[
https://issues.apache.org/jira/browse/KNOX-3379?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Sandor Molnar updated KNOX-3379:
--------------------------------
Resolution: Fixed
Status: Resolved (was: Patch Available)
> Support LDAPS for the LdapProxyBackend connection to the remote LDAP server
> ---------------------------------------------------------------------------
>
> Key: KNOX-3379
> URL: https://issues.apache.org/jira/browse/KNOX-3379
> Project: Apache Knox
> Issue Type: Sub-task
> Components: Server
> Affects Versions: 3.0.0
> Reporter: Sandor Molnar
> Assignee: Sandor Molnar
> Priority: Critical
> Fix For: 3.0.0
>
>
> Enable the LdapProxyBackend to connect to the remote/backing LDAP server over
> LDAPS. Today an l{{{}daps:// {{}}}}URL is parsed but the connection is always
> plaintext because SSL is never applied to the LdapConnectionConfig. Apply TLS
> to both the pooled search connections and the short-lived authentication
> (bind) connection.
> +Changes:+
> - Per-backend configuration ({{{}gateway.ldap.interceptor.<name>.*{}}}):
> -- {{{}useSsl{}}}: enable LDAPS (auto-enabled when the URL uses the ldaps://
> scheme).
> -- {{{}trustAllCertificates{}}}: skip certificate validation (test/dev only).
> -- {{{}trustStore / trustStoreType / trustStorePassword{}}}: truststore used
> to validate the server certificate (defaults to the JVM default trust store
> when unset).
> -- {{{}sslProtocol, enabledProtocols, enabledCipherSuites{}}}: TLS
> protocol/cipher tuning.
> -- {{{}connectionTimeout{}}}: LDAP response timeout (ms).
> - Trust material built once and applied to both connection paths.
> +Required dependency alignment (runtime):+
> - Apache Directory client API 2.0.0 → 2.1.8. The 2.0.0 client's SSL code
> calls MINA APIs (SslFilter.setUseClientMode, etc.) removed in MINA 2.2.x,
> causing {{NoSuchMethodError}} under the MINA 2.2.8 Knox ships. 2.1.8 targets
> MINA 2.2.x.
> - ApacheDS server 2.0.0.AM26 → 2.0.0.AM27. AM26's LdapsInitializer
> references NoVerificationTrustManager, which directory-api 2.1.8 removed;
> AM27 is built against directory-api 2.1.x + MINA 2.2.x, keeping the front-end
> LDAPS transport working.
> - MINA stays at 2.2.8 (unchanged; CVE requirement).
> - Pin all directory-api artifacts to a single version and converge
> {{commons-collections4 to 4.5.0 }}to keep one consistent classpath.
> - Because {{NoVerificationTrustManager}} no longer exists in 2.1.8, the
> backend provides its own trust-all X509TrustManager for the
> {{trustAllCertificates}} path.
> +Acceptance criteria:+
> - The backend performs user/group lookups and binds against a remote LDAP
> server over TLS.
> - An untrusted server certificate is rejected when validation is enabled; a
> configured truststore or {{trustAllCertificates}} allows the connection.
> - Existing plaintext backend behavior is unchanged when useSsl is not set.
> - Integration test drives the backend over an SSL-enabled embedded server
> (lookups + binds) and verifies untrusted-cert rejection.
> - Existing LDAP tests, the shared gateway-demo-ldap server, and reactor-wide
> dependency convergence all remain green after the version bumps.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
