mirror of https://github.com/OpenIdentityPlatform/OpenDJ.git

Matthew Swift
25.41.2016 076c78aa32f39fe76d74dca79b550f3049e2baa5
refs
author Matthew Swift <matthew.swift@forgerock.com>
Friday, November 25, 2016 00:41 +0100
committer Matthew Swift <matthew.swift@forgerock.com>
Friday, November 25, 2016 19:00 +0100
commit076c78aa32f39fe76d74dca79b550f3049e2baa5
tree df45e5688b9866440d52368fc2604913589f1b7f tree | zip | gz
parent 04450de5b9953136772cb2600eda73c221ab18a4 view | diff
OPENDJ-3189: Implement EL expression support in cn=config

It is now possible to use EL expression inside cn=config. Examples:

1. set the LDAP port to the value of the OPENDJ_PORT env variable:

ds-cfg-listen-port: ${env['OPENDJ_PORT']}

2. set the LDAP port to the value of the opendj.port system property:

ds-cfg-listen-port: ${system['opendj.port']}

3. set the LDAP port to the value of the opendj.port property in a
property file:

ds-cfg-listen-port: ${readProperties(config.properties)['port']}

4. set the JKS key manager's PIN file:

ds-cfg-key-store-pin: ${read('config/keystore.pin')}

Other functions are provided in the Functions class.

KNOWN ISSUES:

Expressions are evaluated by the server's config framework before
publishing them to external components (e.g. config listeners, LDAP
clients). This allows client applications to function properly because
they receive the "effective" value rather than the unevaluated
expression, which is likely to be invalid according to the server's
schema (e.g. ${env['OPENDJ_PORT']} is not a valid integer).

Tools like dsconfig can read and update the configuration. However,
depending on the schema, it is often not possible to configure
expressions using dsconfig. Instead, users must first configure their
server and then manually edit config.ldif in order to add the
expressions where needed.

Another side-effect of exposing "effective" (evaluated) values over LDAP
is that secrets may be accidentally exposed to a wider audience than
anticipated. For example, the key manager pin can now be read from a
file using two approaches:

ds-cfg-key-store-pin: ${read('config/keystore.pin')}
ds-cfg-key-store-pin-file: config/keystore.pin

Reading the associated config entry over LDAP will return the evaluated
content in the first case, but not the second.
6 files added
3 files modified
568 ■■■■■ changed files
opendj-server-legacy/pom.xml 14 ●●●●● diff | view | raw | blame | history
opendj-server-legacy/src/main/java/org/opends/server/config/ConfigurationHandler.java 99 ●●●● diff | view | raw | blame | history
opendj-server-legacy/src/main/java/org/opends/server/config/Expression.java 189 ●●●●● diff | view | raw | blame | history
opendj-server-legacy/src/main/java/org/opends/server/config/Functions.java 80 ●●●●● diff | view | raw | blame | history
opendj-server-legacy/src/messages/org/opends/messages/config.properties 10 ●●●●● diff | view | raw | blame | history
opendj-server-legacy/src/test/java/org/opends/server/config/ExpressionTest.java 105 ●●●●● diff | view | raw | blame | history
opendj-server-legacy/src/test/java/org/opends/server/config/FunctionsTest.java 51 ●●●●● diff | view | raw | blame | history
opendj-server-legacy/tests/unit-tests-testng/resource/el-config.properties 19 ●●●●● diff | view | raw | blame | history
opendj-server-legacy/tests/unit-tests-testng/resource/el-password.pin 1 ●●●● diff | view | raw | blame | history