Let JNDI use a own TrustManager interface implementation

Question

morning,
i did now reach the point where my ldap enabled application is able to connect to a directory server over ssl.
i further figured out, that it is possible to tell jsse to use a own implementation of the TrustManager interface so that i would, e.g. be able to let my application talk to every directory server without any matter of being the certificate used by that server added to the keystore file used by the application.
now one of the last problems is, that i do not know how to tell the jndi to use my customized X509TrustManager implementation.
can anyone tell me how i can do that, please?
greez
dialsc

Answer 1

Hello.
Frist you create your own Trust manager, which looks something like:
package test;
import java.security.cert.X509Certificate;
import javax.net.ssl.X509TrustManager;
import java.security.cert.CertificateException;
public class TestX509TrustManager implements X509TrustManager {
    public TestX509TrustManager() {
    public void checkServerTrusted(X509Certificate[] chain, String authType) throws
            CertificateException {
    public X509Certificate[] getAcceptedIssuers() {
        return null;
    public void checkClientTrusted(X509Certificate[] chain, String authType) {
        return;
}Then you create your own Socket factory which looks something like:
package test;
import java.io.IOException;
import java.net.InetAddress;
import java.net.Socket;
import java.net.UnknownHostException;
import javax.net.SocketFactory;
import javax.net.ssl.SSLSocketFactory;
import java.security.KeyManagementException;
import javax.net.ssl.SSLContext;
import javax.net.ssl.TrustManager;
import java.security.NoSuchAlgorithmException;
public class TestSocketFactory extends SocketFactory {
    private static TestSocketFactory factory;
    private SSLSocketFactory sf=null;
    private TestSocketFactory() {
            createFactory();
    public static synchronized SocketFactory getDefault() {
        if(factory == null){
            factory = new TestSocketFactory();
        return factory;
    public void createFactory() {
        try {
            TrustManager[] tm = new TrustManager[] {new TestX509TrustManager()};
            SSLContext sc = SSLContext.getInstance("TLS");
            sc.init(null, tm, null);
            sf = sc.getSocketFactory();
        catch (KeyManagementException e) {}
        catch (NoSuchAlgorithmException e) {}
    public Socket createSocket(String host, int port) throws IOException, UnknownHostException {
        return sf.createSocket(host,port);
    public Socket createSocket(String host, int port, InetAddress localHost, int localPort)
            throws IOException, UnknownHostException {
        return sf.createSocket(host, port, localHost, localPort);
    public Socket createSocket(InetAddress host, int port) throws IOException {
        return sf.createSocket(host,port);
    public Socket createSocket(InetAddress address, int port, InetAddress localAddress, int localPort)
            throws IOException {
        return sf.createSocket(address, port, localAddress, localPort);
}Finally, you'll have to tell the system to use your custom Socket factory:
    LdapContext ctx = null;
    public LdapTest() throws NamingException {
        Hashtable env = new Hashtable(11);
        env.put(Context.INITIAL_CONTEXT_FACTORY, "com.sun.jndi.ldap.LdapCtxFactory");
        env.put(Context.PROVIDER_URL, "ldap://myserver.com:636/dc=foo");
        env.put(Context.SECURITY_PROTOCOL, "SSL");
        env.put(Context.SECURITY_AUTHENTICATION, "none");
        env.put("java.naming.ldap.factory.socket", "test.TestSocketFactory");
        ctx = new InitialLdapContext(env, null);
    }The important statement above is: env.put("java.naming.ldap.factory.socket", "test.TestSocketFactory");