[
https://issues.apache.org/jira/browse/KNOX-3359?focusedWorklogId=1028983&page=com.atlassian.jira.plugin.system.issuetabpanels:worklog-tabpanel#worklog-1028983
]
ASF GitHub Bot logged work on KNOX-3359:
----------------------------------------
Author: ASF GitHub Bot
Created on: 09/Jul/26 18:48
Start Date: 09/Jul/26 18:48
Worklog Time Spent: 10m
Work Description: moresandeep commented on code in PR #1291:
URL: https://github.com/apache/knox/pull/1291#discussion_r3554016589
##########
gateway-spi/src/main/java/org/apache/knox/gateway/dispatch/DefaultHttpClientFactory.java:
##########
@@ -173,25 +173,36 @@ private boolean doesRetryParamExist(final FilterConfig
filterConfig) {
* <p>
* This method is package private to allow access to unit tests
*
- * @param services the {@link GatewayServices}
- * @param filterConfig a {@link FilterConfig} used to query for parameters
for this operation
- * @param serviceRole the name of the service role to whom this HTTP client
is being created for
+ * @param services the {@link GatewayServices}
+ * @param gatewayConfig the {@link GatewayConfig} used to determine
single-EKU mode
+ * @param filterConfig a {@link FilterConfig} used to query for parameters
for this operation
+ * @param serviceRole the name of the service role to whom this HTTP
client is being created for
* @return a {@link SSLContext} or <code>null</code> if a custom {@link
SSLContext} is not needed.
*/
- SSLContext createSSLContext(GatewayServices services, FilterConfig
filterConfig, String serviceRole) {
+ SSLContext createSSLContext(GatewayServices services, GatewayConfig
gatewayConfig, FilterConfig filterConfig, String serviceRole) {
KeyStore identityKeystore;
char[] identityKeyPassphrase;
KeyStore trustKeystore;
KeystoreService ks = services.getService(ServiceType.KEYSTORE_SERVICE);
try {
- if
(Boolean.parseBoolean(filterConfig.getInitParameter(PARAMETER_USE_TWO_WAY_SSL)))
{
+ boolean singleEku = gatewayConfig != null &&
gatewayConfig.isSingleEkuEnabled();
+ boolean twoWaySsl =
Boolean.parseBoolean(filterConfig.getInitParameter(PARAMETER_USE_TWO_WAY_SSL))
+ || (gatewayConfig != null &&
gatewayConfig.isHttpClientTwoWaySslEnabled());
Review Comment:
Sorry, i did not understand your question.
This is a global dispatch level mTLS flag.
Prior to this change two-way-ssl was dispatch level so we'd have to go to
each service dispatch to enable mTLS. Now, we can just set it in gateay-site
and it enables for all dispatches. Services can turn it off (override) if they
want. But prior to this there was no global config for mTLS for dispatching.
Issue Time Tracking
-------------------
Worklog Id: (was: 1028983)
Time Spent: 2h 40m (was: 2.5h)
> Support Single-Purpose EKU Certificates
> ---------------------------------------
>
> Key: KNOX-3359
> URL: https://issues.apache.org/jira/browse/KNOX-3359
> Project: Apache Knox
> Issue Type: New Feature
> Components: Server
> Reporter: Sandeep More
> Assignee: Sandeep More
> Priority: Major
> Time Spent: 2h 40m
> Remaining Estimate: 0h
>
> h1. Background
> Knox currently supports a single certificate per host. This certificate
> carries both the serverAuth and clientAuth Extended Key Usages (EKUs),
> meaning the same key and certificate is used whether the service running on
> the host is acting as a TLS server or as a client in a mutual-TLS (mTLS)
> handshake.
>
> Industry standards and public CAs (like DigiCert) are sunsetting multi-use
> certificates, making Knox's current requirement for dual serverAuth and
> clientAuth EKUs difficult to manage.
> h1. Overview:
> Knox will need separate keystores and truststores for client authentication
> and server authentication.
> # Keystores:
> *
> -- Knox to assert its identity as a server
> -- Knox to assert its identity as a client (to downstream services)
> 2.Truststores:
> *
> -- Clients asserting identity to Knox
> -- Servers asserting identity to Knox
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
