[
https://issues.apache.org/jira/browse/KNOX-3377?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Sandor Molnar updated KNOX-3377:
--------------------------------
Resolution: Fixed
Status: Resolved (was: Patch Available)
> Support secure LDAP (LDAPS) for the Knox embedded LDAP service
> --------------------------------------------------------------
>
> Key: KNOX-3377
> URL: https://issues.apache.org/jira/browse/KNOX-3377
> Project: Apache Knox
> Issue Type: Task
> Components: Server
> Affects Versions: 3.0.0
> Reporter: Sandor Molnar
> Assignee: Sandor Molnar
> Priority: Critical
> Fix For: 3.0.0
>
> Time Spent: 40m
> Remaining Estimate: 0h
>
> The org.apache.knox.gateway.services.ldap.KnoxLDAPService currently operates
> over plaintext LDAP only. There are two distinct connection paths, and
> neither supports TLS today:
> 1. {*}Front-end{*}: the embedded ApacheDS server that clients connect to.
> {{KnoxLDAPServerManager}} binds a plain {{{}TcpTransport{}}}; no keystore/SSL
> is ever configured, so the listener is plaintext-only.
> 2. *Backend:* the {{LdapProxyBackend}} connection to the remote/backing LDAP
> server. An {{ldaps://}} URL is parsed for host/port, but SSL is never enabled
> on the {{{}LdapConnectionConfig{}}}, so the connection is always plaintext
> (and would fail against a real LDAPS endpoint).
> This JIRA adds configurable, credential-store-integrated TLS support to both
> paths so Knox can expose LDAPS to clients and proxy to a secure backend LDAP
> server.
> +Scope:+
> - Secure transport on the embedded server (front-end)
> - Secure transport for the proxy backend (backend)
> - Configuration must fit the existing {{gateway.ldap.*}} namespace and
> resolve secrets through the gateway credential store (AliasService) where
> applicable.
> - Unit/integration test coverage for both paths.
> +Out of scope / follow-ups:+
> - StartTLS for the backend (LDAPS only for now; StartTLS through the pooled
> connection factory needs a dedicated factory and can be a follow-up).
> - Mutual TLS / client-certificate authentication.
> _Dependency note:_ Enabling client-side LDAPS requires aligning the Apache
> Directory API / ApacheDS server versions with the MINA 2.2.8 that Knox ships
> for CVE reasons (details in the backend sub-task). MINA itself is not
> downgraded.
> Acceptance criteria:
> - LDAPS can be enabled for the embedded server and for the proxy backend via
> configuration.
> - Certificate material and passwords are sourced from the gateway
> keystore/credential store (front-end) and configurable trust material
> (backend).
> - Existing plaintext behavior is unchanged when the new options are disabled
> (default off).
> - All existing LDAP tests continue to pass; new tests cover the secure paths.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
