[
https://issues.apache.org/jira/browse/KNOX-3513?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18126986#comment-18126986
]
ASF subversion and git services commented on KNOX-3513:
-------------------------------------------------------
Commit 3c4c6e1b54090630ffcdd1d41acf563b743d01aa in knox's branch
refs/heads/master from Sandor Molnar
[ https://gitbox.apache.org/repos/asf?p=knox.git;h=3c4c6e1b5 ]
KNOX-3513 - Add capped retry for resolving LDAP backend password aliases (#1453)
LDAP backend password aliases (${ALIAS=...}) that are not yet in the credential
store when the embedded LDAP service creates its interceptors can now be looked
up again before they are left unresolved:
- gateway.ldap.backend.password.alias.retry.attempts (default 0, no retry)
- gateway.ldap.backend.password.alias.retry.interval.ms (default 1000)
All missing aliases are retried together, so the LDAP service waits at most
(attempts x interval). Only missing aliases are retried; credential store errors
are still reported right away.
The Knox CLI also initializes the LDAP service, so it never retries: otherwise
every knoxcli command - including the create-alias that provides the missing
alias - would stall for the whole retry window.
The CI compose stack now creates the demoldap systemPassword alias only after
Knox has started retrying the lookup, and a new test verifies from gateway.log
that the retry picked it up.
Co-authored-by: Claude <[email protected]>
> Retry unresolved credential-store aliases for LDAP proxy backend passwords
> --------------------------------------------------------------------------
>
> Key: KNOX-3513
> URL: https://issues.apache.org/jira/browse/KNOX-3513
> Project: Apache Knox
> Issue Type: Improvement
> Components: Server
> Affects Versions: 3.1.0
> Reporter: Sandor Molnar
> Assignee: Sandor Molnar
> Priority: Major
> Fix For: 3.1.0
>
> Time Spent: 40m
> Remaining Estimate: 0h
>
> Since KNOX-3497, {{KnoxLDAPServerManager#resolveBackendPasswordAliases}}
> resolves {{S\{ALIAS=…} / ${ALIAS=…}}} in {{{}bindPassword{}}},
> {{systemPassword}} and {{trustStorePassword}} exactly once, when the
> interceptors are built. If the alias isn't in the gateway credential store
> yet, Knox logs "{{{}No value found in the gateway credential store for alias
> …",{}}} keeps the raw reference, and backend binds fail with
> {{INVALID_CREDENTIALS}} until something triggers a reload.
> This happens in Kubernetes when the Secret and the CR are created together
> and Knox is already running. Knox reloads the CR 1–10s after it's synced, but
> the operator persists the alias about 4–5s after the Secret is created. So
> Knox often looks up the alias before it exists, and nothing makes it look
> again.
> *Proposal*
> When an alias lookup returns null, retry it with a cap instead of giving up
> after the first attempt:
> * Configurable in {{gateway-site.xml.}} Suggested defaults: 5 attempts, 2s
> delay.
> * Each retry must read the current credential store, not a cached negative
> result.
> * Log each retry at {{{}WARN{}}}. Log {{ERROR}} only after the last attempt
> fails, then fall back to today's behaviour.
> * Retries *must not block* gateway startup or reloads of other interceptors.
> * Literal (non-alias) values are unchanged.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
