pradeepagrawal8184 commented on code in PR #1188:
URL: https://github.com/apache/ranger/pull/1188#discussion_r3871107922
##########
embeddedwebserver/src/main/java/org/apache/ranger/server/tomcat/EmbeddedServer.java:
##########
@@ -200,6 +211,14 @@ public void start() {
ssl.setAttribute("keystorePass", keystorePass);
ssl.setAttribute("keystoreFile", keystoreFile);
+ String trustStoreFile =
EmbeddedServerUtil.getConfig("ranger.truststore.file");
+ if (StringUtils.isNotBlank(trustStoreFile) &&
StringUtils.isNotBlank(truststorePass)) {
+ ssl.setAttribute("truststorePass", truststorePass);
+ ssl.setAttribute("truststoreFile", trustStoreFile);
+ } else {
+ LOG.info("TrustStore is not set, TrustStoreFile is " +
trustStoreFile + " and is TruststorePass empty " +
StringUtils.isBlank(truststorePass));
Review Comment:
Prefer something like: "Truststore not configured for HTTPS connector
(file={}, password={})" at DEBUG, or only log when clientAuth requires it.
##########
embeddedwebserver/src/main/java/org/apache/ranger/server/tomcat/EmbeddedServer.java:
##########
@@ -200,6 +211,14 @@ public void start() {
ssl.setAttribute("keystorePass", keystorePass);
ssl.setAttribute("keystoreFile", keystoreFile);
+ String trustStoreFile =
EmbeddedServerUtil.getConfig("ranger.truststore.file");
Review Comment:
Keystore gets upfront validation via validateHttpsKeystore() with a clear
LOG.severe on failure. Truststore has no equivalent — a bad path or password
only surfaces as a vague info log:
a validateHttpsTruststore() (or reuse of existing loading logic) would give
operators actionable errors, similar to keystore.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
