[jira] [Work logged] (KNOX-3397) Remove index suffix from actor groups header explicitly in AbstractAuthResource

["ASF GitHub Bot (Jira)" <ji...@apache.org>]

     [ https://issues.apache.org/jira/browse/KNOX-3397?focusedWorklogId=1032359&page=com.atlassian.jira.plugin.system.issuetabpanels:worklog-tabpanel#worklog-1032359 ]

ASF GitHub Bot logged work on KNOX-3397:
----------------------------------------

                Author: ASF GitHub Bot
            Created on: 27/Jul/26 08:36
            Start Date: 27/Jul/26 08:36
    Worklog Time Spent: 10m 
      Work Description: smolnar82 opened a new pull request, #1329:
URL: https://github.com/apache/knox/pull/1329

   [KNOX-3397](https://issues.apache.org/jira/browse/KNOX-3397) - Allow the actor groups header name to be configured explicitly
   
   ## What changes were proposed in this pull request?
   
   [KNOX-3354](https://issues.apache.org/jira/browse/KNOX-3354) removed the index suffix from the actor groups header when roles are resolved at the resource layer (rather than in the LDAP interceptors), so that the configured actor groups header is not postfixed. This is useful in environments where role lookup is configured locally.
   
   However, a topology may instead use the RemoteAuthFilter to authenticate requests, where the remote counterpart is configured for role lookup. In that case remote.auth.group.header returns roles rather than groups, but the `KNOX-AUTH-SERVICE` configured in the topology still emits the suffixed version of `preauth.auth.header.actor.groups.prefix`, causing a mismatch.
   
   To give operators explicit control over this, this PR introduces a new configuration parameter in AbstractAuthResource: `preauth.auth.header.actor.groups`. When declared, it takes precedence over the existing `preauth.auth.header.actor.groups.prefix` parameter and is used directly as the groups header name in the response, without any index suffix.
   
   When the new parameter is not set, behavior is unchanged (fully backward compatible). The header-name selection logic was also extracted into a small private `createGroupsHeaderName(...)` helper for readability.
   
   ## How was this patch tested?
   
   - Added a unit test (PreAuthResourceTest#testExplicitGroupsHeaderTakesPrecedenceOverPrefix) that configures both the explicit header and a prefix, and verifies the explicit header is emitted directly, exactly once, with no index suffix.
   - Ran the full PreAuthResourceTest suite: Tests run: 9, Failures: 0, Errors: 0, Skipped: 0.
   
   ## Integration Tests
   N/A
   
   ## UI changes
   N/A




Issue Time Tracking
-------------------

            Worklog Id:     (was: 1032359)
    Remaining Estimate: 0h
            Time Spent: 10m

> Remove index suffix from actor groups header explicitly in AbstractAuthResource
> -------------------------------------------------------------------------------
>
>                 Key: KNOX-3397
>                 URL: https://issues.apache.org/jira/browse/KNOX-3397
>             Project: Apache Knox
>          Issue Type: Bug
>          Components: Server
>    Affects Versions: 3.0.0
>            Reporter: Sandor Molnar
>            Assignee: Sandor Molnar
>            Priority: Major
>             Fix For: 3.0.0
>
>          Time Spent: 10m
>  Remaining Estimate: 0h
>
> h3. Background
> KNOX-3354 introduced a change in {{AbstractAuthResource}} that removes the index suffix from the actor groups header when roles are resolved. Specifically, when role lookup happens at the resource layer (rather than in the LDAP interceptors), the configured actor groups header is no longer postfixed. This is useful in environments where role lookup is configured locally.
> h3. Problem
> A topology may instead use the {{RemoteAuthFilter}} to authenticate requests, where the remote counterpart is configured for role lookup. In that case, {{remote.auth.group.header}} returns roles rather than groups. However, the {{KNOX-AUTH-SERVICE}} configured in the topology still emits the suffixed version of {{preauth.auth.header.actor.groups.prefix}}, causing a mismatch.
> h3. Proposed change
> To give operators explicit control over this behavior, we introduce a new configuration parameter:
> {{preauth.auth.header.actor.groups}}
> When this parameter is declared, it takes precedence over the existing {{preauth.auth.header.actor.groups.prefix}} parameter and is used directly as the groups header in the response (without any suffix).



--
This message was sent by Atlassian Jira
(v8.20.10#820010)