[release/9.0-staging] Add support for LDAPTLS_CACERTDIR \ TrustedCertificateDirectory

[steveharter]

Backport of #111877 to release/9.0-staging
Fixes #104260 for v9.0.x
Backport for v8: #112530

/cc @steveharter @JasonDebug

Customer Impact

• Customer reported
• Found internally

Adds two new members to System.DirectoryServices.Protocols.LdapSessionOptions to forward to LDAP APIs on Linux\OSX that help with server certificate validation. On Windows, server certificate validation is supported by setting a callback on LdapSessionOptions.VerifyServerCertificates(), but that is not supported on Linux\OSX.

Regression

• Yes
• No

Testing

Several months ago, we provided a package with the proposed fix which was validated by the support engineer and customer requesting this feature. Once it was added to v10, the validation was done again. Also, local validation on Linux Ubuntu was done and verification tests were added.

Automated tests here are not supported with current infrastructure as it requires LDAP server support. Currently this must be manually tested.

Risk

Low - although we normally don't add new APIs in a servicing release, it is safer here since this assembly does not ship inbox with .NET so risk is low for versioning issues.

[dotnet-issue-labeler]

Note regarding the new-api-needs-documentation label:

This serves as a reminder for when your PR is modifying a ref *.cs file and adding/modifying public APIs, please make sure the API implementation in the src *.cs file is documented with triple slash comments, so the PR reviewers can sign off that change.

[dotnet-issue-labeler]

Note regarding the new-api-needs-documentation label:

This serves as a reminder for when your PR is modifying a ref *.cs file and adding/modifying public APIs, please make sure the API implementation in the src *.cs file is documented with triple slash comments, so the PR reviewers can sign off that change.

[dotnet-policy-service]

Tagging subscribers to this area: @dotnet/area-system-directoryservices, @jay98014
See info in area-owners.md if you want to be subscribed.

[Copilot]

Copilot reviewed 5 out of 10 changed files in this pull request and generated 1 comment.

Files not reviewed (5)

• src/libraries/Common/tests/System/DirectoryServices/LDAP.Configuration.xml: Language not supported
• src/libraries/System.DirectoryServices.Protocols/src/Resources/Strings.resx: Language not supported
• src/libraries/System.DirectoryServices.Protocols/src/System/DirectoryServices/Protocols/ldap/LdapConnection.cs: Evaluated as low risk
• src/libraries/Common/src/Interop/Interop.Ldap.cs: Evaluated as low risk
• src/libraries/System.DirectoryServices.Protocols/ref/System.DirectoryServices.Protocols.cs: Evaluated as low risk

Comments suppressed due to low confidence (4)

src/libraries/System.DirectoryServices.Protocols/tests/DirectoryServicesProtocolsTests.cs:709

• Ensure that the new test cases properly cover the new functionality for 'StartNewTlsSessionContext' and 'TrustedCertificatesDirectory'.

[ConditionalFact(nameof(UseTls))]

src/libraries/System.DirectoryServices.Protocols/tests/DirectoryServicesProtocolsTests.cs:732

• Ensure that the new test cases properly cover the new functionality for 'StartNewTlsSessionContext' and 'TrustedCertificatesDirectory'.

[ConditionalFact(nameof(UseTls))]

src/libraries/System.DirectoryServices.Protocols/tests/DirectoryServicesProtocolsTests.cs:744

• Ensure that the new test cases properly cover the new functionality for 'TrustedCertificatesDirectory'.

[ConditionalFact(nameof(LdapConfigurationExists))]

src/libraries/System.DirectoryServices.Protocols/tests/DirectoryServicesProtocolsTests.cs:754

• Ensure that the new test cases properly cover the new functionality for 'StartNewTlsSessionContext'.

[ConditionalFact(nameof(LdapConfigurationExists))]

[Copilot]

Minor grammar issue: 'The directory not exist.' should be 'The directory does not exist.'

Suggested change

	/// <exception cref="DirectoryNotFoundException">The directory not exist.</exception>
	/// <exception cref="DirectoryNotFoundException">The directory does not exist.</exception>

[ericstj]

This is OK for now - but if we wanted to make this more common we could let projects opt out of this setting -

runtime/eng/packaging.targets

Line 41 in b61c07c

<EnableStrictModeForBaselineValidation>true</EnableStrictModeForBaselineValidation>