[DIRSERVER-2329] Replication trust manager improvements

• Type: Task
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Fix Version/s: 2.0.0.AM27
• Assignee: Colm O hEigeartaigh
• Reporter: Colm O hEigeartaigh
• Created: 10/Sep/20 06:54
• Updated: 10/May/21 13:16
• Resolved: 10/May/21 13:16

Description

There are some improvements that should be made regarding trust manager configuration for Replication:

1. In ReplicationTrustManager, the static block is not initialized before the constructor (at least in the tests), leading to a NPE.
2. SyncReplConfiguration defaults to NoVerificationTrustManager, which is not secure, even though this is inconsistent with the value for strictCertVerification (true)
3. The CreateConsumer annotation has a trustManager setting which is not used anywhere
4. The ServerAnnotationProcessor does not wire the value for CreateConsumer.strictCertVerification()

Issue Links

• is related to: DIRSERVER-2328 CreateAuthenticator annotation trust manager improvements
• relates to: DIRSERVER-2330 StartTlsHandler and LdapsInitializer use NoVerificationTrustManager
• links to: GitHub Pull Request #43