Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

LDAP realm does not reload SSL context if files change #36923

Closed
tvernum opened this issue Dec 21, 2018 · 2 comments
Closed

LDAP realm does not reload SSL context if files change #36923

tvernum opened this issue Dec 21, 2018 · 2 comments
Assignees
@tvernum
Labels
>bug :Security/Authentication Logging in, Usernames/passwords, Realms (Native/LDAP/AD/SAML/PKI/etc)

Comments

@tvernum
Copy link
Contributor

tvernum commented Dec 21, 2018

Somewhere between 6.2 and 6.5 the LDAP realm behaviour changed to not reload the SSL context if the underlying file contents change (updated CA file).

The SSL Service still reloads the internal context, but the LDAP realm doesn't use it.

My guess is that this might be due to the way we changed reloading to support FIPS, but I haven't dug into it yet.
@tvernum tvernum added >bug :Security/Authentication Logging in, Usernames/passwords, Realms (Native/LDAP/AD/SAML/PKI/etc) labels Dec 21, 2018
@tvernum tvernum self-assigned this Dec 21, 2018
@elasticmachine
Copy link
Collaborator

Pinging @elastic/es-security

@tvernum
Copy link
Contributor Author

tvernum commented Dec 21, 2018

I've confirmed this is a result of the FIPS-JVM compliant reloading changes in 2b09e90

That's unfortunate, because we need to keep those changes, so I'm going to need to add some sort of notification mechanism so that the SSLService can notify the LDAP connection pool to reload its SSL context.

tvernum added a commit to tvernum/elasticsearch that referenced this issue Dec 21, 2018
@tvernum
Reload SSL context on file change for LDAP
a37bbf6 
In elastic#30509 we changed the way SSL configuration is reloaded when the
content of a file changes. As a consequence of that implementation
change the LDAP realm ceased to pick up changes to CA files (or other
certificate material) if they changed.

This commit repairs the reloading behaviour for LDAP realms, and adds
a test for this functionality.

Resolves: elastic#36923
@tvernum tvernum mentioned this issue Dec 21, 2018
Merged
tvernum added a commit that referenced this issue Dec 28, 2018
@tvernum
Reload SSL context on file change for LDAP (#36937)
51c18c0 
In #30509 we changed the way SSL configuration is reloaded when the
content of a file changes. As a consequence of that implementation
change the LDAP realm ceased to pick up changes to CA files (or other
certificate material) if they changed.

This commit repairs the reloading behaviour for LDAP realms, and adds
a test for this functionality.

Resolves: #36923
original-brownbear pushed a commit to original-brownbear/elasticsearch that referenced this issue Dec 28, 2018
@tvernum @original-brownbear
Reload SSL context on file change for LDAP (elastic#36937)
2039012 
In elastic#30509 we changed the way SSL configuration is reloaded when the
content of a file changes. As a consequence of that implementation
change the LDAP realm ceased to pick up changes to CA files (or other
certificate material) if they changed.

This commit repairs the reloading behaviour for LDAP realms, and adds
a test for this functionality.

Resolves: elastic#36923
tvernum added a commit that referenced this issue Jan 4, 2019
@tvernum
Reload SSL context on file change for LDAP (#36937)
0234fa8 
In #30509 we changed the way SSL configuration is reloaded when the
content of a file changes. As a consequence of that implementation
change the LDAP realm ceased to pick up changes to CA files (or other
certificate material) if they changed.

This commit repairs the reloading behaviour for LDAP realms, and adds
a test for this functionality.

Resolves: #36923
tvernum added a commit that referenced this issue Jan 4, 2019
@tvernum
Reload SSL context on file change for LDAP (#36937)
27a1725 
In #30509 we changed the way SSL configuration is reloaded when the
content of a file changes. As a consequence of that implementation
change the LDAP realm ceased to pick up changes to CA files (or other
certificate material) if they changed.

This commit repairs the reloading behaviour for LDAP realms, and adds
a test for this functionality.

Resolves: #36923
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@tvernum tvernum

Labels
>bug :Security/Authentication Logging in, Usernames/passwords, Realms (Native/LDAP/AD/SAML/PKI/etc)
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
2 participants
@tvernum @elasticmachine