UnboundID Can Put LDAPS Inside an HTTP CONNECT Tunnel

Use HTTPProxySocketFactory with a TLS socket factory and account for its lack of direct proxy-authentication support.

UnboundID LDAP SDK 7.0.5 provides HTTPProxySocketFactory for an HTTP CONNECT route. Supply the application’s TLS socket factory when the destination is LDAPS:

var proxyFactory =
    new com.unboundid.util.HTTPProxySocketFactory(
        "proxy.example.net", 8080, 10000, ldapsTlsFactory);

ldapsTlsFactory is the application’s SSLSocketFactory with the intended server-trust configuration. Pass proxyFactory to an LDAPConnection constructor accepting a socket factory and the LDAP server’s actual hostname and port.

Configure the connection’s hostname verification too. The SDK exposes HostNameSSLSocketVerifier through LDAPConnectionOptions; trusting the certificate issuer alone is not the same check as matching the intended LDAP host.

The HTTP proxy must permit CONNECT to that destination, often port 636 for LDAPS. A proxy limited to web destination ports can reject it.

The factory’s documented limits matter: communication to the proxy itself is not TLS-encrypted, and it offers no direct support for HTTP proxy authentication. Supplying an LDAPS TLS factory protects the subsequent directory connection, rather than adding a missing proxy login mechanism.

Artihkkalat mat laktásit