.2.x in order to prepare for JIRA 6 in increments, it would also be acceptable for us if we knew that JIRA 6 would address this problem. At this time, it looks like JIRA 6 does not address this problem.
The scenario that is not acceptable is for Atlassian to drop support for Java 6, and not support LDAP over SSL with Java 7.
We have just upgraded JIRA to 5.2.6 and moving everything to new server with Java 7 installed. And it seems that we can not connect from JIRA to LDAP server using SSL. Yeah, we can use workaround for this by installing additional Java 6 version just for Jira but it would be great to avoid this. Can we expect a bug fix soon?
Ken Mohr
added a comment - If possible, it would be nice to have this backported to jira 5.2.x since it will take a bit of time for Jira 6.0 to be adopted by all the add-on vendors.
Ken Mohr
added a comment - If possible, it would be nice to have this backported to jira 5.2.x since it will take a bit of time for Jira 6.0 to be adopted by all the add-on vendors. Hi ohernandez@atlassian.com, yeah, I think we can wait for 6.0 for this.
Mark Moskovitz
added a comment - This is preventing us from moving to Java 7 as well. A huge bug.
We are currently running into this issue while migrating to Jira 5.2.
Our corporate IT security guideline requires secure LDAP access.
Is there any plan to provide a fix for Jira 5.2?
The workaround suggests to use Java 6, however this is not the recommended version. What are the side effects?
I see this is fixed with Jira 6, is there a confirmed target release date?