Sandor Molnar created KNOX-3379:
-----------------------------------
Summary: Support LDAPS for the LdapProxyBackend connection to the
remote LDAP server
Key: KNOX-3379
URL: https://issues.apache.org/jira/browse/KNOX-3379
Project: Apache Knox
Issue Type: Sub-task
Components: Server
Affects Versions: 3.0.0
Reporter: Sandor Molnar
Assignee: Sandor Molnar
Fix For: 3.0.0
Enable the LdapProxyBackend to connect to the remote/backing LDAP server over
LDAPS. Today an l{{{}daps:// {{}}}}URL is parsed but the connection is always
plaintext because SSL is never applied to the LdapConnectionConfig. Apply TLS
to both the pooled search connections and the short-lived authentication (bind)
connection.
+Changes:+
- Per-backend configuration ({{{}gateway.ldap.interceptor.<name>.*{}}}):
-- {{{}useSsl{}}}: enable LDAPS (auto-enabled when the URL uses the ldaps://
scheme).
-- {{{}trustAllCertificates{}}}: skip certificate validation (test/dev only).
-- {{{}trustStore / trustStoreType / trustStorePassword{}}}: truststore used
to validate the server certificate (defaults to the JVM default trust store
when unset).
-- {{{}sslProtocol, enabledProtocols, enabledCipherSuites{}}}: TLS
protocol/cipher tuning.
-- {{{}connectionTimeout{}}}: LDAP response timeout (ms).
- Trust material built once and applied to both connection paths.
+Required dependency alignment (runtime):+
- Apache Directory client API 2.0.0 → 2.1.8. The 2.0.0 client's SSL code calls
MINA APIs (SslFilter.setUseClientMode, etc.) removed in MINA 2.2.x, causing
{{NoSuchMethodError}} under the MINA 2.2.8 Knox ships. 2.1.8 targets MINA 2.2.x.
- ApacheDS server 2.0.0.AM26 → 2.0.0.AM27. AM26's LdapsInitializer references
NoVerificationTrustManager, which directory-api 2.1.8 removed; AM27 is built
against directory-api 2.1.x + MINA 2.2.x, keeping the front-end LDAPS transport
working.
- MINA stays at 2.2.8 (unchanged; CVE requirement).
- Pin all directory-api artifacts to a single version and converge
{{commons-collections4 to 4.5.0 }}to keep one consistent classpath.
- Because {{NoVerificationTrustManager}} no longer exists in 2.1.8, the
backend provides its own trust-all X509TrustManager for the
{{trustAllCertificates}} path.
+Acceptance criteria:+
- The backend performs user/group lookups and binds against a remote LDAP
server over TLS.
- An untrusted server certificate is rejected when validation is enabled; a
configured truststore or {{trustAllCertificates}} allows the connection.
- Existing plaintext backend behavior is unchanged when useSsl is not set.
- Integration test drives the backend over an SSL-enabled embedded server
(lookups + binds) and verifies untrusted-cert rejection.
- Existing LDAP tests, the shared gateway-demo-ldap server, and reactor-wide
dependency convergence all remain green after the version bumps.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
