[jira] [Resolved] (KNOX-3389) Embedded LDAP getUserGroups drops roles-lookup roles that have no backing group

["Sandor Molnar (Jira)" <ji...@apache.org>]

     [ https://issues.apache.org/jira/browse/KNOX-3389?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Sandor Molnar resolved KNOX-3389.
---------------------------------
    Resolution: Fixed

> Embedded LDAP getUserGroups drops roles-lookup roles that have no backing group
> -------------------------------------------------------------------------------
>
>                 Key: KNOX-3389
>                 URL: https://issues.apache.org/jira/browse/KNOX-3389
>             Project: Apache Knox
>          Issue Type: Bug
>          Components: Server
>    Affects Versions: 3.0.0
>            Reporter: Sandor Molnar
>            Assignee: Sandor Molnar
>            Priority: Major
>             Fix For: 3.0.0
>
>          Time Spent: 1h
>  Remaining Estimate: 0h
>
> When the embedded Knox LDAP server has the roles lookup interceptor enabled, resolved roles are written to the user entry as memberOf values. If the user has no existing groups (so there is no template group DN to build a full DN from), {{LDAPRolesLookupInterceptor.addRoleAttribute}} stores each role as a bare RDN, e.g. {{memberOf: cn=platform:awc-admin-sam}}, with no trailing DN components.
> {{KnoxLDAPServerManager.getUserGroups}} then fails to return these as groups. It extracts the CN by taking the substring between {{cn=}} and the first comma, but a bare RDN has no comma {{(indexOf(',') returns -1)}}, so the value is silently skipped and the roles never surface as groups.
> *Repro:* embedded LDAP pointed at a demo backend whose LDIF defines users but no groups, with {{rolesLookup}} in {{gateway.ldap.interceptor.names}}. Authenticate a user (e.g. {{sam}}) whose roles resolve to {{platform:awc-admin-sam}} and {{ml-workspace-abc:viewer-sam}}. Knox resolves the roles and writes them to {{memberOf}} as {{cn=<role>}}, but {{getUserGroups("sam")}} returns an empty list.
> *Fix:* when the roles lookup interceptor is active, handle bare-RDN {{memberOf}} values by taking everything after {{cn=}}. Full DNs continue to be parsed as before, and a no-comma value without the interceptor is still skipped as unexpected data.



--
This message was sent by Atlassian Jira
(v8.20.10#820010)