[
https://issues.apache.org/jira/browse/KNOX-3377?focusedWorklogId=1030262&page=com.atlassian.jira.plugin.system.issuetabpanels:worklog-tabpanel#worklog-1030262
]
ASF GitHub Bot logged work on KNOX-3377:
----------------------------------------
Author: ASF GitHub Bot
Created on: 14/Jul/26 10:15
Start Date: 14/Jul/26 10:15
Worklog Time Spent: 10m
Work Description: github-actions[bot] commented on PR #1305:
URL: https://github.com/apache/knox/pull/1305#issuecomment-4968056056
## Test Results
36 tests 36 ✅ 6s ⏱️
3 suites 0 💤
3 files 0 ❌
Results for commit 7a92b3e1.
[test-results]:data:application/gzip;base64,H4sIACsMVmoC/12Myw7CIBBFf6Vh7aKAgPgzBqdDMrEthsfK+O8iGmzd3XNuch7M04yJnQd5GFgqlDtMJbpMYa2oK9Yjt6vDJRWAP3OjezVjF97RvBMYY4hfE8vai++9C37Er9d4k2u8rUFYFsoVmHFWXCVyro4jgvYCLHpnBJdSg7IG9MmgmpA9X3uuCX//AAAA
Issue Time Tracking
-------------------
Worklog Id: (was: 1030262)
Time Spent: 20m (was: 10m)
> Support secure LDAP (LDAPS) for the Knox embedded LDAP service
> --------------------------------------------------------------
>
> Key: KNOX-3377
> URL: https://issues.apache.org/jira/browse/KNOX-3377
> Project: Apache Knox
> Issue Type: Task
> Components: Server
> Affects Versions: 3.0.0
> Reporter: Sandor Molnar
> Assignee: Sandor Molnar
> Priority: Critical
> Fix For: 3.0.0
>
> Time Spent: 20m
> Remaining Estimate: 0h
>
> The org.apache.knox.gateway.services.ldap.KnoxLDAPService currently operates
> over plaintext LDAP only. There are two distinct connection paths, and
> neither supports TLS today:
> 1. {*}Front-end{*}: the embedded ApacheDS server that clients connect to.
> {{KnoxLDAPServerManager}} binds a plain {{{}TcpTransport{}}}; no keystore/SSL
> is ever configured, so the listener is plaintext-only.
> 2. *Backend:* the {{LdapProxyBackend}} connection to the remote/backing LDAP
> server. An {{ldaps://}} URL is parsed for host/port, but SSL is never enabled
> on the {{{}LdapConnectionConfig{}}}, so the connection is always plaintext
> (and would fail against a real LDAPS endpoint).
> This JIRA adds configurable, credential-store-integrated TLS support to both
> paths so Knox can expose LDAPS to clients and proxy to a secure backend LDAP
> server.
> +Scope:+
> - Secure transport on the embedded server (front-end)
> - Secure transport for the proxy backend (backend)
> - Configuration must fit the existing {{gateway.ldap.*}} namespace and
> resolve secrets through the gateway credential store (AliasService) where
> applicable.
> - Unit/integration test coverage for both paths.
> +Out of scope / follow-ups:+
> - StartTLS for the backend (LDAPS only for now; StartTLS through the pooled
> connection factory needs a dedicated factory and can be a follow-up).
> - Mutual TLS / client-certificate authentication.
> _Dependency note:_ Enabling client-side LDAPS requires aligning the Apache
> Directory API / ApacheDS server versions with the MINA 2.2.8 that Knox ships
> for CVE reasons (details in the backend sub-task). MINA itself is not
> downgraded.
> Acceptance criteria:
> - LDAPS can be enabled for the embedded server and for the proxy backend via
> configuration.
> - Certificate material and passwords are sourced from the gateway
> keystore/credential store (front-end) and configurable trust material
> (backend).
> - Existing plaintext behavior is unchanged when the new options are disabled
> (default off).
> - All existing LDAP tests continue to pass; new tests cover the secure paths.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
