[jira] [Commented] (KNOX-3377) Support secure LDAP (LDAPS) for the Knox embedded LDAP service

["ASF subversion and git services (Jira)" <ji...@apache.org>]

    [ https://issues.apache.org/jira/browse/KNOX-3377?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18096413#comment-18096413 ] 

ASF subversion and git services commented on KNOX-3377:
-------------------------------------------------------

Commit ad6c15958ba2ba3e78a5fd5225a43327003fa288 in knox's branch refs/heads/master from Sandor Molnar
[ https://gitbox.apache.org/repos/asf?p=knox.git;h=ad6c15958 ]

KNOX-3377: KNOX-3378: KNOX-3379: Support secure LDAP (LDAPS) for the Knox embedded LDAP service (#1305)

> Support secure LDAP (LDAPS) for the Knox embedded LDAP service
> --------------------------------------------------------------
>
>                 Key: KNOX-3377
>                 URL: https://issues.apache.org/jira/browse/KNOX-3377
>             Project: Apache Knox
>          Issue Type: Task
>          Components: Server
>    Affects Versions: 3.0.0
>            Reporter: Sandor Molnar
>            Assignee: Sandor Molnar
>            Priority: Critical
>             Fix For: 3.0.0
>
>          Time Spent: 40m
>  Remaining Estimate: 0h
>
> The org.apache.knox.gateway.services.ldap.KnoxLDAPService currently operates over plaintext LDAP only. There are two distinct connection paths, and neither supports TLS today:
> 1. {*}Front-end{*}: the embedded ApacheDS server that clients connect to. {{KnoxLDAPServerManager}} binds a plain {{{}TcpTransport{}}}; no keystore/SSL is ever configured, so the listener is plaintext-only.
> 2. *Backend:* the {{LdapProxyBackend}} connection to the remote/backing LDAP server. An {{ldaps://}} URL is parsed for host/port, but SSL is never enabled on the {{{}LdapConnectionConfig{}}}, so the connection is always plaintext (and would fail against a real LDAPS endpoint).
> This JIRA adds configurable, credential-store-integrated TLS support to both paths so Knox can expose LDAPS to clients and proxy to a secure backend LDAP server.
> +Scope:+
>  - Secure transport on the embedded server (front-end)
>  - Secure transport for the proxy backend (backend)
>  - Configuration must fit the existing {{gateway.ldap.*}} namespace and resolve secrets through the gateway credential store (AliasService) where applicable.
>  - Unit/integration test coverage for both paths.
> +Out of scope / follow-ups:+
>  - StartTLS for the backend (LDAPS only for now; StartTLS through the pooled connection factory needs a dedicated factory and can be a follow-up).
>  - Mutual TLS / client-certificate authentication.
> _Dependency note:_ Enabling client-side LDAPS requires aligning the Apache Directory API / ApacheDS server versions with the MINA 2.2.8 that Knox ships for CVE reasons (details in the backend sub-task). MINA itself is not downgraded.
> Acceptance criteria:
>  - LDAPS can be enabled for the embedded server and for the proxy backend via configuration.
>  - Certificate material and passwords are sourced from the gateway keystore/credential store (front-end) and configurable trust material (backend).
>  - Existing plaintext behavior is unchanged when the new options are disabled (default off).
>  - All existing LDAP tests continue to pass; new tests cover the secure paths.



--
This message was sent by Atlassian Jira
(v8.20.10#820010)