Delay of 30 sec for ldaps connection via Xpress connecto JNDI Connector

Products

• CA Identity Suite
• CA Identity Manager

Issue/Introduction

When utilizing a custom JNDI connector with OpBinding for password reset functionality, LDAPS connection attempts consistently experience a 30-second delay. Network trace analysis reveals that the connector presents a client certificate ("eta_server") with a Common Name (CN) that does not match the machine name or the service account, stalling the SSL handshake process.

 

Environment

• Product: CA Identity Manager
• Release: 14.x

Cause

The default socketFactory implementation presents a client certificate during the SSL handshake. This presentation causes the connection delay when the server fails to validate the provided certificate. The CustomSSLSocketFactory is designed to handle this differently by not presenting a client certificate if the ClientCertKeyStore is null.

Resolution

Update your OpBinding code to use CustomSSLSocketFactory instead of the default socket factory.

1. Import the CustomSSLSocketFactory class in your code: importClass(Packages.com.ca.commons.security.ssl.CustomSSLSocketFactory);

2. Modify your environment configuration to use the custom factory. Add the property following the initial context factory configuration: env.put(javax.naming.Context.INITIAL_CONTEXT_FACTORY, "com.sun.jndi.ldap.LdapCtxFactory"); env.put("java.naming.ldap.factory.socket", "com.ca.commons.security.ssl.CustomSSLSocketFactory");

Additional Information

The CustomSSLSocketFactory utilizes two separate keystores: CAKeyStore (containing private, root, and trusted certificates) and ClientCertKeyStore (containing client certificates). By default, the ClientCertKeyStore is set to NULL, which ensures that no client certificate is sent during the SSL handshake, effectively bypassing the certificate validation delay.