[
https://issues.apache.org/jira/browse/KNOX-3422?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18110507#comment-18110507
]
ASF subversion and git services commented on KNOX-3422:
-------------------------------------------------------
Commit 2606f1e97531a05f75e2cd05eb3d918121e5a3e6 in knox's branch
refs/heads/v3.0.0 from David Han
[ https://gitbox.apache.org/repos/asf?p=knox.git;h=2606f1e97 ]
KNOX-3422: Update service_ldap_server.md (#1371)
Removed a note from docs that assumed that the credentials change wouldn't make
it into 3.0.0.
(cherry picked from commit 31419b7fc0bed3fb117dd714bfceb46bbbedb56e)
> LDAP Proxy shouldn't create user from gateway.ldap.bind.user config
> -------------------------------------------------------------------
>
> Key: KNOX-3422
> URL: https://issues.apache.org/jira/browse/KNOX-3422
> Project: Apache Knox
> Issue Type: Improvement
> Components: Server
> Affects Versions: 3.0.0
> Reporter: David Han
> Assignee: David Han
> Priority: Major
> Fix For: 3.0.0
>
> Time Spent: 1h 50m
> Remaining Estimate: 0h
>
> This user configured using the gateway.ldap.bind.user configuration is used
> to bind against the LDAP Proxy. The gateway server currently creates a user
> in the local LDAP using this configuration and the aliased password. The
> downside of this approach is that there is currently no tracking for this
> user and no way to automatically remove this user if the config changes nor
> rotate the password. This user is also returned in search queries against the
> LDAP Proxy.
> I propose creating a new authentication interceptor to manage this user
> in-memory. This way the user won't be persisted and will automatically be
> unable to authenticate if the configuration changes.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
