ISSUE

Shared Web Server listeners fail to authenticate when using LDAP 'Custom' authentication type on Shared Web Server page for Java 11 basic runtime.

The issue manifests itself with following error in the runtime log:
 

FINE    [com.boomi.connector.server.http.security.CustomAuthCredential check] Custom login failed: java.lang.NullPointerException: invalid null input(s)

at java.base/java.util.Objects.requireNonNull(Objects.java:246)

at java.base/javax.security.auth.Subject$SecureSet.add(Subject.java:1127)

at java.base/java.util.Collections$SynchronizedCollection.add(Collections.java:2040)

at org.mortbay.jetty.plus.jaas.spi.AbstractLoginModule$JAASUserInfo.setJAASInfo(AbstractLoginModule.java:95)

at org.mortbay.jetty.plus.jaas.spi.AbstractLoginModule.commit(AbstractLoginModule.java:189)

at org.mortbay.jetty.plus.jaas.ldap.LdapLoginModule.commit(LdapLoginModule.java:577)

The issue only impacts basic runtime, it does not impact runtime cluster or Cloud.
Note: this issue does not impact LDAP connector.


CAUSE

There is a defect in Jetty where LdapLoginModule fails when forceBinding property is set to true in Java 9 and higher versions.

The issue was fixed in jetty 9.4+ version. Boomi is running on jetty version 6.1.26, hence the issue exists in Boomi.

SOLUTION

We have a patch to resolve the issue. You will need to deploy the patch to your basic runtime before upgrading Java to 11.

To apply the patch, please follow the below steps.

1. Back up userlib/http-auth/jetty-plus-6.1.26.jar file to a location outside of basic runtime installation folder
2. Copy the attached jetty-plus-6.1.26-boomi1.jar to userlib/http-auth folder 
3. Stop the basic runtime service
4. Remove jetty-plus-6.1.26.jar file from userlib/http-auth folder
5. Start basic runtime service
6. Upgrade basic runtime to java 11