Sandor Molnar created KNOX-3377:
-----------------------------------
Summary: Support secure LDAP (LDAPS) for the Knox embedded LDAP
service
Key: KNOX-3377
URL: https://issues.apache.org/jira/browse/KNOX-3377
Project: Apache Knox
Issue Type: Task
Components: Server
Affects Versions: 3.0.0
Reporter: Sandor Molnar
Assignee: Sandor Molnar
Fix For: 3.0.0
The org.apache.knox.gateway.services.ldap.KnoxLDAPService currently operates
over plaintext LDAP only. There are two distinct connection paths, and neither
supports TLS today:
1. {*}Front-end{*}: the embedded ApacheDS server that clients connect to.
{{KnoxLDAPServerManager}} binds a plain {{{}TcpTransport{}}}; no keystore/SSL
is ever configured, so the listener is plaintext-only.
2. *Backend:* the {{LdapProxyBackend}} connection to the remote/backing LDAP
server. An {{ldaps://}} URL is parsed for host/port, but SSL is never enabled
on the {{{}LdapConnectionConfig{}}}, so the connection is always plaintext (and
would fail against a real LDAPS endpoint).
This JIRA adds configurable, credential-store-integrated TLS support to both
paths so Knox can expose LDAPS to clients and proxy to a secure backend LDAP
server.
+Scope:+
- Secure transport on the embedded server (front-end)
- Secure transport for the proxy backend (backend)
- Configuration must fit the existing {{gateway.ldap.*}} namespace and resolve
secrets through the gateway credential store (AliasService) where applicable.
- Unit/integration test coverage for both paths.
+Out of scope / follow-ups:+
- StartTLS for the backend (LDAPS only for now; StartTLS through the pooled
connection factory needs a dedicated factory and can be a follow-up).
- Mutual TLS / client-certificate authentication.
_Dependency note:_ Enabling client-side LDAPS requires aligning the Apache
Directory API / ApacheDS server versions with the MINA 2.2.8 that Knox ships
for CVE reasons (details in the backend sub-task). MINA itself is not
downgraded.
Acceptance criteria:
- LDAPS can be enabled for the embedded server and for the proxy backend via
configuration.
- Certificate material and passwords are sourced from the gateway
keystore/credential store (front-end) and configurable trust material (backend).
- Existing plaintext behavior is unchanged when the new options are disabled
(default off).
- All existing LDAP tests continue to pass; new tests cover the secure paths.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
