[
https://issues.apache.org/jira/browse/FLINK-37764?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Purshotam Shah updated FLINK-37764:
-----------------------------------
Description:
Thought for a couple of seconds
*Jira Description*
*Background*
Currently, SSLUtils only supports the built-in FingerprintTrustManagerFactory
or the default JDK TrustManagerFactory. We need to allow users to plug in their
own {{TrustManagerFactory}} implementation—so they can load a custom
truststore, perform additional (in our case, enforce specific CN-name
validation)
*Requirements*
# Introduce a new config option:
{{security.ssl.trustmanager.factory.class}}
– Type: {{String}} (fully-qualified class name)
– No default value (optional)
– When set, Flink must:
*
** Instantiate this class via its no-arg constructor
*
** Call {{init(trustStore)}} on it, passing in the configured keystore
# The user’s custom class *must* extend {{javax.net.ssl.TrustManagerFactory}}
and in its implementation:
*
** Load the configured truststore
*
** Perform any custom SSL certificate verification
*
** Enforce CN-name checks to ensure only the specified Common Names are
accepted
# Fallback behavior when the option is *not* set:
*
** If {{ssl.*.cert-fingerprint}} is configured → use
{{FingerprintTrustManagerFactory}}
*
** Else → use the JVM’s default {{TrustManagerFactory}}
was:
Thought for a couple of seconds
*Jira Description*
*Background*
Currently, SSLUtils only supports the built-in FingerprintTrustManagerFactory
or the default JDK TrustManagerFactory. We need to allow users to plug in their
own {{TrustManagerFactory}} implementation—so they can load a custom
truststore, perform additional (in our case, enforce specific CN-name
validation)
*Requirements*
# Introduce a new config option:
{{security.ssl.trustmanager.factory.class}}
– Type: {{String}} (fully-qualified class name)
– No default value (optional)
– When set, Flink must:
** Instantiate this class via its no-arg constructor
** Call {{init(trustStore)}} on it, passing in the configured keystore
** Use it in place of the built-in fingerprint/Athenz/default logic
# The user’s custom class *must* extend {{javax.net.ssl.TrustManagerFactory}}
and in its implementation:
** Load the configured truststore
** Perform any custom SSL certificate verification
** Enforce CN-name checks to ensure only the specified Common Names are
accepted
# Fallback behavior when the option is *not* set:
** If {{ssl.*.cert-fingerprint}} is configured → use
{{FingerprintTrustManagerFactory}}
** Else → use the JVM’s default {{TrustManagerFactory}}
> Add support for configurable custom TrustManagerFactory in SSLUtils
> -------------------------------------------------------------------
>
> Key: FLINK-37764
> URL: https://issues.apache.org/jira/browse/FLINK-37764
> Project: Flink
> Issue Type: Improvement
> Reporter: Purshotam Shah
> Priority: Major
>
> Thought for a couple of seconds
> *Jira Description*
> *Background*
> Currently, SSLUtils only supports the built-in FingerprintTrustManagerFactory
> or the default JDK TrustManagerFactory. We need to allow users to plug in
> their own {{TrustManagerFactory}} implementation—so they can load a custom
> truststore, perform additional (in our case, enforce specific CN-name
> validation)
> *Requirements*
> # Introduce a new config option:
> {{security.ssl.trustmanager.factory.class}}
> – Type: {{String}} (fully-qualified class name)
> – No default value (optional)
> – When set, Flink must:
> *
> ** Instantiate this class via its no-arg constructor
> *
> ** Call {{init(trustStore)}} on it, passing in the configured keystore
> # The user’s custom class *must* extend
> {{javax.net.ssl.TrustManagerFactory}} and in its implementation:
> *
> ** Load the configured truststore
> *
> ** Perform any custom SSL certificate verification
> *
> ** Enforce CN-name checks to ensure only the specified Common Names are
> accepted
> # Fallback behavior when the option is *not* set:
> *
> ** If {{ssl.*.cert-fingerprint}} is configured → use
> {{FingerprintTrustManagerFactory}}
> *
> ** Else → use the JVM’s default {{TrustManagerFactory}}
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
