No more LDAP SSL truststore password on CP4BA

Author: PYLochou

.pre-commit-config.yaml

@@ -4,7 +4,7 @@ repos:
     # You are encouraged to use static refs such as tags, instead of branch name
     #
     # Running "pre-commit autoupdate" automatically updates rev to latest tag
-    rev: 0.13.1+ibm.62.dss
+    rev: 0.13.1+ibm.64.dss
     hooks:
       - id: detect-secrets # pragma: whitelist secret
         # Add options for detect-secrets-hook binary. You can run `detect-secrets-hook --help` to list out all possible options.
@@ -13,4 +13,3 @@ repos:
         # when "--baseline" with "--use-all-plugins", pre-commit scan with all available plugins
         # add "--fail-on-unaudited" to fail pre-commit for unaudited potential secrets
         args: [--baseline, .secrets.baseline]
-

.secrets.baseline

@@ -3,7 +3,7 @@
     "files": "^.git/.*|^.secrets.baseline$",
     "lines": null
   },
-  "generated_at": "2026-04-09T12:26:56Z",
+  "generated_at": "2026-07-15T07:54:21Z",
   "plugins_used": [
     {
       "name": "AWSKeyDetector"
@@ -82,7 +82,7 @@
         "hashed_secret": "5baa61e4c9b93f3f0682250b6cf8331b7ee68fd8",
         "is_secret": false,
         "is_verified": false,
-        "line_number": 47,
+        "line_number": 48,
         "type": "Basic Auth Credentials",
         "verified_result": null
       }
@@ -268,7 +268,7 @@
         "hashed_secret": "07313f0e320f22cbfa35cfc220508eb3ff457c7e",
         "is_secret": false,
         "is_verified": false,
-        "line_number": 111,
+        "line_number": 105,
         "type": "Secret Keyword",
         "verified_result": null
       }
@@ -278,31 +278,31 @@
         "hashed_secret": "642c4d230c27058424a132dbff9a0d1317fd0deb",
         "is_secret": false,
         "is_verified": false,
-        "line_number": 125,
+        "line_number": 135,
         "type": "Secret Keyword",
         "verified_result": null
       },
       {
         "hashed_secret": "fa9beb99e4029ad5a6615399e7bbae21356086b3",
         "is_secret": false,
         "is_verified": false,
-        "line_number": 128,
+        "line_number": 138,
         "type": "Secret Keyword",
         "verified_result": null
       },
       {
         "hashed_secret": "07313f0e320f22cbfa35cfc220508eb3ff457c7e",
         "is_secret": false,
         "is_verified": false,
-        "line_number": 131,
+        "line_number": 141,
         "type": "Secret Keyword",
         "verified_result": null
       },
       {
         "hashed_secret": "dece3177de6ef53ccd2138fa6a36213476061cb3",
         "is_secret": false,
         "is_verified": false,
-        "line_number": 133,
+        "line_number": 152,
         "type": "Secret Keyword",
         "verified_result": null
       }
@@ -646,7 +646,7 @@
         "hashed_secret": "d53cc24e20ca1808d3df033258b6d8e78168ecef",
         "is_secret": false,
         "is_verified": false,
-        "line_number": 20,
+        "line_number": 25,
         "type": "Secret Keyword",
         "verified_result": null
       }
@@ -768,7 +768,7 @@
         "hashed_secret": "d53cc24e20ca1808d3df033258b6d8e78168ecef",
         "is_secret": false,
         "is_verified": false,
-        "line_number": 18,
+        "line_number": 23,
         "type": "Secret Keyword",
         "verified_result": null
       }
@@ -1338,7 +1338,7 @@
       }
     ]
   },
-  "version": "0.13.1+ibm.62.dss",
+  "version": "0.13.1+ibm.64.dss",
   "word_list": {
     "file": null,
     "hash": null

common/script/configureTlsSecurity.sh

@@ -99,17 +99,10 @@ then
 fi
 # End - Configuration for the TLS security
 
-if [ -f "/config/ldap/ldap.jks" ]
-then
-	if [ -n "$LDAP_TRUSTSTORE_PASSWORD" ] || [ -f /config/secrets/dba-env-context/ldapSslTruststorePassword ]
-	then
-		# Set env var if secrets are passed using mounted volumes
-		[ -f /config/secrets/dba-env-context/ldapSslTruststorePassword ] && export LDAP_TRUSTSTORE_PASSWORD=$(cat /config/secrets/dba-env-context/ldapSslTruststorePassword)
-		echo "import /config/ldap/ldap.jks in trustore using provided LDAP truststore password"
-	else
-		echo "import /config/ldap/ldap.jks in trustore using default LDAP truststore password"
-		LDAP_TRUSTSTORE_PASSWORD=changeit
-	fi
+if [ -f "/config/ldap/ldap.jks" ]; then
+
+	echo "import /config/ldap/ldap.jks in trustore using default LDAP truststore password"
+	LDAP_TRUSTSTORE_PASSWORD=changeit
 
 	i=0
 	mapfile -t trust_list < <(keytool -J"-Xshareclasses:none" -list -v -keystore /config/ldap/ldap.jks -storepass $LDAP_TRUSTSTORE_PASSWORD | grep "Alias name" | awk 'NF>1{print $NF}')
@@ -121,11 +114,13 @@ then
 	keytool -J"-Xshareclasses:none" -importkeystore -srckeystore /config/ldap/ldap.jks -destkeystore /config/security/truststore.jks -srcstorepass $LDAP_TRUSTSTORE_PASSWORD -deststorepass $DEFAULT_TRUSTSTORE_PASSWORD
 
 else
+
   echo "no /config/ldap/ldap.jks file"
+
 fi
 
 # This part allow to import a list of PEM certificate in the JVM
- echo "Importing trusted certificates $dir"
+echo "Importing trusted certificates $dir"
 TRUSTSTORE=/config/security/truststore.jks
 CERTDIR="/config/security/trusted-cert-volume/"
 if [ -d $CERTDIR ]; then