OPENDJ-3189: Implement EL expression support in cn=config
It is now possible to use EL expression inside cn=config. Examples:
1. set the LDAP port to the value of the OPENDJ_PORT env variable:
ds-cfg-listen-port: ${env['OPENDJ_PORT']}
2. set the LDAP port to the value of the opendj.port system property:
ds-cfg-listen-port: ${system['opendj.port']}
3. set the LDAP port to the value of the opendj.port property in a
property file:
ds-cfg-listen-port: ${readProperties(config.properties)['port']}
4. set the JKS key manager's PIN file:
ds-cfg-key-store-pin: ${read('config/keystore.pin')}
Other functions are provided in the Functions class.
KNOWN ISSUES:
Expressions are evaluated by the server's config framework before
publishing them to external components (e.g. config listeners, LDAP
clients). This allows client applications to function properly because
they receive the "effective" value rather than the unevaluated
expression, which is likely to be invalid according to the server's
schema (e.g. ${env['OPENDJ_PORT']} is not a valid integer).
Tools like dsconfig can read and update the configuration. However,
depending on the schema, it is often not possible to configure
expressions using dsconfig. Instead, users must first configure their
server and then manually edit config.ldif in order to add the
expressions where needed.
Another side-effect of exposing "effective" (evaluated) values over LDAP
is that secrets may be accidentally exposed to a wider audience than
anticipated. For example, the key manager pin can now be read from a
file using two approaches:
ds-cfg-key-store-pin: ${read('config/keystore.pin')}
ds-cfg-key-store-pin-file: config/keystore.pin
Reading the associated config entry over LDAP will return the evaluated
content in the first case, but not the second.