Vikas Kumar created RANGER-5734:
-----------------------------------
Summary: Update EmbeddedServer to use custom TrustStore instead of
relying on JVM's default cacerts
Key: RANGER-5734
URL: https://issues.apache.org/jira/browse/RANGER-5734
Project: Ranger
Issue Type: Improvement
Components: admin, kms
Reporter: Vikas Kumar
Assignee: Vikas Kumar
org/apache/ranger/server/tomcat/EmbeddedServer.java, initialises one
SSLContext and set it as default. Here it is reads user provided truststore
using following:
{code:java}
String truststoreFile = EmbeddedServerUtil.getConfig("ranger.truststore.file");
String truststoreAlias =
EmbeddedServerUtil.getConfig("ranger.truststore.alias");
String credentialProviderPath =
EmbeddedServerUtil.getConfig("ranger.credential.provider.path");
String truststoreFileType =
EmbeddedServerUtil.getConfig("ranger.truststore.file.type",
RANGER_TRUSTSTORE_FILE_TYPE_DEFAULT);{code}
But same is not true when it uses Tomcat's connector path. Connector
initialises it's SSLContext independently. here Ranger initialises the user
provided keystore but truststore is missing. Hence, it defaults to JVM's
cacerts.
Ideally this behaviour should be consistent. And Connector approach should also
use user provided truststore.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
