[jira] [Updated] (KNOX-3513) Retry unresolved credential-store aliases for LDAP proxy backend passwords

["Sandor Molnar (Jira)" <ji...@apache.org>]

     [ https://issues.apache.org/jira/browse/KNOX-3513?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Sandor Molnar updated KNOX-3513:
--------------------------------
    Status: Patch Available  (was: Open)

> Retry unresolved credential-store aliases for LDAP proxy backend passwords
> --------------------------------------------------------------------------
>
>                 Key: KNOX-3513
>                 URL: https://issues.apache.org/jira/browse/KNOX-3513
>             Project: Apache Knox
>          Issue Type: Improvement
>          Components: Server
>    Affects Versions: 3.1.0
>            Reporter: Sandor Molnar
>            Assignee: Sandor Molnar
>            Priority: Major
>             Fix For: 3.1.0
>
>          Time Spent: 20m
>  Remaining Estimate: 0h
>
> Since KNOX-3497, {{KnoxLDAPServerManager#resolveBackendPasswordAliases}} resolves {{S\{ALIAS=…} / ${ALIAS=…}}} in {{{}bindPassword{}}}, {{systemPassword}} and {{trustStorePassword}} exactly once, when the interceptors are built. If the alias isn't in the gateway credential store yet, Knox logs "{{{}No value found in the gateway credential store for alias …",{}}} keeps the raw reference, and backend binds fail with {{INVALID_CREDENTIALS}} until something triggers a reload.
> This happens in Kubernetes when the Secret and the CR are created together and Knox is already running. Knox reloads the CR 1–10s after it's synced, but the operator persists the alias about 4–5s after the Secret is created. So Knox often looks up the alias before it exists, and nothing makes it look again.
> *Proposal*
> When an alias lookup returns null, retry it with a cap instead of giving up after the first attempt:
>  * Configurable in {{gateway-site.xml.}} Suggested defaults: 5 attempts, 2s delay.
>  * Each retry must read the current credential store, not a cached negative result.
>  * Log each retry at {{{}WARN{}}}. Log {{ERROR}} only after the last attempt fails, then fall back to today's behaviour.
>  * Retries *must not block* gateway startup or reloads of other interceptors.
>  * Literal (non-alias) values are unchanged.



--
This message was sent by Atlassian Jira
(v8.20.10#820010)