Sandor Molnar created KNOX-3378:
-----------------------------------
Summary: Expose a secure (LDAPS) transport on the embedded Knox
LDAP server
Key: KNOX-3378
URL: https://issues.apache.org/jira/browse/KNOX-3378
Project: Apache Knox
Issue Type: Sub-task
Components: Server
Affects Versions: 3.0.0
Reporter: Sandor Molnar
Assignee: Sandor Molnar
Fix For: 3.0.0
Add an optional TLS transport to the embedded ApacheDS server managed by
{{{}KnoxLDAPServerManager{}}}, so external clients can connect over LDAPS
instead of plaintext LDAP.
+Changes:+
- New configuration keys (defaults keep current behavior):
- gateway.ldap.ssl.enabled - enable LDAPS (default false).
- {{gateway.ldap.ssl.keystore.path}} - keystore holding the server
certificate; defaults to the gateway identity keystore
(getIdentityKeystorePath()).
- {{gateway.ldap.ssl.keystore.password.alias}} - credential-store alias for
the keystore password; defaults to the gateway identity keystore password.
- {{gateway.ldap.ssl.enabled.cipher.suites}} - optional TLS cipher-suite
allowlist.
- {{KnoxLDAPServerManager}} enables SSL on the {{TcpTransport}} and sets the
keystore file + certificate password on the LdapServer.
- Keystore password resolved via {{AliasService}} (consistent with existing
bind-password handling); falls back to the gateway identity keystore password
when no dedicated alias is set.
- Fail fast at startup with a clear message when SSL is enabled but no
keystore is available.
+Notes/constraints:+
- ApacheDS loads the keystore using the JVM default keystore type, so the
configured keystore must be in that format.
+Acceptance criteria:+
- With SSL enabled, the server completes a TLS handshake presenting the
configured certificate.
- Plaintext access to the secure port is rejected.
- Anonymous/plaintext behavior is unchanged when
{{{}gateway.ldap.ssl.enabled=false{}}}.
- Unit tests cover: successful TLS handshake with the configured cert,
plaintext rejection, and missing-keystore startup failure.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
