smolnar82 opened a new pull request, #1305: URL: https://github.com/apache/knox/pull/1305
[KNOX-3377](https://issues.apache.org/jira/browse/KNOX-XXXX) - Support secure LDAP (LDAPS) for the Knox embedded LDAP service ## What changes were proposed in this pull request? `KnoxLDAPService` previously operated over plaintext LDAP only, on both of its connection paths. This PR adds configurable, credential-store-integrated LDAPS support to both, and updates the docker-based integration tests to exercise the feature end-to-end. The three commits are self-contained: 1. Front-end (embedded server) LDAPS - the embedded ApacheDS server can now expose a TLS listener instead of accepting only plaintext. - New config in the existing gateway.ldap.* namespace (defaults off, behavior unchanged): - `gateway.ldap.ssl.enabled` - `gateway.ldap.ssl.keystore.path` (defaults to the gateway identity keystore) - `gateway.ldap.ssl.keystore.password.alias` (defaults to the gateway identity keystore password) - `gateway.ldap.ssl.enabled.cipher.suites` (optional) - The keystore password is resolved through `AliasService`, consistent with the existing bind-password handling. Invalid SSL config (missing keystore) fails fast at startup with a clear message. 2. Backend (proxy) LDAPS - `LdapProxyBackend` can now connect to the remote/backing LDAP server over LDAPS. Before, an `ldaps://` URL was parsed but SSL was never enabled on the connection, so secure backend connections silently did not work. TLS is applied to both the pooled search connections and the authentication bind. Per-backend config (`gateway.ldap.interceptor.<name>.*`): `useSsl` (auto-enabled by an `ldaps://` URL), `trustAllCertificates`, `trustStore/trustStoreType/trustStorePassword`, `sslProtocol`, `enabledProtocols`, `enabledCipherSuites`, `connectionTimeout`. - Required dependency alignment for client-side LDAPS to work under the `MINA 2.2.8` that Knox ships (for CVEs): `Apache Directory client API 2.0.0 → 2.1.8` (2.0.0's SSL code calls MINA APIs removed in 2.2.x), and `ApacheDS server 2.0.0.AM26 → 2.0.0.AM27` (AM26's LdapsInitializer references `NoVerificationTrustManager`, removed in directory-api 2.1.8; AM27 is built for 2.1.x + MINA 2.2.x). MINA stays at 2.2.8. All directory-api artifacts are pinned to one version; `commons-collections4` is converged to 4.5.0; and the legacy `jdk15on` BouncyCastle that AM27 pulls is excluded in favor of Knox's `jdk18on` artifacts (same packages), keeping `dependency:analyze` and the shipped BouncyCastle consistent. 3. Integration test over LDAPS - the docker-based LDAP proxy search test now runs entirely over TLS: the client connects to the embedded Knox LDAP service over LDAPS, and Knox proxies to the demo LDAP backend over LDAPS. The demo LDAP (SimpleLdapDirectoryServer) gained optional system-property-driven SSL; ldap.sh/gateway.sh provision dev keystores and the knoxldap Shiro realm was moved to ldaps:// (its cert imported into the JVM cacerts so the JNDI realm trusts it). ## How was this patch tested? - Unit tests (gateway-server): - Front-end: TLS handshake presenting the configured certificate (JSSE SSLSocket), plaintext-access-to-secure-port rejection, and missing-keystore fail-fast. - Backend: a new `LdapProxyBackendSslTest` starts an SSL-enabled embedded ApacheDS instance and drives the backend over TLS (user/group lookups and binds), and verifies an untrusted server certificate is rejected when validation is enabled. - Full LDAP package (129 tests) passes against the upgraded ApacheDS AM27 / directory-api 2.1.8, plus `gateway-demo-ldap` and `gateway-util-common`. - Build: reactor-wide `mvn validate` (dependency convergence) and `dependency:analyze-only` pass after the version bumps and BouncyCastle exclusion. - Manual: `mvn -Ppackage clean install` then the docker-compose stack. ## Integration Tests Updated `.github/workflows/tests/test_knox_ldap_proxy_search.py` to connect over LDAPS (use_ssl=True, Tls(validate=CERT_NONE) for the self-signed dev cert), and the supporting docker fixtures (`gateway-site.xml`, `gateway.sh`, `ldap.sh`, `knoxldap.xml`) so both the client → Knox and Knox → demo-LDAP legs are TLS. `test_knox_auth_service_and_ldap.py` is unchanged but now implicitly exercises the secure backend (group resolution flows through it). Full stack result: 32/32 integration tests pass, including the `knoxldap/remoteauth/extauthz` auth suites that authenticate through the now-LDAPS embedded service. ## UI Changes N/A -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
