<html>
<head>
<meta http-equiv="Content-Type" content="text/html;
charset=windows-1252">
</head>
<body>
Hi Sean,<br>
<br>
Alexey answered the same question for me:<br>
<br>
<blockquote type="cite">
<pre class="moz-quote-pre" wrap="">I mean “com.sun.jndi.ldap.connect.timeout” property.
The positive value forces to start TLS handshake and wait for it completion during the connectTimeout milliseconds:
Connection.java
</pre>
<blockquote type="cite" style="color: #000000;">
<blockquote type="cite" style="color: #000000;">
<pre class="moz-quote-pre" wrap="">if (connectTimeout > 0) {
int socketTimeout = sslSocket.getSoTimeout();
sslSocket.setSoTimeout(connectTimeout); // reuse full timeout value
sslSocket.startHandshake();
sslSocket.setSoTimeout(socketTimeout);
}
</pre>
</blockquote>
</blockquote>
<pre class="moz-quote-pre" wrap="">Without this property handshake is started later asynchronously.
As result
</pre>
<blockquote type="cite" style="color: #000000;">
<blockquote type="cite" style="color: #000000;">
<pre class="moz-quote-pre" wrap=""> certs = ssock.getSession().getPeerCertificates();
</pre>
</blockquote>
</blockquote>
<pre class="moz-quote-pre" wrap="">in the LdapClient.java could return SSLPeerUnverifiedException().
This exception will be wrapped to NamingException and thrown to application.
This is not usually happens but I saw it on the slow connection</pre>
</blockquote>
<br>
The full context of LDAP Connection code that initiates the SSL
handshake could be viewed here: <br>
<a class="moz-txt-link-freetext" href="https://github.com/openjdk/jdk/blob/master/src/java.naming/share/classes/com/sun/jndi/ldap/Connection.java#L345">https://github.com/openjdk/jdk/blob/master/src/java.naming/share/classes/com/sun/jndi/ldap/Connection.java#L345</a><br>
<br>
-- Aleksei<br>
<br>
<div class="moz-cite-prefix">On 06/07/2020 21:11, Sean Mullan wrote:<br>
</div>
<blockquote type="cite"
cite="mid:f65907af-4acc-ef57-8c2c-98a44da11b97@oracle.com">Hi
Alexey,
<br>
<br>
This may have been discussed already, but can you explain why the
"com.sun.jndi.ldap.connect.timeout" property needs to be set in
order to use this feature? That property is mostly used in tests
to avoid long socket timeouts, etc.
<br>
<br>
Why does that need to be set? What problem are you trying to
solve?
<br>
<br>
--Sean
<br>
<br>
<br>
On 7/3/20 11:31 AM, Alexey Bakhtin wrote:
<br>
<blockquote type="cite">
<br>
<blockquote type="cite">I would suggest removing it. At least
for the SASL GSS-API mech, it seems the GSSContext object will
not be leaked and no one has a chance to call
setChannelBinding again on it.
<br>
<br>
There is no spec saying setChannelBinding() can only be called
once, so I'd rather we don't enforce that, although you might
say there is no need to call it twice.
<br>
</blockquote>
<br>
OK.
<br>
GSSContextImpl class is removed from patch.
<br>
<br>
Webrev : <a class="moz-txt-link-freetext" href="http://cr.openjdk.java.net/~abakhtin/8245527/webrev.v11">http://cr.openjdk.java.net/~abakhtin/8245527/webrev.v11</a>
<br>
<br>
Thank you
<br>
Alexey
<br>
<br>
</blockquote>
</blockquote>
<br>
</body>
</html>