[release/8.0-staging] Add support for LDAPTLS_CACERTDIR \ TrustedCertificateDirectory

[steveharter]

Backport of #111877 to release/8.0-staging
Fixes #104260 for v8.0.x
Backport for v9: #112531

/cc @steveharter @JasonDebug

Customer Impact

• Customer reported
• Found internally

Adds two new members to System.DirectoryServices.Protocols.LdapSessionOptions to forward to LDAP APIs on Linux\OSX that help with server certificate validation. On Windows, server certificate validation is supported by setting a callback on LdapSessionOptions.VerifyServerCertificates(), but that is not supported on Linux\OSX.

Regression

• Yes
• No

Testing

Several months ago, we provided a package with the proposed fix which was validated by the support engineer and customer requesting this feature. Once it was added to v10, the validation was done again. Also, local validation on Linux Ubuntu was done and verification tests were added.

Automated tests here are not supported with current infrastructure as it requires LDAP server support. Currently this must be manually tested.

Risk

Low - although we normally don't add new APIs in a servicing release, it is safer here since this assembly does not ship inbox with .NET so risk is low for versioning issues.

[dotnet-issue-labeler]

Note regarding the new-api-needs-documentation label:

This serves as a reminder for when your PR is modifying a ref *.cs file and adding/modifying public APIs, please make sure the API implementation in the src *.cs file is documented with triple slash comments, so the PR reviewers can sign off that change.

[dotnet-issue-labeler]

Note regarding the new-api-needs-documentation label:

This serves as a reminder for when your PR is modifying a ref *.cs file and adding/modifying public APIs, please make sure the API implementation in the src *.cs file is documented with triple slash comments, so the PR reviewers can sign off that change.

[dotnet-policy-service]

Tagging subscribers to this area: @dotnet/area-system-directoryservices, @jay98014
See info in area-owners.md if you want to be subscribed.

Copilot reviewed 5 out of 10 changed files in this pull request and generated no comments.

Files not reviewed (5)

• src/libraries/Common/tests/System/DirectoryServices/LDAP.Configuration.xml: Language not supported
• src/libraries/System.DirectoryServices.Protocols/src/Resources/Strings.resx: Language not supported
• src/libraries/System.DirectoryServices.Protocols/src/System/DirectoryServices/Protocols/ldap/LdapConnection.cs: Evaluated as low risk
• src/libraries/Common/src/Interop/Interop.Ldap.cs: Evaluated as low risk
• src/libraries/System.DirectoryServices.Protocols/ref/System.DirectoryServices.Protocols.cs: Evaluated as low risk

[steveharter]

@ericstj can you commit this please; I don't have permission.

[ericstj]

@ericstj can you commit this please; I don't have permission.

You do - you just need all the checks to pass. Seems like check-labels is stuck - can happen when GitHub has an issue triggering the workflow, so to fix that I usually toggle a label.