[
https://issues.apache.org/jira/browse/KNOX-3377?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18096413#comment-18096413
]
ASF subversion and git services commented on KNOX-3377:
-------------------------------------------------------
Commit ad6c15958ba2ba3e78a5fd5225a43327003fa288 in knox's branch
refs/heads/master from Sandor Molnar
[ https://gitbox.apache.org/repos/asf?p=knox.git;h=ad6c15958 ]
KNOX-3377: KNOX-3378: KNOX-3379: Support secure LDAP (LDAPS) for the Knox
embedded LDAP service (#1305)
> Support secure LDAP (LDAPS) for the Knox embedded LDAP service
> --------------------------------------------------------------
>
> Key: KNOX-3377
> URL: https://issues.apache.org/jira/browse/KNOX-3377
> Project: Apache Knox
> Issue Type: Task
> Components: Server
> Affects Versions: 3.0.0
> Reporter: Sandor Molnar
> Assignee: Sandor Molnar
> Priority: Critical
> Fix For: 3.0.0
>
> Time Spent: 40m
> Remaining Estimate: 0h
>
> The org.apache.knox.gateway.services.ldap.KnoxLDAPService currently operates
> over plaintext LDAP only. There are two distinct connection paths, and
> neither supports TLS today:
> 1. {*}Front-end{*}: the embedded ApacheDS server that clients connect to.
> {{KnoxLDAPServerManager}} binds a plain {{{}TcpTransport{}}}; no keystore/SSL
> is ever configured, so the listener is plaintext-only.
> 2. *Backend:* the {{LdapProxyBackend}} connection to the remote/backing LDAP
> server. An {{ldaps://}} URL is parsed for host/port, but SSL is never enabled
> on the {{{}LdapConnectionConfig{}}}, so the connection is always plaintext
> (and would fail against a real LDAPS endpoint).
> This JIRA adds configurable, credential-store-integrated TLS support to both
> paths so Knox can expose LDAPS to clients and proxy to a secure backend LDAP
> server.
> +Scope:+
> - Secure transport on the embedded server (front-end)
> - Secure transport for the proxy backend (backend)
> - Configuration must fit the existing {{gateway.ldap.*}} namespace and
> resolve secrets through the gateway credential store (AliasService) where
> applicable.
> - Unit/integration test coverage for both paths.
> +Out of scope / follow-ups:+
> - StartTLS for the backend (LDAPS only for now; StartTLS through the pooled
> connection factory needs a dedicated factory and can be a follow-up).
> - Mutual TLS / client-certificate authentication.
> _Dependency note:_ Enabling client-side LDAPS requires aligning the Apache
> Directory API / ApacheDS server versions with the MINA 2.2.8 that Knox ships
> for CVE reasons (details in the backend sub-task). MINA itself is not
> downgraded.
> Acceptance criteria:
> - LDAPS can be enabled for the embedded server and for the proxy backend via
> configuration.
> - Certificate material and passwords are sourced from the gateway
> keystore/credential store (front-end) and configurable trust material
> (backend).
> - Existing plaintext behavior is unchanged when the new options are disabled
> (default off).
> - All existing LDAP tests continue to pass; new tests cover the secure paths.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
