[jira] [Work logged] (KNOX-3497) LdapProxyBackend does not resolve credential-store aliases for bind/system password

["ASF GitHub Bot (Jira)" <ji...@apache.org>]

     [ https://issues.apache.org/jira/browse/KNOX-3497?focusedWorklogId=1044787&page=com.atlassian.jira.plugin.system.issuetabpanels:worklog-tabpanel#worklog-1044787 ]

ASF GitHub Bot logged work on KNOX-3497:
----------------------------------------

                Author: ASF GitHub Bot
            Created on: 30/Sep/26 09:11
            Start Date: 30/Sep/26 09:11
    Worklog Time Spent: 10m 
      Work Description: smolnar82 opened a new pull request, #1436:
URL: https://github.com/apache/knox/pull/1436

   [KNOX-3497](https://issues.apache.org/jira/browse/KNOX-3497) - Resolve credential-store aliases for LDAP Proxy Backend passwords
   
   ## What changes were proposed in this pull request?
   
   The Knox LDAP Proxy Backend read its bind/system/truststore passwords as literal strings from `gateway-site.xml`, so a `S{ALIAS=...}` credential-store reference was sent verbatim over the wire as the password instead of being resolved - unlike every other Knox password property (e.g. the proxy's own `gateway_ldap_bind_password`).
   
   This PR closes that gap:
   
   1. `KnoxLDAPServerManager.createInterceptors()` now resolves credential-store alias references in the backend password properties (bindPassword, systemPassword, trustStorePassword) before the config map reaches the backend:
   2. Literal values pass through unchanged for backward compatibility.
   3. An unresolvable alias is left as-is and logged at ERROR, so the backend bind fails visibly rather than silently binding with a different credential.
   
   The fix lives in the server manager (which holds the AliasService and mutates the config map that flows to the backend), so the pluggable `LdapBackendFactory` / `LdapBackend` SPI is untouched.
   
   Docs updated in `knox-site/docs/service_ldap_server.md` with a new Credential store aliases for backend passwords subsection.
   
   ## How was this patch tested?
   
   - Unit - `KnoxLDAPServerManagerTest`: added cases for
     - `testLdapBackendPasswordAliasIsResolved`- `S{ALIAS=...}` → secret from the credential store,
     - `testLdapBackendLiteralPasswordIsUnchanged` - literal passthrough,
     - `testLdapBackendUnresolvablePasswordAliasIsLeftUnchanged` - alias left intact on failure.
   
   
   ## Integration Tests
   
   The default CI E2E env now supplies the demo backend's system password to the proxy via an alias, so `test_knox_ldap_proxy_search.py` exercises real alias resolution end-to-end:
   
   - build/gateway.sh seeds `gateway_ldap_demoldap_system_password` via `knoxcli.sh create-alias`.
   - build/gateway-site.xml sets:
   ```
   <property>
       <name>gateway.ldap.interceptor.demoldap.systemPassword</name>
       <value>S{ALIAS=gateway_ldap_demoldap_system_password}</value>
   </property>
   ```
   The proxy must resolve the alias to bind to the demo LDAP; a regression would send the literal `S{ALIAS=...}` string as the password and every proxied search would fail on a bind error - turning the whole suite red.
   
   Test results:
   ```
   tests-1  | ------------------------------------
   tests-1  | Your code has been rated at 10.00/10
   tests-1  | 
   tests-1  | Waiting for knox...
   tests-1  | ============================= test session starts ==============================
   tests-1  | platform linux 

Issue Time Tracking
-------------------

            Worklog Id:     (was: 1044787)
    Remaining Estimate: 0h
            Time Spent: 10m

> LdapProxyBackend does not resolve credential-store aliases for bind/system password
> -----------------------------------------------------------------------------------
>
>                 Key: KNOX-3497
>                 URL: https://issues.apache.org/jira/browse/KNOX-3497
>             Project: Apache Knox
>          Issue Type: Improvement
>          Components: Server
>    Affects Versions: 3.0.0
>            Reporter: Sandor Molnar
>            Assignee: Sandor Molnar
>            Priority: Major
>             Fix For: 3.1.0
>
>          Time Spent: 10m
>  Remaining Estimate: 0h
>
> {{LdapProxyBackend}} reads the AD service-account password as a literal string and never resolves credential-store aliases:
>  * {{LdapProxyBackend.java:158-161}} - {{bindPassword = config.get("bindPassword") / config.get("systemPassword");}} value passed verbatim to {{setCredentials()}} (line 282).
>  * No {{AliasService}} reference anywhere in the class or its factory.
>  * Upstream config ({{{}GatewayConfigImpl.getLDAPInterceptorConfig{}}}) is a plain prefix scan with no alias expansion; the only alias-aware LDAP calls ({{{}KnoxLDAPServerManager.start{}}}, {{{}resolveSslKeystorePassword{}}}) are off this path.
> {*}Impact{*}: An alias reference in {{gateway.ldap.interceptor.<name>.bindPassword/.systemPassword}} is used as the literal password, so the AD bind fails. Passwords can only be stored in cleartext config today.
> {*}Fix{*}: Resolve aliases for the bind/system password on the backend path (in {{LdapProxyBackend.init()}} or when the interceptor config is assembled), preserving literal values for back-compat.



--
This message was sent by Atlassian Jira
(v8.20.10#820010)