[jira] [Commented] (KNOX-3378) Expose a secure (LDAPS) transport on the embedded Knox LDAP server

["ASF subversion and git services (Jira)" <ji...@apache.org>]

    [ https://issues.apache.org/jira/browse/KNOX-3378?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18096414#comment-18096414 ] 

ASF subversion and git services commented on KNOX-3378:
-------------------------------------------------------

Commit ad6c15958ba2ba3e78a5fd5225a43327003fa288 in knox's branch refs/heads/master from Sandor Molnar
[ https://gitbox.apache.org/repos/asf?p=knox.git;h=ad6c15958 ]

KNOX-3377: KNOX-3378: KNOX-3379: Support secure LDAP (LDAPS) for the Knox embedded LDAP service (#1305)

> Expose a secure (LDAPS) transport on the embedded Knox LDAP server
> ------------------------------------------------------------------
>
>                 Key: KNOX-3378
>                 URL: https://issues.apache.org/jira/browse/KNOX-3378
>             Project: Apache Knox
>          Issue Type: Sub-task
>          Components: Server
>    Affects Versions: 3.0.0
>            Reporter: Sandor Molnar
>            Assignee: Sandor Molnar
>            Priority: Critical
>             Fix For: 3.0.0
>
>
> Add an optional TLS transport to the embedded ApacheDS server managed by {{{}KnoxLDAPServerManager{}}}, so external clients can connect over LDAPS instead of plaintext LDAP.
> +Changes:+
>  - New configuration keys (defaults keep current behavior):
>  - gateway.ldap.ssl.enabled - enable LDAPS (default false).
>  - {{gateway.ldap.ssl.keystore.path}} - keystore holding the server certificate; defaults to the gateway identity keystore (getIdentityKeystorePath()).
>  - {{gateway.ldap.ssl.keystore.password.alias}} - credential-store alias for the keystore password; defaults to the gateway identity keystore password.
>  - {{gateway.ldap.ssl.enabled.cipher.suites}} - optional TLS cipher-suite allowlist.
>  - {{KnoxLDAPServerManager}} enables SSL on the {{TcpTransport}} and sets the keystore file + certificate password on the LdapServer.
>  - Keystore password resolved via {{AliasService}} (consistent with existing bind-password handling); falls back to the gateway identity keystore password when no dedicated alias is set.
>  - Fail fast at startup with a clear message when SSL is enabled but no keystore is available.
> +Notes/constraints:+
>  - ApacheDS loads the keystore using the JVM default keystore type, so the configured keystore must be in that format.
> +Acceptance criteria:+
>  - With SSL enabled, the server completes a TLS handshake presenting the configured certificate.
>  - Plaintext access to the secure port is rejected.
>  - Anonymous/plaintext behavior is unchanged when {{{}gateway.ldap.ssl.enabled=false{}}}.
>  - Unit tests cover: successful TLS handshake with the configured cert, plaintext rejection, and missing-keystore startup failure.



--
This message was sent by Atlassian Jira
(v8.20.10#820010)