import java.io.IOException;

import java.lang.reflect.Constructor;

import java.lang.reflect.InvocationTargetException;

import java.security.KeyManagementException;

import java.security.NoSuchAlgorithmException;

import java.util.Arrays;

import javax.naming.ldap.InitialLdapContext;

import javax.naming.ldap.LdapContext;

import javax.naming.ldap.StartTlsRequest;

import javax.naming.ldap.StartTlsResponse;

import javax.net.ssl.HostnameVerifier;

import javax.net.ssl.SSLContext;

import javax.net.ssl.SSLSession;

import javax.net.ssl.SSLSocketFactory;

    /**

     * Whether to use TLS for connections

     */

    private boolean useStartTls = false;

    private StartTlsResponse tls = null;

    /**

     * The list of enabled cipher suites used for establishing tls connections.

     * <code>null</code> means to use the default cipher suites.

     */

    private String[] cipherSuites = null;

    /**

     * Verifier for hostnames in a StartTLS secured connection. <code>null</code>

     * means to use the default verifier.

     */

    private HostnameVerifier hostnameVerifier = null;

    /**

     * {@link SSLSocketFactory} to use when connection with StartTLS enabled.

     */

    private SSLSocketFactory sslSocketFactory = null;

    /**

     * @return flag whether to use StartTLS for connections to the ldap server

     */

    public boolean getUseStartTls() {

        return useStartTls;

    }

    /**

     * Flag whether StartTLS should be used when connecting to the ldap server

     *

     * @param useStartTls

     *            {@code true} when StartTLS should be used. Default is

     *            {@code false}.

     */

    public void setUseStartTls(boolean useStartTls) {

        this.useStartTls = useStartTls;

    }

    /**

     * @return list of the allowed cipher suites when connections are made using

     *         StartTLS

     */

    private String[] getCipherSuitesArray() {

        return cipherSuites;

    }

    /**

     * Set the allowed cipher suites when opening a connection using StartTLS.

     * The cipher suites are expected as a comma separated list.

     *

     * @param suites

     *            comma separated list of allowed cipher suites

     */

    public void setCipherSuites(String suites) {

        if (suites == null || suites.trim().isEmpty()) {

            containerLog.warn(sm.getString("jndiRealm.emptyCipherSuites"));

            this.cipherSuites = null;

        } else {

            this.cipherSuites = suites.trim().split("\\s*,\\s*");

            containerLog.debug(sm.getString("jndiRealm.cipherSuites",

                    Arrays.asList(this.cipherSuites)));

        }

    }

    /**

     * @return name of the {@link HostnameVerifier} class used for connections

     *         using StartTLS, or the empty string, if the default verifier

     *         should be used.

     */

    public String getHostnameVerifierClassName() {

        if (this.hostnameVerifier == null) {

            return "";

        }

        return this.hostnameVerifier.getClass().getCanonicalName();

    }

    /**

     * Set the {@link HostnameVerifier} to be used when opening connections

     * using StartTLS. An instance of the given class name will be constructed

     * using the default constructor.

     *

     * @param verifierClassName

     *            class name of the {@link HostnameVerifier} to be constructed

     */

    public void setHostnameVerifierClassName(String verifierClassName) {

        if (verifierClassName == null || verifierClassName.trim().equals("")) {

            return;

        }

        try {

            Object o = constructInstance(verifierClassName);

            if (o instanceof HostnameVerifier) {

                this.hostnameVerifier = (HostnameVerifier) o;

            } else {

                containerLog

                        .warn(sm.getString("jndiRealm.invalidHostnameVerifier",

                                verifierClassName));

            }

        } catch (ClassNotFoundException | NoSuchMethodException

                | SecurityException | InstantiationException

                | IllegalAccessException | IllegalArgumentException

                | InvocationTargetException e) {

            containerLog.warn(sm.getString("jndiRealm.invalidHostnameVerifier",

                    verifierClassName), e);

        }

    }

    /**

     * @return the {@link HostnameVerifier} to use for peer certificate

     *         verification when opening connections using StartTLS.

     */

    public HostnameVerifier getHostnameVerifier() {

        return this.getHostnameVerifier();

    }

    /**

     * Set the {@link SSLSocketFactory} to be used when opening connections

     * using StartTLS. An instance of the factory with the given name will be

     * created using the default constructor. The SSLSocketFactory can also be

     * set using {@link JNDIRealm#setSslProtocol(String) setSslProtocol(String)}.

     *

     * @param factoryClassName

     *            class name of the factory to be constructed

     */

    public void setSslSocketFactoryClassName(String factoryClassName) {

        if (factoryClassName == null || factoryClassName.trim().equals("")) {

            return;

        }

        try {

            Object o = constructInstance(factoryClassName);

            if (o instanceof SSLSocketFactory) {

                this.sslSocketFactory = (SSLSocketFactory) o;

            } else {

                containerLog.warn(sm.getString(

                        "jndiRealm.invalidSslSocketFactory", factoryClassName));

            }

        } catch (ClassNotFoundException | NoSuchMethodException

                | SecurityException | InstantiationException

                | IllegalAccessException | IllegalArgumentException

                | InvocationTargetException e) {

            containerLog.warn(sm.getString("jndiRealm.invalidSslSocketFactory",

                    factoryClassName));

        }

    }

    /**

     * Set the ssl protocol to be used for connections using StartTLS.

     *

     * @param protocol

     *            one of the allowed ssl protocol names

     */

    public void setSslProtocol(String protocol) {

        try {

            SSLContext sslContext = SSLContext.getInstance(protocol);

            sslContext.init(null, null, null);

            this.sslSocketFactory = sslContext.getSocketFactory();

        } catch (NoSuchAlgorithmException | KeyManagementException e) {

            List<String> allowedProtocols = Arrays

                    .asList(getSupportedSslProtocols());

            throw new IllegalArgumentException(

                    sm.getString("jndiRealm.invalidSslProtocol", protocol,

                            allowedProtocols), e);

        }

    }

    /**

     * @return the list of supported ssl protocols by the default

     *         {@link SSLContext}

     */

    private String[] getSupportedSslProtocols() {

        try {

            SSLContext sslContext = SSLContext.getDefault();

            sslContext.init(null, null, null);

            return sslContext.getSupportedSSLParameters().getProtocols();

        } catch (NoSuchAlgorithmException | KeyManagementException e) {

            throw new RuntimeException(sm.getString("jndiRealm.exception"), e);

        }

    }

    private Object constructInstance(String className)

            throws ClassNotFoundException, NoSuchMethodException,

            InstantiationException, IllegalAccessException,

            InvocationTargetException {

        Class<?> clazz = getClass().getClassLoader().loadClass(

                className);

        Constructor<?> constructor = clazz.getConstructor();

        return constructor.newInstance();

    }

        // Close tls startResponse if used

        if (tls != null) {

            try {

                tls.close();

            } catch (IOException e) {

                containerLog.error(sm.getString("jndiRealm.tlsClose"), e);

            }

        }

    private DirContext createDirContext(Hashtable<String, String> env) throws NamingException {

        if (useStartTls) {

            return createTlsDirContext(env);

        } else {

            return new InitialDirContext(env);

        }

    }

    /**

     * Create a tls enabled LdapContext and set the StartTlsResponse tls

     * instance variable.

     *

     * @param env

     *            Environment to use for context creation

     * @return configured {@link LdapContext}

     * @throws NamingException

     *             when something goes wrong while negotiating the connection

     */

    private DirContext createTlsDirContext(

            Hashtable<String, String> env) throws NamingException {

        Map<String, Object> savedEnv = new HashMap<>();

        for (String key : Arrays.asList(Context.SECURITY_AUTHENTICATION,

                Context.SECURITY_CREDENTIALS, Context.SECURITY_PRINCIPAL,

                Context.SECURITY_PROTOCOL)) {

            Object entry = env.remove(key);

            if (entry != null) {

                savedEnv.put(key, entry);

            }

        }

        LdapContext result = null;

        try {

            result = new InitialLdapContext(env, null);

            tls = (StartTlsResponse) result

                    .extendedOperation(new StartTlsRequest());

            if (hostnameVerifier != null) {

                tls.setHostnameVerifier(hostnameVerifier);

            }

            if (getCipherSuitesArray() != null) {

                tls.setEnabledCipherSuites(getCipherSuitesArray());

            }

            try {

                SSLSession negotiate = tls.negotiate(sslSocketFactory);

                containerLog.debug(sm.getString("jndiRealm.negotiatedTls",

                        negotiate.getProtocol()));

            } catch (IOException e) {

                throw new NamingException(e.getMessage());

            }

        } finally {

            if (result != null) {

                for (Map.Entry<String, Object> savedEntry : savedEnv.entrySet()) {

                    result.addToEnvironment(savedEntry.getKey(),

                            savedEntry.getValue());

                }

            }

        }

        return result;

    }

jndiRealm.emptyCipherSuites=Empty String for cipher suites given. Using default cipher suites.

jndiRealm.cipherSuites=Enable [{0}] as cipher suites for tls connection.

jndiRealm.invalidHostnameVerifier="{0}" not a valid class name for a HostnameVerifier

jndiRealm.invalidSslProtocol=Given protocol "{0}" is invalid. It has to be one of {1}

jndiRealm.invalidSslSocketFactory="{0}" not a valid class name for a SSLSocketFactory

jndiRealm.negotiatedTls=Negotiated tls connection using protocol "{0}"

jndiRealm.tlsClose=Exception closing tls response

      <attribute name="cipherSuites" required="false">

        <p>Specify which cipher suites are allowed when trying to open

        a secured connection using StartTLS. The allowed cipher suites

        are specified by a comma separated list. The default is to use the

        cipher suites of the JVM.</p>

      </attribute>

      <attribute name="hostnameVerifierClassName" required="false">

        <p>The name of the class to use for hostname verification when

        using StartTLS for securing the connection to the ldap server.

        The default constructor will be used to construct an instance of

        the verifier class. The default is to accept only those hostnames,

        that are valid according to the peer certificate of the ldap

        server.</p>

      </attribute>

      <attribute name="sslProtocol" required="false">

        <p>Specifies which ssl protocol should be used, when connecting with

        StartTLS. The default is to let the jre decide. If you need even more

        control, you can specify the <code>SSLSocketFactory</code> to use.</p>

      </attribute>

      <attribute name="sslSocketFactory" required="false">

        <p>Specifies which <code>SSLSocketFactory</code> to use when connecting

        to the ldap server using StartTLS. An instance of the class will be

        constructed using the default constructor. If none class name is given

        the default jre <code>SSLSocketFactory</code> will be used.</p>

      </attribute>

      <attribute name="useStartTls" required="false">

        <p>Set to <code>true</code> if you want to use StartTLS for securing

        the connection to the ldap server. The default value is <code>false</code>.

        </p>

      </attribute>