[JAVA-4522] Connection string parameter tlsInsecure is not supported Created: 08/Mar/22 Updated: 04/May/22 |
|
| Status: | Backlog |
| Project: | Java Driver |
| Component/s: | Configuration |
| Affects Version/s: | None |
| Fix Version/s: | None |
| Type: | New Feature | Priority: | Major - P3 |
| Reporter: | Fabian Kreis | Assignee: | Unassigned |
| Resolution: | Unresolved | Votes: | 0 |
| Labels: | external-user | ||
| Remaining Estimate: | Not Specified | ||
| Time Spent: | Not Specified | ||
| Original Estimate: | Not Specified | ||
| Description |
|
Version:
Context: Everything works fine when we import the appropriate mongoDB certs into the truststore. However, we want to use tlsInsecure=true for local development only to make setups easier for the developers. Hence, I am defining a mongodb uri like
Actual behvior: The connection string query parameter 'tlsInsecure' is being ignored
Expected Behavior:*+
Solution hints: I believe there is two places to change: 1) The class com.mongodb.ConnectionString does not have a field "tlsInsecure". Such a field (along with accessors) should be added. In line 576 this new field should be asigned instead of sslInvalidHostnameAllowed. 2) The new introduced tlsInsecure information from 1) has to be evaluated in com.mongodb.connection.SslSettings.Builder#applyConnectionString() |
| Comments |
| Comment by Jeffrey Yemin [ 14/Mar/22 ] |
|
f.kreis@enbw.com thanks for providing this context. Local development is certainly a common use case, but I think most users choose different workarounds. The ones that I'm aware of are:
Meanwhile, we will consider whether and how the driver can safely support the tlsInsecure configuration parameter. |
| Comment by Fabian Kreis [ 14/Mar/22 ] |
|
Jeffrey, thank you for your response! I am aware of the option to provide my own SSLContext. It is good to have that option, we are using it as a "workaround" for local development while the tlsInsecure option is not supported by the mongoDB driver. However, this requires additional code which also will be part of the production code. The same code would have to be written, tested, and maintained by all users of the mongoDB driver which want to achieve the same thing. If on the other hand this would be implemented within the mongoDB driver all users would benefit from that single, well-maintained implementation. Also, I as a mongoDB user would expect that all featues which are documented in https://docs.mongodb.com/manual/reference/connection-string/#connection-string-options are supported by all drivers. It is very unexpected for me that some of options are supported, and others are not. It took me some time to figure out that the reason for my dysfunctional setup was not caused by me. Especially, as there is a hint about mongo shell (“This connection string option is not available for the mongo shell. Use the command-line option instead.”) but not for the Java driver. In summary, I still believe that this option should be supported by the Java driver as it is documented in https://docs.mongodb.com/manual/reference/connection-string/#connection-string-options . |
| Comment by Jeffrey Yemin [ 11/Mar/22 ] |
|
f.kreis@enbw.com it's intentional that the driver does not support this option via URI. It's not the same as tls/sslInvalidHostnameAllowed, which is supported. The reason it's not supported is due to the abstractions provided by the JDK for TLS configuration. By default, the driver creates TLS-enabled sockets via the socket factory from javax.net.ssl.SSLContext.getDefault().getSocketFactory(). The default behavior of this socket factory is to enforce TLS certificate validation using the root certificates that are included with the JDK. These certificates can be altered via the system property javax.net.ssl.trustStore. But certificate validation can not just be turned off. In order to do it, you have to create a new SSLContext with a TrustManager that trusts all certificates. This is not something that we believe that the driver should do directly, via a simple connection string parameter. Instead, what the driver lets you do is configure your own SSLContext for the driver to use to create sockets. So you can disable certificate validation, but you have to do it in code, by creating an SSLContext that disables the validation. Hope this helps. |
| Comment by Esha Bhargava [ 11/Mar/22 ] |
|
f.kreis@enbw.com Thank you for reporting this issue! We'll look into it and get back to you soon. |