moresandeep opened a new pull request, #1459: URL: https://github.com/apache/knox/pull/1459
[KNOX-3519](https://issues.apache.org/jira/browse/KNOX-3519) - Set the JWKS host on the TLS socket so HTTPS endpoint identification works under BC-FIPS ## What changes were proposed in this pull request? Under the BouncyCastle FIPS JSSE provider, fetching a JWKS over HTTPS fails before any certificate is examined: ``` java.security.cert.CertificateException: No hostname specified for HTTPS endpoint ID check at org.bouncycastle.jsse.provider.HostnameUtil.checkHostname(HostnameUtil.java:31) at org.bouncycastle.jsse.provider.ProvX509TrustManager.checkEndpointID(ProvX509TrustManager.java:333) ``` JWT verification then fails and the request is rejected with 401, even when the JWKS endpoint's certificate is fully trusted and carries a matching SAN. **The change.** A new `SetHostSSLSocketFactory` decorator stamps the JWKS URL's host onto every socket it creates, via `setHost(String)` as declared by `org.bouncycastle.jsse.BCSSLSocket`. It is wired in at both JWKS retrieval paths: `DefaultTokenAuthorityService.buildJwkSource` (default truststore) and `IssuerTrustResourceRetriever` (per-issuer CA bundle). Notes on the implementation: - The BC type is reached reflectively, so Knox takes no compile dependency on the BouncyCastle TLS provider, it is present only in FIPS deployments. Lookup walks interfaces first, because BC's socket implementations are package-private and the method is only invocable through the public `BCSSLSocket` interface. - On sockets that do not expose `setHost` the decorator is a no-op. That is correct for the stock JSSE, which identifies HTTPS endpoints from the URL already, so non-FIPS deployments are unaffected. - Endpoint identification is **preserved, not bypassed**. The server certificate must still carry a SAN matching the JWKS host. - The retriever built for the default path reproduces Nimbus's own defaults exactly (connect/read 500 ms, 51200 byte limit, `disconnectAfterUse = true`), so timeout and size behaviour are unchanged. ## How was this patch tested? Patch was tested locally. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
