This is an automated email from the ASF dual-hosted git repository.
tballison pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/tika.git
The following commit(s) were added to refs/heads/main by this push:
new 39f035cc77 simplify tls (#2977)
39f035cc77 is described below
commit 39f035cc775362e96e5174cf816e4014533c510d
Author: Tim Allison <[email protected]>
AuthorDate: Wed Jul 29 17:12:04 2026 -0400
simplify tls (#2977)
---
docs/modules/ROOT/pages/using-tika/grpc/index.adoc | 9 +++++----
.../java/org/apache/tika/pipes/grpc/TikaGrpcServer.java | 11 ++++++-----
.../org/apache/tika/pipes/grpc/TikaGrpcServerTlsTest.java | 15 ++++++++++++---
3 files changed, 23 insertions(+), 12 deletions(-)
diff --git a/docs/modules/ROOT/pages/using-tika/grpc/index.adoc
b/docs/modules/ROOT/pages/using-tika/grpc/index.adoc
index ef550e0e24..ab58eec64d 100644
--- a/docs/modules/ROOT/pages/using-tika/grpc/index.adoc
+++ b/docs/modules/ROOT/pages/using-tika/grpc/index.adoc
@@ -126,10 +126,11 @@ java -jar tika-grpc-<version>.jar --secure \
--trust-cert-collection ca.pem --client-auth-required
----
-Mutual TLS is opt-in: `--client-auth-required` is off by default, so it has no
-effect unless `--trust-cert-collection` is also given (a missing or
non-existent
-trust-collection path is silently ignored). The default port is `50052`
-(`-p`/`--port`).
+`--client-auth-required` implies `--secure` -- it's included above for clarity,
+but TLS is enabled automatically whenever client authentication is required.
+`--trust-cert-collection` must point to a readable file when
+`--client-auth-required` is set; the server refuses to start otherwise. The
+default port is `50052` (`-p`/`--port`).
When running the Docker image, append these flags to the container command —
they
are forwarded to the server — and mount the certificate files into the
container.
diff --git
a/tika-grpc/src/main/java/org/apache/tika/pipes/grpc/TikaGrpcServer.java
b/tika-grpc/src/main/java/org/apache/tika/pipes/grpc/TikaGrpcServer.java
index 79f64ea539..f55b5bac1b 100644
--- a/tika-grpc/src/main/java/org/apache/tika/pipes/grpc/TikaGrpcServer.java
+++ b/tika-grpc/src/main/java/org/apache/tika/pipes/grpc/TikaGrpcServer.java
@@ -70,10 +70,10 @@ public class TikaGrpcServer {
@Parameter(names = {"--private-key-password"}, description = "Private key
password, if needed")
private String privateKeyPassword;
- @Parameter(names = {"--trust-cert-collection"}, description = "The trust
certificate collection (root certs). Example: ca.pem See:
https://github.com/grpc/grpc-java/tree/b3ffb5078df361d7460786e134db7b5c00939246/examples/example-tls";)
+ @Parameter(names = {"--trust-cert-collection"}, description = "The trust
certificate collection (root certs). Required, and must be a readable file,
when --client-auth-required is set. Example: ca.pem See:
https://github.com/grpc/grpc-java/tree/b3ffb5078df361d7460786e134db7b5c00939246/examples/example-tls";)
private File trustCertCollection;
- @Parameter(names = {"--client-auth-required"}, description = "Is Mutual
TLS required?")
+ @Parameter(names = {"--client-auth-required"}, description = "Is Mutual
TLS required? Implies --secure.")
private boolean clientAuthRequired;
@Parameter(names = {"-h", "-H", "--help"}, description = "Display help
menu")
@@ -82,6 +82,10 @@ public class TikaGrpcServer {
public void start() throws Exception {
HealthStatusManager healthStatusManager = new HealthStatusManager();
ServerCredentials creds;
+ if (clientAuthRequired && !secure) {
+ LOGGER.info("--client-auth-required implies --secure; enabling
TLS.");
+ secure = true;
+ }
if (secure) {
TlsServerCredentials.Builder channelCredBuilder =
TlsServerCredentials.newBuilder();
channelCredBuilder.keyManager(certChain, privateKey,
privateKeyPassword);
@@ -97,9 +101,6 @@ public class TikaGrpcServer {
}
creds = channelCredBuilder.build();
} else {
- if (clientAuthRequired) {
- throw new IllegalArgumentException("--client-auth-required
requires --secure; refusing to start");
- }
creds = InsecureServerCredentials.create();
}
if (tikaConfig == null) {
diff --git
a/tika-grpc/src/test/java/org/apache/tika/pipes/grpc/TikaGrpcServerTlsTest.java
b/tika-grpc/src/test/java/org/apache/tika/pipes/grpc/TikaGrpcServerTlsTest.java
index d6edd326e7..71390d1ca9 100644
---
a/tika-grpc/src/test/java/org/apache/tika/pipes/grpc/TikaGrpcServerTlsTest.java
+++
b/tika-grpc/src/test/java/org/apache/tika/pipes/grpc/TikaGrpcServerTlsTest.java
@@ -30,7 +30,8 @@ import org.junit.jupiter.api.io.TempDir;
/**
* Covers the trust-cert-collection states that {@link TikaGrpcServer#start()}
should refuse
* to start on when {@code --client-auth-required} is set: omitted,
nonexistent, unreadable,
- * and invalid/corrupt content, plus {@code --client-auth-required} without
{@code --secure}.
+ * and invalid/corrupt content. Also covers {@code --client-auth-required}
without
+ * {@code --secure}, which implies {@code --secure} rather than being rejected.
*/
class TikaGrpcServerTlsTest {
private static final File CERT_CHAIN = Paths.get("src", "test",
"resources", "certs", "server1.pem").toFile();
@@ -38,11 +39,19 @@ class TikaGrpcServerTlsTest {
private static final File VALID_TRUST_COLLECTION = Paths.get("src",
"test", "resources", "certs", "ca.pem").toFile();
@Test
- void clientAuthRequiredWithoutSecureRefusesToStart() {
+ void clientAuthRequiredWithoutSecureImpliesSecureAndStarts() throws
Exception {
TikaGrpcServer server = new TikaGrpcServer()
+ .setPort(0)
.setSecure(false)
+ .setCertChain(CERT_CHAIN)
+ .setPrivateKey(PRIVATE_KEY)
+ .setTrustCertCollection(VALID_TRUST_COLLECTION)
.setClientAuthRequired(true);
- assertThrows(IllegalArgumentException.class, server::start);
+ try {
+ server.start();
+ } finally {
+ server.stop();
+ }
}
@Test
