Sandor Molnar created KNOX-3513:
-----------------------------------
Summary: Retry unresolved credential-store aliases for LDAP proxy
backend passwords
Key: KNOX-3513
URL: https://issues.apache.org/jira/browse/KNOX-3513
Project: Apache Knox
Issue Type: Improvement
Components: Server
Affects Versions: 3.1.0
Reporter: Sandor Molnar
Assignee: Sandor Molnar
Fix For: 3.1.0
Since KNOX-3497, {{KnoxLDAPServerManager#resolveBackendPasswordAliases}}
resolves {{S\{ALIAS=…} / ${ALIAS=…}}} in {{{}bindPassword{}}},
{{systemPassword}} and {{trustStorePassword}} exactly once, when the
interceptors are built. If the alias isn't in the gateway credential store yet,
Knox logs "{{{}No value found in the gateway credential store for alias …",{}}}
keeps the raw reference, and backend binds fail with {{INVALID_CREDENTIALS}}
until something triggers a reload.
This happens in Kubernetes when the Secret and the CR are created together and
Knox is already running. Knox reloads the CR 1–10s after it's synced, but the
operator persists the alias about 4–5s after the Secret is created. So Knox
often looks up the alias before it exists, and nothing makes it look again.
*Proposal*
When an alias lookup returns null, retry it with a cap instead of giving up
after the first attempt:
* Configurable in {{gateway-site.xml.}} Suggested defaults: 5 attempts, 2s
delay.
* Each retry must read the current credential store, not a cached negative
result.
* Log each retry at {{{}WARN{}}}. Log {{ERROR}} only after the last attempt
fails, then fall back to today's behaviour.
* Retries *must not block* gateway startup or reloads of other interceptors.
* Literal (non-alias) values are unchanged.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
