[
https://issues.apache.org/jira/browse/KNOX-3378?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18096989#comment-18096989
]
ASF subversion and git services commented on KNOX-3378:
-------------------------------------------------------
Commit ad6c15958ba2ba3e78a5fd5225a43327003fa288 in knox's branch
refs/heads/knox_idf from Sandor Molnar
[ https://gitbox.apache.org/repos/asf?p=knox.git;h=ad6c15958 ]
KNOX-3377: KNOX-3378: KNOX-3379: Support secure LDAP (LDAPS) for the Knox
embedded LDAP service (#1305)
> Expose a secure (LDAPS) transport on the embedded Knox LDAP server
> ------------------------------------------------------------------
>
> Key: KNOX-3378
> URL: https://issues.apache.org/jira/browse/KNOX-3378
> Project: Apache Knox
> Issue Type: Sub-task
> Components: Server
> Affects Versions: 3.0.0
> Reporter: Sandor Molnar
> Assignee: Sandor Molnar
> Priority: Critical
> Fix For: 3.0.0
>
>
> Add an optional TLS transport to the embedded ApacheDS server managed by
> {{{}KnoxLDAPServerManager{}}}, so external clients can connect over LDAPS
> instead of plaintext LDAP.
> +Changes:+
> - New configuration keys (defaults keep current behavior):
> - gateway.ldap.ssl.enabled - enable LDAPS (default false).
> - {{gateway.ldap.ssl.keystore.path}} - keystore holding the server
> certificate; defaults to the gateway identity keystore
> (getIdentityKeystorePath()).
> - {{gateway.ldap.ssl.keystore.password.alias}} - credential-store alias for
> the keystore password; defaults to the gateway identity keystore password.
> - {{gateway.ldap.ssl.enabled.cipher.suites}} - optional TLS cipher-suite
> allowlist.
> - {{KnoxLDAPServerManager}} enables SSL on the {{TcpTransport}} and sets the
> keystore file + certificate password on the LdapServer.
> - Keystore password resolved via {{AliasService}} (consistent with existing
> bind-password handling); falls back to the gateway identity keystore password
> when no dedicated alias is set.
> - Fail fast at startup with a clear message when SSL is enabled but no
> keystore is available.
> +Notes/constraints:+
> - ApacheDS loads the keystore using the JVM default keystore type, so the
> configured keystore must be in that format.
> +Acceptance criteria:+
> - With SSL enabled, the server completes a TLS handshake presenting the
> configured certificate.
> - Plaintext access to the secure port is rejected.
> - Anonymous/plaintext behavior is unchanged when
> {{{}gateway.ldap.ssl.enabled=false{}}}.
> - Unit tests cover: successful TLS handshake with the configured cert,
> plaintext rejection, and missing-keystore startup failure.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
