This is an automated email from the ASF dual-hosted git repository.
smolnar82 pushed a change to branch knox_idf
in repository https://gitbox.apache.org/repos/asf/knox.git
discard 3a3b8043d Knox as OIDC Provider (#1215)
add bea046932 KNOX-3372: Add gateway-reloadable documentation (#1297)
add 1427c8858 KNOX-3344: Upgrade pac4j to 6.5.3 (#1278)
add 7b34b7c98 KNOX-3374: Fix inherited roles missing from auth headers
when LDAP roles-lookup interceptor is active (#1300)
add 6dbdc9486 KNOX-3359 - Support Single-Purpose EKU Certificates (#1291)
add 3f2ed2e59 KNOX-3375: Wire in gatewayservices for
LDAPRolesLookupInterceptorFactory so KnoxCLI is able to load it (#1303)
add c24781a1a KNOX-3376: Use DeafultAliasService in Knox OOTB (#1304)
add ad6c15958 KNOX-3377: KNOX-3378: KNOX-3379: Support secure LDAP (LDAPS)
for the Knox embedded LDAP service (#1305)
add 6110aea62 KNOX-3374: Skip redundant roles lookup in PreAuth/ExtAuthz
when the identity-assertion layer already resolved roles (#1306)
add 8d70ff44d KNOX-3380: hive_metastore_enable_ssl config should be used
to determin if SSL is enabled on HMS (#1307)
add 34ba12724 KNOX-3361: Route OpenSAML off BouncyCastle in FIPS mode
(#1299)
new a023563db Knox as OIDC Provider (#1215)
This update added new revisions after undoing existing revisions.
That is to say, some revisions that were in the old version of the
branch are not in the new version. This situation occurs
when a user --force pushes a change and generates a repository
containing something like this:
* -- * -- B -- O -- O -- O (3a3b8043d)
\
N -- N -- N refs/heads/knox_idf (a023563db)
You should already have received notification emails for all of the O
revisions, and so the following emails describe only the N revisions
from the common base, B.
Any revisions marked "omit" are not gone; other references still
refer to them. Any revisions marked "discard" are gone forever.
The 1 revisions listed above as "new" are entirely new to this
repository and will be described in separate emails. The revisions
listed as "add" were already present in the repository and have only
been added to this reference.
Summary of changes:
.../workflows/build/conf/topologies/knoxldap.xml | 2 +-
.github/workflows/build/gateway-site.xml | 22 +-
.github/workflows/build/gateway.sh | 34 ++-
.github/workflows/build/ldap.sh | 20 +-
.../compose/docker-compose.single-eku-no-mtls.yml | 31 +++
.../compose/docker-compose.single-eku.yml | 62 +++++
.github/workflows/compose/docker-compose.yml | 2 +-
.../workflows/compose/gen-single-eku-keystores.sh | 75 +++++
.../single-eku-no-mtls}/gateway-site.xml | 14 +-
.../compose/single-eku/gateway-single-eku.sh | 47 ++++
.../{build => compose/single-eku}/gateway-site.xml | 66 +++++
.../compose/single-eku/keystores/client-cert.pem | 18 ++
.../compose/single-eku/keystores/client-key.pem | 28 ++
.../single-eku/keystores/global_truststore.jks | Bin 0 -> 812 bytes
.../single-eku/keystores/host-client_keystore.jks | Bin 0 -> 2112 bytes
.../keystores/server-identity_keystore.jks | Bin 0 -> 2120 bytes
.github/workflows/tests.yml | 89 +++++-
.../workflows/tests/test_knox_ldap_proxy_search.py | 16 +-
.github/workflows/tests/test_single_eku_mtls.py | 130 +++++++++
.github/workflows/tests/test_single_eku_no_mtls.py | 62 +++++
.gitignore | 3 +
build.xml | 2 +-
gateway-demo-ldap/pom.xml | 7 +
.../security/ldap/SimpleLdapDirectoryServer.java | 18 ++
.../hive/IcebergRestServiceModelGenerator.java | 2 +-
.../gateway/ha/dispatch/SSEHaDispatchTest.java | 4 +
.../filter/AbstractIdentityAssertionFilter.java | 11 +-
.../filter/CommonIdentityAssertionFilter.java | 4 +-
.../filter/CommonIdentityAssertionFilterTest.java | 2 +-
.../filter/ConcatIdentityAssertionFilter.java | 4 +-
.../filter/ConcatIdentityAssertionFilterTest.java | 2 +-
.../groups/filter/HadoopGroupProviderFilter.java | 14 +-
.../filter/HadoopGroupProviderFilterTest.java | 41 ++-
.../filter/NoImpersonationFilter.java | 2 +-
.../filter/NoImpersonationFilterTest.java | 10 +-
.../filter/IdentityAsserterFilter.java | 4 +-
.../filter/DefaultIdentityAssertionFilterTest.java | 10 +-
.../regex/filter/RegexIdentityAssertionFilter.java | 3 +-
.../filter/RegexIdentityAssertionFilterTest.java | 2 +-
.../SwitchCaseIdentityAssertionFilter.java | 3 +-
.../SwitchCaseIdentityAssertionFilterTest.java | 16 +-
gateway-provider-security-pac4j/pom.xml | 10 +
gateway-release/home/conf/gateway-site.xml | 6 +-
gateway-server/pom.xml | 13 +
.../org/apache/knox/gateway/GatewayMessages.java | 9 +
.../gateway/config/impl/GatewayConfigImpl.java | 56 ++++
.../services/factory/LdapServiceFactory.java | 1 +
.../services/ldap/KnoxLDAPServerManager.java | 89 +++++-
.../gateway/services/ldap/KnoxLDAPService.java | 14 +-
.../knox/gateway/services/ldap/LdapMessages.java | 8 +
.../services/ldap/backend/LdapProxyBackend.java | 131 ++++++++-
.../DisabledUserInterceptorFactory.java | 3 +-
.../DuplicateUserFilteringInterceptorFactory.java | 3 +-
.../ldap/interceptor/InterceptorFactory.java | 6 +-
.../interceptor/KnoxLdapInterceptorFactory.java | 6 +-
.../LDAPRolesLookupInterceptorFactory.java | 10 +-
.../interceptor/UserSearchInterceptorFactory.java | 3 +-
.../security/impl/DefaultAliasService.java | 14 +
.../security/impl/DefaultKeystoreService.java | 27 +-
.../services/security/impl/JettySSLService.java | 130 ++++++++-
.../services/security/impl/RemoteAliasService.java | 14 +
.../security/impl/ZookeeperRemoteAliasService.java | 5 +
.../gateway/config/impl/GatewayConfigImplTest.java | 57 ++++
.../services/ldap/KnoxLDAPServerManagerTest.java | 134 ++++++++-
.../gateway/services/ldap/KnoxLDAPServiceTest.java | 1 +
.../ldap/backend/LdapProxyBackendSslTest.java | 263 ++++++++++++++++++
.../LDAPRolesLookupInterceptorFactoryTest.java | 13 +-
.../services/security/CryptoServiceTest.java | 5 +
.../security/impl/DefaultAliasServiceTest.java | 81 ++++++
.../security/impl/DefaultKeystoreServiceTest.java | 100 +++++++
.../security/impl/JettySSLServiceTest.java | 303 +++++++++++++++++++++
.../impl/RemoteAliasServiceTestProvider.java | 5 +
.../gateway/service/auth/AbstractAuthResource.java | 13 +-
.../gateway/service/auth/ExtAuthzResource.java | 9 +
.../knox/gateway/service/auth/PreAuthResource.java | 9 +
.../gateway/service/auth/ExtAuthzResourceTest.java | 9 +-
.../gateway/service/auth/PreAuthResourceTest.java | 52 +++-
.../vault/HashicorpVaultAliasService.java | 5 +
gateway-shim-opensaml-security-api/pom.xml | 110 ++++++++
.../FipsConfigurationPropertiesSource.java | 50 ++++
.../KnoxNamedCurveRegistryInitializer.java | 28 +-
...nsaml.core.config.ConfigurationPropertiesSource | 3 +-
.../services/org.opensaml.core.config.Initializer | 3 +-
.../KnoxNamedCurveRegistryInitializerTest.java | 83 ++++++
.../org/apache/knox/gateway/GatewayTestConfig.java | 60 ++++
.../apache/knox/gateway/SpiGatewayMessages.java | 4 +
.../apache/knox/gateway/config/GatewayConfig.java | 87 ++++++
.../dispatch/DefaultHttpAsyncClientFactory.java | 2 +-
.../gateway/dispatch/DefaultHttpClientFactory.java | 34 ++-
.../security/AbstractIdentityAssertionBase.java | 2 +
.../gateway/services/security/AliasService.java | 2 +
.../gateway/services/security/KeystoreService.java | 19 ++
.../DefaultHttpAsyncClientFactoryTest.java | 2 +
.../dispatch/DefaultHttpClientFactoryTest.java | 177 +++++++++++-
.../apache/knox/gateway/sse/SSEDispatchTest.java | 2 +
.../knox/gateway/util/X509CertificateUtil.java | 14 +-
.../knox/gateway/util/X509CertificateUtilTest.java | 39 +++
knox-site/docs/config.md | 40 +++
knox-site/docs/config_mutual_authentication_ssl.md | 57 ++++
knox-site/docs/config_pac4j_provider.md | 2 +
pom.xml | 125 +++++++--
101 files changed, 3272 insertions(+), 172 deletions(-)
create mode 100644
.github/workflows/compose/docker-compose.single-eku-no-mtls.yml
create mode 100644 .github/workflows/compose/docker-compose.single-eku.yml
create mode 100755 .github/workflows/compose/gen-single-eku-keystores.sh
copy .github/workflows/{build => compose/single-eku-no-mtls}/gateway-site.xml
(92%)
create mode 100755 .github/workflows/compose/single-eku/gateway-single-eku.sh
copy .github/workflows/{build => compose/single-eku}/gateway-site.xml (72%)
create mode 100644
.github/workflows/compose/single-eku/keystores/client-cert.pem
create mode 100644
.github/workflows/compose/single-eku/keystores/client-key.pem
create mode 100644
.github/workflows/compose/single-eku/keystores/global_truststore.jks
create mode 100644
.github/workflows/compose/single-eku/keystores/host-client_keystore.jks
create mode 100644
.github/workflows/compose/single-eku/keystores/server-identity_keystore.jks
create mode 100644 .github/workflows/tests/test_single_eku_mtls.py
create mode 100644 .github/workflows/tests/test_single_eku_no_mtls.py
create mode 100644
gateway-server/src/test/java/org/apache/knox/gateway/services/ldap/backend/LdapProxyBackendSslTest.java
create mode 100644
gateway-server/src/test/java/org/apache/knox/gateway/services/security/impl/DefaultAliasServiceTest.java
create mode 100644 gateway-shim-opensaml-security-api/pom.xml
create mode 100644
gateway-shim-opensaml-security-api/src/main/java/org/apache/knox/gateway/shim/opensaml/FipsConfigurationPropertiesSource.java
copy
gateway-util-common/src/main/java/org/apache/knox/gateway/util/TruststorePasswordSetter.java
=>
gateway-shim-opensaml-security-api/src/main/java/org/apache/knox/gateway/shim/opensaml/KnoxNamedCurveRegistryInitializer.java
(53%)
copy
gateway-provider-rewrite-func-hostmap-static/src/test/resources/org/apache/knox/gateway/hostmap/impl/HostmapFunctionProcessorTest/hdfs-hostmap.txt
=>
gateway-shim-opensaml-security-api/src/main/resources/META-INF/services/org.opensaml.core.config.ConfigurationPropertiesSource
(91%)
copy
gateway-provider-rewrite-func-hostmap-static/src/test/resources/org/apache/knox/gateway/hostmap/impl/HostmapFunctionProcessorTest/hdfs-hostmap.txt
=>
gateway-shim-opensaml-security-api/src/main/resources/META-INF/services/org.opensaml.core.config.Initializer
(91%)
create mode 100644
gateway-shim-opensaml-security-api/src/test/java/org/apache/knox/gateway/shim/opensaml/KnoxNamedCurveRegistryInitializerTest.java
