You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@knox.apache.org by "hanicz (via GitHub)" <gi...@apache.org> on 2026/07/08 08:28:58 UTC

[PR] KNOX-3374: Fix inherited roles missing from auth headers when LDAP ro… [knox]

hanicz opened a new pull request, #1300:
URL: https://github.com/apache/knox/pull/1300

   …les-lookup interceptor is active
   
   [KNOX-3374](https://issues.apache.org/jira/browse/KNOX-3374) - Inherited roles missing from auth headers when LDAP roles-lookup interceptor is active
   
   ## What changes were proposed in this pull request?
   
   - `KnoxLDAPServerManager.getUserGroups()` now attaches a `RolesLookupBypassControl` to its LDAP search, so it returns raw group names instead of interceptor-rewritten role names.
   - Eliminates a double roles-lookup: `LDAPRolesLookupInterceptor` was rewriting memberOf to roles, and `AbstractAuthResource` then called the roles API again with those roles-as-groups — which returned only the user's direct roles, dropping inherited ones.
   - External LDAP-proxy clients are unaffected; the interceptor still rewrites memberOf on their searches.
   - New `KnoxLDAPServerManagerTest#testGetUserGroupsReturnsRawGroupsEvenWhenRolesInterceptorRewritesMemberOf` — installs the real roles interceptor over a test entries interceptor serving a user with memberOf group DNs; asserts getUserGroups returns raw group names, not the mocked roles.
   
   ## How was this patch tested?
   
   Unit tests
   E2Etests:
   
   Without changes:
   ```
   ldapsearch -x -H ldap://localhost:10389 \
     -D "uid=admin,ou=people,dc=hadoop,dc=apache,dc=org" -w admin-password \
     -b "dc=hadoop,dc=apache,dc=org" "(uid=admin)" memberOf
   
   # admin, people, hadoop.apache.org
   dn: uid=admin,ou=people,dc=hadoop,dc=apache,dc=org
   memberOf: cn=ws-1:viewer,ou=groups,ou=groups,dc=hadoop,dc=apache,dc=org
   memberOf: cn=ws-2:user,ou=groups,ou=groups,dc=hadoop,dc=apache,dc=org
   ```
   
   ```
   curl -kvs -u admin:admin-password \
     https://localhost:8443/gateway/sandbox/auth/api/v1/extauthz/anything
   
   < username: admin
   < roles: console:admin
   ```
   
   With the fix:
   ```
   ldapsearch -x -H ldap://localhost:10389 \
     -D "uid=admin,ou=people,dc=hadoop,dc=apache,dc=org" -w admin-password \
     -b "dc=hadoop,dc=apache,dc=org" "(uid=admin)" memberOf
   
   # admin, people, hadoop.apache.org
   dn: uid=admin,ou=people,dc=hadoop,dc=apache,dc=org
   memberOf: cn=ws-1:viewer,ou=groups,ou=groups,dc=hadoop,dc=apache,dc=org
   memberOf: cn=ws-2:user,ou=groups,ou=groups,dc=hadoop,dc=apache,dc=org
   ```
   
   ```
   curl -kvs -u admin:admin-password \
     https://localhost:8443/gateway/sandbox/auth/api/v1/extauthz/anything
   
   < username: admin
   < roles: ws-1:viewer,console:admin,ws-2:user
   ```
   
   ## Integration Tests
   N/A
   
   ## UI changes
   N/A
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: dev-unsubscribe@knox.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] KNOX-3374: Fix inherited roles missing from auth headers when LDAP ro… [knox]

Posted by "hanicz (via GitHub)" <gi...@apache.org>.
hanicz merged PR #1300:
URL: https://github.com/apache/knox/pull/1300


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: dev-unsubscribe@knox.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] KNOX-3374: Fix inherited roles missing from auth headers when LDAP ro… [knox]

Posted by "github-actions[bot] (via GitHub)" <gi...@apache.org>.
github-actions[bot] commented on PR #1300:
URL: https://github.com/apache/knox/pull/1300#issuecomment-4912916631

   ## Test Results
   32 tests   32 ✅  3s ⏱️
    1 suites   0 💤
    1 files     0 ❌
   
   Results for commit b4dfa93c.
   
   [test-results]:data:application/gzip;base64,H4sIALsLTmoC/12Myw6DIBQFf8Ww7gKKgPRnGp7JTVUaHqum/160SrW7M3OSeSEPo0vo1pFLh1KB3MCWqDKEuSKtWI+8XPS6wz0VY/7MA57V4Ca8gvEkXIwhbiaWuRWXfQp+xa+38iG38rFmwjRBroB0b72S1AxWau7wYJlmRhHPJJdCEeEFs7jnGL0/t38nZP8AAAA=
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: dev-unsubscribe@knox.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] KNOX-3374: Fix inherited roles missing from auth headers when LDAP ro… [knox]

Posted by "handavid (via GitHub)" <gi...@apache.org>.
handavid commented on PR #1300:
URL: https://github.com/apache/knox/pull/1300#issuecomment-4917633522

   @hanicz I'm not sure this is the right approach. If the Subject in the `AbstractAuthResource` already has the correct roles, then I think it makes more sense to remove the role lookup from there instead. This change confuses the issue of whether the LDAP Proxy will return groups or roles. This hard-codes the `getUserGroups` method to return groups even if the configuration includes the roles lookup interceptor.


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: dev-unsubscribe@knox.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org