This is an automated email from the ASF dual-hosted git repository.
smolnar82 pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/knox.git
The following commit(s) were added to refs/heads/master by this push:
new 33df7d5da KNOX-3330: Refactor LDAP Proxy configuration to support
multiple backends (#1240)
33df7d5da is described below
commit 33df7d5da5faf02728a587953fbddaec494ef220
Author: David Han <[email protected]>
AuthorDate: Mon Jun 8 05:30:24 2026 -0500
KNOX-3330: Refactor LDAP Proxy configuration to support multiple backends
(#1240)
---
.github/workflows/build/gateway-site.xml | 30 ++--
.../gateway/config/impl/GatewayConfigImpl.java | 8 +-
.../services/ldap/KnoxLDAPServerManager.java | 185 +++++++++++++------
.../knox/gateway/services/ldap/LdapMessages.java | 26 ++-
.../services/ldap/backend/BackendFactory.java | 23 ++-
.../gateway/services/ldap/backend/FileBackend.java | 27 ++-
.../services/ldap/backend/FileBackendFactory.java | 32 ++++
.../gateway/services/ldap/backend/LdapBackend.java | 14 +-
.../services/ldap/backend/LdapBackendFactory.java | 25 +++
.../services/ldap/backend/LdapProxyBackend.java | 32 ++--
.../ldap/backend/LdapProxyBackendFactory.java | 32 ++++
.../DuplicateUserFilteringInterceptor.java | 87 +++++++++
.../DuplicateUserFilteringInterceptorFactory.java | 36 ++++
.../ldap/interceptor/InterceptorFactory.java | 59 ++++++
.../interceptor/KnoxLdapInterceptorFactory.java | 41 +++++
.../UserSearchInterceptor.java} | 79 ++++----
.../interceptor/UserSearchInterceptorFactory.java | 36 ++++
.../java/org/apache/knox/gateway/util/KnoxCLI.java | 1 +
...teway.services.ldap.backend.LdapBackendFactory} | 6 +-
...es.ldap.interceptor.KnoxLdapInterceptorFactory} | 6 +-
.../src/main/resources/conf/gateway-site.xml | 113 ++++++++----
.../services/ldap/KnoxLDAPServerManagerTest.java | 198 ++++++++++++++++++---
.../gateway/services/ldap/KnoxLDAPServiceTest.java | 7 +-
.../services/ldap/backend/BackendFactoryTest.java | 47 +++--
.../ldap/backend/LdapProxyBackendTest.java | 63 +++----
.../DuplicateUserFilteringInterceptorTest.java | 166 +++++++++++++++++
.../org/apache/knox/gateway/GatewayTestConfig.java | 6 +-
.../apache/knox/gateway/config/GatewayConfig.java | 18 +-
knox-site/docs/service_ldap_server.md | 125 +++++++++----
29 files changed, 1223 insertions(+), 305 deletions(-)
diff --git a/.github/workflows/build/gateway-site.xml
b/.github/workflows/build/gateway-site.xml
index d8c1bbbd1..8f35a939f 100644
--- a/.github/workflows/build/gateway-site.xml
+++ b/.github/workflows/build/gateway-site.xml
@@ -145,42 +145,50 @@ limitations under the License.
<name>gateway.ldap.base.dn</name>
<value>dc=hadoop,dc=apache,dc=org</value>
</property>
- <property>
- <name>gateway.ldap.backend.type</name>
- <value>ldap</value>
- </property>
<property>
<name>gateway.ldap.recursive.group.resolution</name>
<value>true</value>
</property>
+ <property>
+ <name>gateway.ldap.interceptor.names</name>
+ <value>demoldap</value>
+ </property>
<!-- LDAP Backend specific configuration (proxying to demo ldap) -->
<property>
- <name>gateway.ldap.backend.ldap.url</name>
+ <name>gateway.ldap.interceptor.demoldap.interceptorType</name>
+ <value>backend</value>
+ </property>
+ <property>
+ <name>gateway.ldap.interceptor.demoldap.backendType</name>
+ <value>ldap</value>
+ </property>
+ <property>
+ <name>gateway.ldap.interceptor.demoldap.url</name>
<value>ldap://ldap:33389</value>
</property>
<property>
- <name>gateway.ldap.backend.ldap.remoteBaseDn</name>
+ <name>gateway.ldap.interceptor.demoldap.remoteBaseDn</name>
<value>dc=hadoop,dc=apache,dc=org</value>
</property>
<property>
- <name>gateway.ldap.backend.ldap.systemUsername</name>
+ <name>gateway.ldap.interceptor.demoldap.systemUsername</name>
<value>uid=guest,ou=people,dc=hadoop,dc=apache,dc=org</value>
</property>
<property>
- <name>gateway.ldap.backend.ldap.systemPassword</name>
+ <name>gateway.ldap.interceptor.demoldap.systemPassword</name>
<value>guest-password</value>
</property>
<property>
- <name>gateway.ldap.backend.ldap.userSearchBase</name>
+ <name>gateway.ldap.interceptor.demoldap.userSearchBase</name>
<value>ou=people,dc=hadoop,dc=apache,dc=org</value>
</property>
<property>
- <name>gateway.ldap.backend.ldap.groupSearchBase</name>
+ <name>gateway.ldap.interceptor.demoldap.groupSearchBase</name>
<value>ou=groups,dc=hadoop,dc=apache,dc=org</value>
</property>
<property>
- <name>gateway.ldap.backend.ldap.groupMemberAttribute</name>
+ <name>gateway.ldap.interceptor.demoldap.groupMemberAttribute</name>
<value>member</value>
</property>
diff --git
a/gateway-server/src/main/java/org/apache/knox/gateway/config/impl/GatewayConfigImpl.java
b/gateway-server/src/main/java/org/apache/knox/gateway/config/impl/GatewayConfigImpl.java
index eb3f9f227..995fa81be 100644
---
a/gateway-server/src/main/java/org/apache/knox/gateway/config/impl/GatewayConfigImpl.java
+++
b/gateway-server/src/main/java/org/apache/knox/gateway/config/impl/GatewayConfigImpl.java
@@ -1754,8 +1754,8 @@ public class GatewayConfigImpl extends Configuration
implements GatewayConfig {
}
@Override
- public String getLDAPBackendType() {
- return get(LDAP_BACKEND_TYPE, "file");
+ public List<String> getLDAPInterceptorNames() {
+ return splitConfigValueToList(LDAP_INTERCEPTOR_NAMES);
}
@Override
@@ -1782,9 +1782,9 @@ public class GatewayConfigImpl extends Configuration
implements GatewayConfig {
}
@Override
- public Map<String, String> getLDAPBackendConfig(String backendType) {
+ public Map<String, String> getLDAPInterceptorConfig(String interceptorName) {
Map<String, String> config = new HashMap<>();
- String prefix = "gateway.ldap.backend." + backendType + ".";
+ String prefix = "gateway.ldap.interceptor." + interceptorName + ".";
for (String key : getPropertyNames()) {
if (key != null && key.startsWith(prefix)) {
diff --git
a/gateway-server/src/main/java/org/apache/knox/gateway/services/ldap/KnoxLDAPServerManager.java
b/gateway-server/src/main/java/org/apache/knox/gateway/services/ldap/KnoxLDAPServerManager.java
index eebf9251e..ff4edb20e 100644
---
a/gateway-server/src/main/java/org/apache/knox/gateway/services/ldap/KnoxLDAPServerManager.java
+++
b/gateway-server/src/main/java/org/apache/knox/gateway/services/ldap/KnoxLDAPServerManager.java
@@ -17,12 +17,22 @@
*/
package org.apache.knox.gateway.services.ldap;
+import com.google.common.annotations.VisibleForTesting;
+import org.apache.commons.lang3.StringUtils;
+import org.apache.directory.api.ldap.model.cursor.Cursor;
+import org.apache.directory.api.ldap.model.entry.Attribute;
import org.apache.directory.api.ldap.model.entry.DefaultEntry;
import org.apache.directory.api.ldap.model.entry.Entry;
+import org.apache.directory.api.ldap.model.entry.Value;
+import org.apache.directory.api.ldap.model.exception.LdapException;
+import org.apache.directory.api.ldap.model.message.SearchRequest;
+import org.apache.directory.api.ldap.model.message.SearchRequestImpl;
+import org.apache.directory.api.ldap.model.message.SearchScope;
import org.apache.directory.api.ldap.model.name.Dn;
import org.apache.directory.api.ldap.model.schema.SchemaManager;
import org.apache.directory.server.core.DefaultDirectoryService;
import org.apache.directory.server.core.api.DirectoryService;
+import org.apache.directory.server.core.api.DnFactory;
import org.apache.directory.server.core.api.InstanceLayout;
import org.apache.directory.server.core.api.interceptor.Interceptor;
import org.apache.directory.server.core.api.schema.SchemaPartition;
@@ -32,13 +42,16 @@ import org.apache.directory.server.ldap.LdapServer;
import org.apache.directory.server.protocol.shared.transport.TcpTransport;
import org.apache.knox.gateway.config.GatewayConfig;
import org.apache.knox.gateway.i18n.messages.MessagesFactory;
-import org.apache.knox.gateway.services.ldap.backend.BackendFactory;
-import org.apache.knox.gateway.services.ldap.backend.LdapBackend;
+import org.apache.knox.gateway.services.ldap.interceptor.InterceptorFactory;
import java.io.File;
import java.util.ArrayList;
+import java.util.Collection;
+import java.util.HashSet;
import java.util.List;
+import java.util.Locale;
import java.util.Map;
+import java.util.Set;
/**
* Manages the ApacheDS LDAP server instance with pluggable backends
@@ -46,13 +59,16 @@ import java.util.Map;
public class KnoxLDAPServerManager {
private static final LdapMessages LOG =
MessagesFactory.get(LdapMessages.class);
- private DirectoryService directoryService;
+ @VisibleForTesting
+ DirectoryService directoryService;
private LdapServer ldapServer;
- private LdapBackend backend;
+ private GatewayConfig gatewayConfig;
+ private List<Interceptor> interceptors;
private File workDir;
private int port;
private String baseDn;
- private String remoteBaseDn;
+ // Collection of DNs for the proxied backend LDAP servers
+ private Set<String> baseDns;
/**
* Initialize the LDAP server with the given configuration
@@ -60,6 +76,8 @@ public class KnoxLDAPServerManager {
* @param config Gateway configuration
*/
public void initialize(GatewayConfig config) throws Exception {
+ this.gatewayConfig = config;
+
// Prepare work directory for LDAP data
File gatewayDataDir = new File(config.getGatewayDataDir());
this.workDir = new File(gatewayDataDir, "ldap-server");
@@ -67,27 +85,8 @@ public class KnoxLDAPServerManager {
// Get configuration
this.port = config.getLDAPPort();
this.baseDn = config.getLDAPBaseDN();
- String backendType = config.getLDAPBackendType();
-
- // Get backend-specific configuration using prefixed properties
- Map<String, String> backendConfig =
config.getLDAPBackendConfig(backendType);
-
- // Add common configuration
- backendConfig.put("baseDn", baseDn);
-
- // Add legacy dataFile property for backwards compatibility with file
backend
- if ("file".equalsIgnoreCase(backendType) &&
!backendConfig.containsKey("dataFile")) {
- backendConfig.put("dataFile", config.getLDAPBackendDataFile());
- }
-
- backendConfig.put("recursiveGroupResolution",
String.valueOf(config.isLDAPRecursiveGroupResolutionEnabled()));
- backendConfig.put("recursiveGroupResolutionMaxDepth",
String.valueOf(config.getLDAPRecursiveGroupResolutionMaxDepth()));
- // For proxy backends, extract remoteBaseDn if present
- this.remoteBaseDn = backendConfig.get("remoteBaseDn");
-
- // Initialize backend
- backend = BackendFactory.createBackend(backendType, backendConfig);
+ this.interceptors = createInterceptors(config);
// Clean up previous run if it didn't shut down cleanly
File lockFile = new File(workDir, "run/instance.lock");
@@ -99,6 +98,34 @@ public class KnoxLDAPServerManager {
workDir.mkdirs();
}
+ private List<Interceptor> createInterceptors(GatewayConfig config) throws
Exception {
+ List<String> interceptorNames = config.getLDAPInterceptorNames();
+ List<Interceptor> interceptors = new
ArrayList<>(interceptorNames.size());
+ for (String interceptorName : interceptorNames) {
+ // Get backend-specific configuration using prefixed properties
+ Map<String, String> interceptorConfig =
config.getLDAPInterceptorConfig(interceptorName);
+
+ // Add common configuration
+ interceptorConfig.put("baseDn", baseDn);
+
+ // Add common LDAP Proxy configurations to backends
+ String interceptorType = interceptorConfig.get("interceptorType");
+ String backendType = interceptorConfig.get("backendType");
+ if ("backend".equalsIgnoreCase(interceptorType)) {
+ interceptorConfig.put("recursiveGroupResolution",
String.valueOf(config.isLDAPRecursiveGroupResolutionEnabled()));
+ interceptorConfig.put("recursiveGroupResolutionMaxDepth",
String.valueOf(config.getLDAPRecursiveGroupResolutionMaxDepth()));
+ if ("file".equalsIgnoreCase(backendType) &&
+ !interceptorConfig.containsKey("dataFile")) {
+ // Add legacy dataFile property for backwards
compatibility with file backend
+ interceptorConfig.put("dataFile",
config.getLDAPBackendDataFile());
+ }
+ }
+
+
interceptors.add(InterceptorFactory.createInterceptor(interceptorName,
interceptorConfig));
+ }
+ return interceptors;
+ }
+
/**
* Start the LDAP server
*/
@@ -134,17 +161,11 @@ public class KnoxLDAPServerManager {
partition.setPartitionPath(new File(workDir, "proxy").toURI());
directoryService.addPartition(partition);
- // Create partition for remote base DN if different from proxy base DN
- // This allows backend entries with remote DNs to be returned in
search results
- if (remoteBaseDn != null && !remoteBaseDn.equals(baseDn)) {
- JdbmPartition remotePartition = new JdbmPartition(schemaManager,
directoryService.getDnFactory());
- remotePartition.setId("remote");
- remotePartition.setSuffixDn(new Dn(schemaManager, remoteBaseDn));
- remotePartition.setPartitionPath(new File(workDir,
"remote").toURI());
- directoryService.addPartition(remotePartition);
- }
+ baseDns = new HashSet<>();
+ baseDns.add(baseDn);
+ addRemotePartitions();
- addGroupLookupInterceptor();
+ addInterceptors();
// Allow anonymous access
directoryService.setAllowAnonymousAccess(true);
@@ -152,8 +173,8 @@ public class KnoxLDAPServerManager {
// Start the service
directoryService.startup();
- // Add base entries to the partition
- createBaseEntries(schemaManager);
+ // Add base entries to the partitions
+ createBaseEntries(baseDns, schemaManager);
// Create LDAP server on configured port
ldapServer = new LdapServer();
@@ -165,25 +186,51 @@ public class KnoxLDAPServerManager {
LOG.ldapServiceStarted(port);
}
- private void addGroupLookupInterceptor() {
- // Add our interceptor for group lookups and bind proxying
- // We need to insert it before AuthenticationInterceptor to intercept
bind requests
- final List<Interceptor> interceptors = new
ArrayList<>(directoryService.getInterceptors());
+ private void addRemotePartitions() throws LdapException {
+ SchemaManager schemaManager = directoryService.getSchemaManager();
+ DnFactory dnFactory = directoryService.getDnFactory();
+ List<String> interceptorNames =
gatewayConfig.getLDAPInterceptorNames();
+ for (String interceptorName : interceptorNames) {
+ // Get backend-specific configuration using prefixed properties
+ Map<String, String> interceptorConfig =
gatewayConfig.getLDAPInterceptorConfig(interceptorName);
+
+ String remoteBaseDn = interceptorConfig.get("remoteBaseDn");
+ if (StringUtils.isNotBlank(remoteBaseDn)) {
+ if (!baseDns.contains(remoteBaseDn)) {
+ //create partition
+ String id = interceptorName.replaceAll("\\s+", "");
+ JdbmPartition remotePartition = new
JdbmPartition(schemaManager, dnFactory);
+ remotePartition.setId(id);
+ remotePartition.setSuffixDn(new Dn(schemaManager,
remoteBaseDn));
+ remotePartition.setPartitionPath(new File(workDir,
id).toURI());
+ directoryService.addPartition(remotePartition);
+ baseDns.add(remoteBaseDn);
+ }
+ }
+ }
+ }
+
+ private void addInterceptors() throws LdapException {
+ // Find location of AuthenticationInterceptor.
+ // We need to insert interceptors before AuthenticationInterceptor to
intercept bind requests
+ final List<Interceptor> dsInterceptors = new
ArrayList<>(directoryService.getInterceptors());
int authIdx = -1;
- for (int i = 0; i < interceptors.size(); i++) {
- if
(interceptors.get(i).getName().equalsIgnoreCase("authenticationInterceptor")) {
+ for (int i = 0; i < dsInterceptors.size(); i++) {
+ if
(dsInterceptors.get(i).getName().equalsIgnoreCase("authenticationInterceptor"))
{
authIdx = i;
break;
}
}
- final GroupLookupInterceptor interceptor = new
GroupLookupInterceptor(directoryService, backend);
- if (authIdx != -1) {
- interceptors.add(authIdx, interceptor);
- } else {
- interceptors.add(interceptor);
+ // Add our configured interceptors for group lookups and bind proxying
+ for (Interceptor interceptor : interceptors) {
+ if (authIdx != -1) {
+ dsInterceptors.add(authIdx, interceptor);
+ } else {
+ dsInterceptors.add(interceptor);
+ }
}
- directoryService.setInterceptors(interceptors);
+ directoryService.setInterceptors(dsInterceptors);
}
/**
@@ -195,6 +242,7 @@ public class KnoxLDAPServerManager {
if (ldapServer != null) {
try {
ldapServer.stop();
+ ldapServer = null;
} catch (Exception e) {
LOG.ldapServiceStopFailed(e);
}
@@ -203,6 +251,7 @@ public class KnoxLDAPServerManager {
if (directoryService != null) {
try {
directoryService.shutdown();
+ directoryService = null;
} catch (Exception e) {
LOG.ldapServiceStopFailed(e);
}
@@ -211,13 +260,10 @@ public class KnoxLDAPServerManager {
LOG.ldapServiceStopped();
}
- private void createBaseEntries(SchemaManager schemaManager) throws
Exception {
- // Create base entries for proxy base DN
- createBaseEntriesForDn(schemaManager, baseDn);
-
- // Create base entries for remote base DN if different
- if (remoteBaseDn != null && !remoteBaseDn.equals(baseDn)) {
- createBaseEntriesForDn(schemaManager, remoteBaseDn);
+ private void createBaseEntries(Collection<String> baseDns, SchemaManager
schemaManager) throws Exception {
+ // Create base entries for proxy base DN and remote base DNs
+ for (String baseDn : baseDns) {
+ createBaseEntriesForDn(schemaManager, baseDn);
}
}
@@ -266,7 +312,32 @@ public class KnoxLDAPServerManager {
* @return List of group names
*/
public List<String> getUserGroups(String username) throws Exception {
- return backend.getUserGroups(username);
+ SearchRequest searchRequest = new SearchRequestImpl();
+ searchRequest.setBase(new Dn(directoryService.getSchemaManager(),
baseDn));
+ searchRequest.setScope(SearchScope.SUBTREE);
+ searchRequest.setFilter("(uid=" + username + ")");
+ searchRequest.addAttributes("*");
+
+ List<String> groups = new ArrayList<>();
+ try (Cursor<Entry> cursor =
directoryService.getAdminSession().search(searchRequest)) {
+ if (cursor.next()) {
+ Entry entry = cursor.get();
+ Attribute memberOf = entry.get("memberOf");
+ if (memberOf != null) {
+ for (Value value : memberOf) {
+ String groupDn = value.getString();
+ if
(groupDn.toLowerCase(Locale.ROOT).startsWith("cn=")) {
+ int commaIdx = groupDn.indexOf(',');
+ if (commaIdx > 0) {
+ groups.add(groupDn.substring(3, commaIdx));
+ }
+ }
+
+ }
+ }
+ }
+ }
+ return groups;
}
/**
diff --git
a/gateway-server/src/main/java/org/apache/knox/gateway/services/ldap/LdapMessages.java
b/gateway-server/src/main/java/org/apache/knox/gateway/services/ldap/LdapMessages.java
index 221e36e4d..947581247 100644
---
a/gateway-server/src/main/java/org/apache/knox/gateway/services/ldap/LdapMessages.java
+++
b/gateway-server/src/main/java/org/apache/knox/gateway/services/ldap/LdapMessages.java
@@ -49,13 +49,29 @@ public interface LdapMessages {
text = "Failed to stop LDAP service: {0}")
void ldapServiceStopFailed(@StackTrace(level = MessageLevel.DEBUG)
Exception e);
+ @Message(level = MessageLevel.ERROR,
+ text = "Interceptor type ''{0}'' for interceptor ''{1}'' not
found")
+ void ldapInterceptorNotFound(String interceptorType, String
interceptorName);
+
+ @Message(level = MessageLevel.ERROR,
+ text = "Interceptor type not found for interceptor ''{0}''")
+ void ldapInterceptorTypeNotFound(String interceptorName);
+
+ @Message(level = MessageLevel.INFO,
+ text = "Creating interceptor: {0} (via {1})")
+ void ldapInterceptorCreating(String interceptorName, String source);
+
@Message(level = MessageLevel.INFO,
text = "Loading backend: {0} (via {1})")
void ldapBackendLoading(String backendName, String source);
- @Message(level = MessageLevel.WARN,
- text = "Backend ''{0}'' not found, using FileBackend")
- void ldapBackendNotFound(String backendName);
+ @Message(level = MessageLevel.ERROR,
+ text = "Backend type ''{0}'' for backend ''{1}'' not found")
+ void ldapBackendNotFound(String backendType, String backendName);
+
+ @Message(level = MessageLevel.ERROR,
+ text = "Backend type not found for backend ''{0}''")
+ void ldapBackendTypeNotFound(String backendName);
@Message(level = MessageLevel.WARN,
text = "Data file not found: {0}, creating sample data")
@@ -73,6 +89,10 @@ public interface LdapMessages {
text = "LDAP Search: {0} | {1}")
void ldapSearch(String baseDn, String filter);
+ @Message(level = MessageLevel.ERROR,
+ text = "LDAP Search failed: {0} | {1}, {2}")
+ void ldapSearchFailed(String baseDn, String filter, @StackTrace(level =
MessageLevel.DEBUG) Exception e);
+
@Message(level = MessageLevel.DEBUG,
text = "LDAP Bind: {0}")
void ldapBind(String dn);
diff --git
a/gateway-server/src/main/java/org/apache/knox/gateway/services/ldap/backend/BackendFactory.java
b/gateway-server/src/main/java/org/apache/knox/gateway/services/ldap/backend/BackendFactory.java
index f432a6dc5..a204ac460 100644
---
a/gateway-server/src/main/java/org/apache/knox/gateway/services/ldap/backend/BackendFactory.java
+++
b/gateway-server/src/main/java/org/apache/knox/gateway/services/ldap/backend/BackendFactory.java
@@ -32,18 +32,25 @@ public class BackendFactory {
private static final LdapMessages LOG =
MessagesFactory.get(LdapMessages.class);
public static LdapBackend createBackend(String backendName, Map<String,
String> config) throws Exception {
- // Use ServiceLoader to discover all available backends (built-in and
external plugins)
- ServiceLoader<LdapBackend> loader =
ServiceLoader.load(LdapBackend.class);
- for (LdapBackend backend : loader) {
- if (backend.getName().equalsIgnoreCase(backendName)) {
- LOG.ldapBackendLoading(backend.getName(), "ServiceLoader");
- backend.initialize(config);
+ String backendType = config.get("backendType");
+ if (backendType == null) {
+ // No backend type configured found
+ LOG.ldapBackendTypeNotFound(backendName);
+ throw new IllegalArgumentException("No LDAP backend type
configured for : " + backendName);
+ }
+
+ // Use ServiceLoader to discover all available backend factories
(built-in and external plugins)
+ ServiceLoader<LdapBackendFactory> loader =
ServiceLoader.load(LdapBackendFactory.class);
+ for (LdapBackendFactory backendFactory : loader) {
+ if (backendFactory.getType().equalsIgnoreCase(backendType)) {
+ LOG.ldapBackendLoading(backendType, "ServiceLoader");
+ LdapBackend backend = backendFactory.create(backendName,
config);
return backend;
}
}
// No matching backend found
- LOG.ldapBackendNotFound(backendName);
- throw new IllegalArgumentException("No LDAP backend found for type: "
+ backendName);
+ LOG.ldapBackendNotFound(backendType, backendName);
+ throw new IllegalArgumentException("No LDAP backend factory of type "
+ backendType + " found for : " + backendName);
}
}
diff --git
a/gateway-server/src/main/java/org/apache/knox/gateway/services/ldap/backend/FileBackend.java
b/gateway-server/src/main/java/org/apache/knox/gateway/services/ldap/backend/FileBackend.java
index 9c3d96aed..8546a3acd 100644
---
a/gateway-server/src/main/java/org/apache/knox/gateway/services/ldap/backend/FileBackend.java
+++
b/gateway-server/src/main/java/org/apache/knox/gateway/services/ldap/backend/FileBackend.java
@@ -41,9 +41,12 @@ import java.util.Map;
public class FileBackend implements LdapBackend {
private static final LdapMessages LOG =
MessagesFactory.get(LdapMessages.class);
+ static final String TYPE = "file";
+
private Map<String, UserData> users = new HashMap<>();
- private String dataFile;
- private String baseDn;
+ private final String dataFile;
+ private final String baseDn;
+ private final String name;
static class UserData {
String username;
@@ -58,16 +61,26 @@ public class FileBackend implements LdapBackend {
List<UserData> users;
}
+ public FileBackend(String name, Map<String, String> config) throws
Exception {
+ this.name = name;
+ dataFile = config.getOrDefault("dataFile", "ldap-users.json");
+ baseDn = config.getOrDefault("baseDn", "dc=proxy,dc=com");
+ loadData();
+ }
+
@Override
public String getName() {
- return "file";
+ return name;
}
@Override
- public void initialize(Map<String, String> config) throws Exception {
- dataFile = config.getOrDefault("dataFile", "ldap-users.json");
- baseDn = config.getOrDefault("baseDn", "dc=proxy,dc=com");
- loadData();
+ public String getType() {
+ return TYPE;
+ }
+
+ @Override
+ public String getBaseDn() {
+ return baseDn;
}
private void loadData() throws Exception {
diff --git
a/gateway-server/src/main/java/org/apache/knox/gateway/services/ldap/backend/FileBackendFactory.java
b/gateway-server/src/main/java/org/apache/knox/gateway/services/ldap/backend/FileBackendFactory.java
new file mode 100644
index 000000000..847753940
--- /dev/null
+++
b/gateway-server/src/main/java/org/apache/knox/gateway/services/ldap/backend/FileBackendFactory.java
@@ -0,0 +1,32 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.knox.gateway.services.ldap.backend;
+
+import java.util.Map;
+
+public class FileBackendFactory implements LdapBackendFactory {
+ @Override
+ public LdapBackend create(String name, Map<String, String> config) throws
Exception {
+ return new FileBackend(name, config);
+ }
+
+ @Override
+ public String getType() {
+ return FileBackend.TYPE;
+ }
+}
diff --git
a/gateway-server/src/main/java/org/apache/knox/gateway/services/ldap/backend/LdapBackend.java
b/gateway-server/src/main/java/org/apache/knox/gateway/services/ldap/backend/LdapBackend.java
index 4c459ff26..f5cc9c75a 100644
---
a/gateway-server/src/main/java/org/apache/knox/gateway/services/ldap/backend/LdapBackend.java
+++
b/gateway-server/src/main/java/org/apache/knox/gateway/services/ldap/backend/LdapBackend.java
@@ -22,7 +22,6 @@ import org.apache.directory.api.ldap.model.name.Dn;
import org.apache.directory.api.ldap.model.schema.SchemaManager;
import java.util.List;
-import java.util.Map;
/**
* Interface for pluggable LDAP backends.
@@ -33,16 +32,21 @@ import java.util.Map;
* - REST APIs (Knox, Ranger, etc.)
*/
public interface LdapBackend {
+
/**
- * Get the name of this backend implementation
+ * Get the name of this backend
*/
String getName();
/**
- * Initialize the backend with configuration
- * @param config Configuration properties
+ * Get the type of this backend implementation
+ */
+ String getType();
+
+ /**
+ * Get the base dn of this backend
*/
- void initialize(Map<String, String> config) throws Exception;
+ String getBaseDn();
/**
* Get a user entry by username
diff --git
a/gateway-server/src/main/java/org/apache/knox/gateway/services/ldap/backend/LdapBackendFactory.java
b/gateway-server/src/main/java/org/apache/knox/gateway/services/ldap/backend/LdapBackendFactory.java
new file mode 100644
index 000000000..2ec00eb37
--- /dev/null
+++
b/gateway-server/src/main/java/org/apache/knox/gateway/services/ldap/backend/LdapBackendFactory.java
@@ -0,0 +1,25 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.knox.gateway.services.ldap.backend;
+
+import java.util.Map;
+
+public interface LdapBackendFactory {
+ LdapBackend create(String name, Map<String, String> config) throws
Exception;
+ String getType();
+}
diff --git
a/gateway-server/src/main/java/org/apache/knox/gateway/services/ldap/backend/LdapProxyBackend.java
b/gateway-server/src/main/java/org/apache/knox/gateway/services/ldap/backend/LdapProxyBackend.java
index 59355e4ad..07337b049 100644
---
a/gateway-server/src/main/java/org/apache/knox/gateway/services/ldap/backend/LdapProxyBackend.java
+++
b/gateway-server/src/main/java/org/apache/knox/gateway/services/ldap/backend/LdapProxyBackend.java
@@ -54,6 +54,9 @@ import java.util.stream.Collectors;
public class LdapProxyBackend implements LdapBackend {
private static final LdapMessages LOG =
MessagesFactory.get(LdapMessages.class);
+ static final String TYPE = "ldap";
+
+ private String name;
private String ldapUrl;
private String bindDn;
private String bindPassword;
@@ -83,13 +86,8 @@ public class LdapProxyBackend implements LdapBackend {
// Connection pool for efficient connection reuse
private LdapConnectionPool connectionPool;
- @Override
- public String getName() {
- return "ldap";
- }
-
- @Override
- public void initialize(Map<String, String> config) throws Exception {
+ public LdapProxyBackend(String name, Map<String, String> config) {
+ this.name = name;
// Proxy base DN is for entries created in the proxy LDAP server
proxyBaseDn = config.get("baseDn");
if (proxyBaseDn == null || proxyBaseDn.isEmpty()) {
@@ -154,14 +152,28 @@ public class LdapProxyBackend implements LdapBackend {
initializeConnectionPool(config);
}
+ @Override
+ public String getName() {
+ return name;
+ }
+
+ @Override
+ public String getType() {
+ return TYPE;
+ }
+
+ @Override
+ public String getBaseDn() {
+ return remoteBaseDn;
+ }
+
/**
* Initializes the LDAP connection pool with configurable parameters.
* Uses a validating pool to ensure connections remain healthy.
*
* @param config Configuration map that may contain pool settings
- * @throws Exception if connection pool initialization fails
*/
- private void initializeConnectionPool(Map<String, String> config) throws
Exception {
+ private void initializeConnectionPool(Map<String, String> config) {
// Configure connection settings
LdapConnectionConfig connectionConfig = new LdapConnectionConfig();
connectionConfig.setLdapHost(host);
@@ -186,7 +198,7 @@ public class LdapProxyBackend implements LdapBackend {
connectionPool.setMaxTotal(maxActive);
connectionPool.setTestOnBorrow(true);
- LOG.ldapBackendLoading(getName(), "Initialized connection pool with
maxActive=" + maxActive);
+ LOG.ldapBackendLoading(getType(), "Initialized connection pool with
maxActive=" + maxActive);
}
private void parseLdapUrl(String url) {
diff --git
a/gateway-server/src/main/java/org/apache/knox/gateway/services/ldap/backend/LdapProxyBackendFactory.java
b/gateway-server/src/main/java/org/apache/knox/gateway/services/ldap/backend/LdapProxyBackendFactory.java
new file mode 100644
index 000000000..f138a827d
--- /dev/null
+++
b/gateway-server/src/main/java/org/apache/knox/gateway/services/ldap/backend/LdapProxyBackendFactory.java
@@ -0,0 +1,32 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.knox.gateway.services.ldap.backend;
+
+import java.util.Map;
+
+public class LdapProxyBackendFactory implements LdapBackendFactory {
+ @Override
+ public LdapBackend create(String name, Map<String, String> config) throws
Exception {
+ return new LdapProxyBackend(name, config);
+ }
+
+ @Override
+ public String getType() {
+ return LdapProxyBackend.TYPE;
+ }
+}
diff --git
a/gateway-server/src/main/java/org/apache/knox/gateway/services/ldap/interceptor/DuplicateUserFilteringInterceptor.java
b/gateway-server/src/main/java/org/apache/knox/gateway/services/ldap/interceptor/DuplicateUserFilteringInterceptor.java
new file mode 100644
index 000000000..fa7287df1
--- /dev/null
+++
b/gateway-server/src/main/java/org/apache/knox/gateway/services/ldap/interceptor/DuplicateUserFilteringInterceptor.java
@@ -0,0 +1,87 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.knox.gateway.services.ldap.interceptor;
+
+import com.google.common.annotations.VisibleForTesting;
+import org.apache.directory.api.ldap.model.cursor.CursorException;
+import org.apache.directory.api.ldap.model.cursor.ListCursor;
+import org.apache.directory.api.ldap.model.entry.Attribute;
+import org.apache.directory.api.ldap.model.entry.Entry;
+import org.apache.directory.api.ldap.model.entry.Value;
+import org.apache.directory.api.ldap.model.exception.LdapException;
+import org.apache.directory.server.core.api.filtering.EntryFilteringCursor;
+import org.apache.directory.server.core.api.filtering.EntryFilteringCursorImpl;
+import org.apache.directory.server.core.api.interceptor.BaseInterceptor;
+import
org.apache.directory.server.core.api.interceptor.context.SearchOperationContext;
+
+import java.io.IOException;
+import java.util.ArrayList;
+import java.util.HashSet;
+import java.util.List;
+import java.util.Set;
+
+public class DuplicateUserFilteringInterceptor extends BaseInterceptor {
+
+ public DuplicateUserFilteringInterceptor(String name) {
+ super(name);
+ }
+
+ @Override
+ public EntryFilteringCursor search(SearchOperationContext ctx) throws
LdapException {
+ // First execute the interceptor chain to get the results
+ List<Entry> filteredEntries = List.of();
+ try (EntryFilteringCursor originalResults = next(ctx)) {
+ List<Entry> originalEntries = new ArrayList<>();
+ try {
+ while (originalResults.next()) {
+ originalEntries.add(originalResults.get());
+ }
+ originalResults.close();
+ } catch (CursorException e) {
+ // rethrow exception on incomplete iteration
+ throw new LdapException(e);
+ }
+ filteredEntries = filterDuplicateUsers(originalEntries);
+ } catch (IOException e) {
+ // IOException would only occur after finishing iterating over
results
+ // we can ignore this exception and return the filtered entries
+ }
+ return new EntryFilteringCursorImpl(new ListCursor<>(filteredEntries),
ctx, schemaManager);
+ }
+
+ @VisibleForTesting
+ List<Entry> filterDuplicateUsers(List<Entry> originalEntries) {
+ Set<Value> seenUids = new HashSet<>();
+ List<Entry> filteredEntries = new ArrayList<>();
+
+ for (Entry entry : originalEntries) {
+ Attribute uid = entry.get("uid");
+ if (uid == null) {
+ // keep entry because it's not a user
+ filteredEntries.add(entry);
+ } else {
+ Value uidValue = uid.get();
+ if (!seenUids.contains(uidValue)) {
+ filteredEntries.add(entry);
+ seenUids.add(uidValue);
+ }
+ }
+ }
+ return filteredEntries;
+ }
+}
diff --git
a/gateway-server/src/main/java/org/apache/knox/gateway/services/ldap/interceptor/DuplicateUserFilteringInterceptorFactory.java
b/gateway-server/src/main/java/org/apache/knox/gateway/services/ldap/interceptor/DuplicateUserFilteringInterceptorFactory.java
new file mode 100644
index 000000000..b443c2def
--- /dev/null
+++
b/gateway-server/src/main/java/org/apache/knox/gateway/services/ldap/interceptor/DuplicateUserFilteringInterceptorFactory.java
@@ -0,0 +1,36 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.knox.gateway.services.ldap.interceptor;
+
+import org.apache.directory.server.core.api.interceptor.Interceptor;
+
+import java.util.Map;
+
+public class DuplicateUserFilteringInterceptorFactory implements
KnoxLdapInterceptorFactory {
+ public static final String TYPE = "duplicateuserfilter";
+
+ @Override
+ public Interceptor create(String name, Map<String, String> config) {
+ return new DuplicateUserFilteringInterceptor(name);
+ }
+
+ @Override
+ public String getType() {
+ return TYPE;
+ }
+}
diff --git
a/gateway-server/src/main/java/org/apache/knox/gateway/services/ldap/interceptor/InterceptorFactory.java
b/gateway-server/src/main/java/org/apache/knox/gateway/services/ldap/interceptor/InterceptorFactory.java
new file mode 100644
index 000000000..6b26cc116
--- /dev/null
+++
b/gateway-server/src/main/java/org/apache/knox/gateway/services/ldap/interceptor/InterceptorFactory.java
@@ -0,0 +1,59 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.knox.gateway.services.ldap.interceptor;
+
+import org.apache.directory.server.core.api.interceptor.Interceptor;
+import org.apache.knox.gateway.i18n.messages.MessagesFactory;
+import org.apache.knox.gateway.services.ldap.LdapMessages;
+
+import java.util.Map;
+import java.util.ServiceLoader;
+
+/**
+ * Factory for creating LDAP Interceptor implementations using ServiceLoader
for full extensibility.
+ * Backends are discovered via
META-INF/services/org.apache.knox.gateway.services.ldap.interceptor.KnoxLdapInterceptorFactory
+ * Built-in interceptors are registered via ServiceLoader along with any
external plugins.
+ */
+public class InterceptorFactory {
+ private static final LdapMessages LOG =
MessagesFactory.get(LdapMessages.class);
+
+ public static Interceptor createInterceptor(String interceptorName,
Map<String, String> config) throws Exception {
+ String interceptorType = config.get("interceptorType");
+ if (interceptorType == null) {
+ // No backend type configured found
+ LOG.ldapInterceptorTypeNotFound(interceptorName);
+ throw new IllegalArgumentException("No LDAP interceptor type
configured for : " + interceptorName);
+ }
+
+ // Use ServiceLoader to discover all available interceptors (built-in
and external plugins)
+ // Indirect instantiation through a factory is used to allow
configuration of multiple instances
+ // of the same class of interceptor. e.g., if multiple backends are
configured
+ ServiceLoader<KnoxLdapInterceptorFactory> loader =
ServiceLoader.load(KnoxLdapInterceptorFactory.class);
+ for (KnoxLdapInterceptorFactory interceptorFactory : loader) {
+ if
(interceptorFactory.getType().equalsIgnoreCase(interceptorType)) {
+ LOG.ldapInterceptorCreating(interceptorType, "ServiceLoader");
+ Interceptor interceptor =
interceptorFactory.create(interceptorName, config);
+ return interceptor;
+ }
+ }
+
+ // No matching interceptor found
+ LOG.ldapInterceptorNotFound(interceptorType, interceptorName);
+ throw new IllegalArgumentException("No LDAP interceptor of type " +
interceptorType + " found for : " + interceptorName);
+ }
+}
diff --git
a/gateway-server/src/main/java/org/apache/knox/gateway/services/ldap/interceptor/KnoxLdapInterceptorFactory.java
b/gateway-server/src/main/java/org/apache/knox/gateway/services/ldap/interceptor/KnoxLdapInterceptorFactory.java
new file mode 100644
index 000000000..2eb4fb5f9
--- /dev/null
+++
b/gateway-server/src/main/java/org/apache/knox/gateway/services/ldap/interceptor/KnoxLdapInterceptorFactory.java
@@ -0,0 +1,41 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.knox.gateway.services.ldap.interceptor;
+
+import org.apache.directory.server.core.api.interceptor.Interceptor;
+
+import java.util.Map;
+
+/**
+ * Factory interface for creating Interceptor instances.
+ */
+public interface KnoxLdapInterceptorFactory {
+ /**
+ * Instantiate and interceptor
+ * @param name the name of the interceptor
+ * @param config the configuration for the interceptor
+ * @return the interceptor
+ */
+ Interceptor create(String name, Map<String, String> config) throws
Exception;
+
+ /**
+ * Get the type of interceptor this factory creates
+ * @return the type of interceptor ths factory creates
+ */
+ String getType();
+}
diff --git
a/gateway-server/src/main/java/org/apache/knox/gateway/services/ldap/GroupLookupInterceptor.java
b/gateway-server/src/main/java/org/apache/knox/gateway/services/ldap/interceptor/UserSearchInterceptor.java
similarity index 77%
rename from
gateway-server/src/main/java/org/apache/knox/gateway/services/ldap/GroupLookupInterceptor.java
rename to
gateway-server/src/main/java/org/apache/knox/gateway/services/ldap/interceptor/UserSearchInterceptor.java
index 1218c8c78..1ac2ef5a2 100644
---
a/gateway-server/src/main/java/org/apache/knox/gateway/services/ldap/GroupLookupInterceptor.java
+++
b/gateway-server/src/main/java/org/apache/knox/gateway/services/ldap/interceptor/UserSearchInterceptor.java
@@ -15,13 +15,12 @@
* See the License for the specific language governing permissions and
* limitations under the License.
*/
-package org.apache.knox.gateway.services.ldap;
+package org.apache.knox.gateway.services.ldap.interceptor;
import org.apache.directory.api.ldap.model.constants.AuthenticationLevel;
import org.apache.directory.api.ldap.model.cursor.ListCursor;
import org.apache.directory.api.ldap.model.entry.Entry;
import org.apache.directory.api.ldap.model.exception.LdapException;
-import org.apache.directory.api.ldap.model.schema.SchemaManager;
import org.apache.directory.server.core.api.CoreSession;
import org.apache.directory.server.core.api.DirectoryService;
import org.apache.directory.server.core.api.LdapPrincipal;
@@ -32,27 +31,41 @@ import
org.apache.directory.server.core.api.interceptor.context.BindOperationCon
import
org.apache.directory.server.core.api.interceptor.context.LookupOperationContext;
import
org.apache.directory.server.core.api.interceptor.context.SearchOperationContext;
import org.apache.knox.gateway.i18n.messages.MessagesFactory;
+import org.apache.knox.gateway.services.ldap.LdapMessages;
+import org.apache.knox.gateway.services.ldap.LdapUtils;
+import org.apache.knox.gateway.services.ldap.backend.BackendFactory;
import org.apache.knox.gateway.services.ldap.backend.LdapBackend;
import java.util.ArrayList;
import java.util.List;
+import java.util.Map;
import java.util.regex.Matcher;
import java.util.regex.Pattern;
/**
- * Interceptor for LDAP operations to proxy user searches to backend when not
found locally
+ * Interceptor for LDAP operations to proxy user searches to backends when not
found locally
*/
-public class GroupLookupInterceptor extends BaseInterceptor {
+public class UserSearchInterceptor extends BaseInterceptor {
+
private static final LdapMessages LOG =
MessagesFactory.get(LdapMessages.class);
- private DirectoryService directoryService;
- private LdapBackend backend;
private static final Pattern UID_PATTERN =
Pattern.compile(".*\\(uid=([^)]+)\\).*");
private static final Pattern CN_PATTERN =
Pattern.compile(".*\\(cn=([^)]+)\\).*");
private static final Pattern SAMAACCOUNTNAME_PATTERN =
Pattern.compile(".*\\(sAMAccountName=([^)]+)\\).*");
- public GroupLookupInterceptor(DirectoryService directoryService,
LdapBackend backend) {
- this.directoryService = directoryService;
- this.backend = backend;
+ private final LdapBackend backend;
+
+ public UserSearchInterceptor(String name, Map<String, String> config)
throws Exception {
+ super(name);
+ backend = BackendFactory.createBackend(name, config);
+ }
+
+ public LdapBackend getBackend() {
+ return backend;
+ }
+
+ @Override
+ public void init(DirectoryService directoryService) throws LdapException {
+ super.init(directoryService);
}
@Override
@@ -78,15 +91,11 @@ public class GroupLookupInterceptor extends BaseInterceptor
{
LOG.ldapSearch(baseDn, filter);
- // First try the normal search
+ // First execute the next interceptor in the chain
EntryFilteringCursor originalResults;
- try {
- originalResults = next(ctx);
- } catch (Exception e) {
- throw new LdapException(e);
- }
+ originalResults = next(ctx);
- // Check if this is a user search and if we got no results, try the
backend
+ // Check if this is a user search and call the backends
if (isUserSearch(filter)) {
String username = extractUser(filter);
@@ -98,42 +107,40 @@ public class GroupLookupInterceptor extends
BaseInterceptor {
}
originalResults.close();
} catch (Exception e) {
- // If we get an error or no results, try the backend
+ // If we get an error or no results, try the backends
}
- // If no local results, try backend
- if (entries.isEmpty() && username != null) {
+ if (username != null) {
try {
- SchemaManager schemaManager =
directoryService.getSchemaManager();
-
if (username.contains("*")) {
// Wildcard search - use searchUsers
LOG.ldapSearch(baseDn, "wildcard user search: " +
username);
- List<Entry> backendEntries =
backend.searchUsers(username, schemaManager);
-
// Return backend results directly without caching to
avoid deadlock
// (caching during an active search can cause ApacheDS
locking issues)
- entries.addAll(backendEntries);
+ entries.addAll(backend.searchUsers(username,
schemaManager));
} else {
- // Specific user lookup
- LOG.ldapUserLoaded(username);
- Entry backendEntry = backend.getUser(username,
schemaManager);
-
- if (backendEntry != null) {
- // Return backend result directly without caching
- entries.add(backendEntry);
- LOG.ldapUserEntry(backendEntry.toString());
- } else {
- LOG.ldapUserNull(username);
+ // if no results, perform single-user search
+ if (entries.isEmpty()) {
+ // Specific user lookup
+ Entry backendEntry = backend.getUser(username,
schemaManager);
+ LOG.ldapUserLoaded(username);
+
+ if (backendEntry != null) {
+ // Return backend result directly without
caching
+ entries.add(backendEntry);
+ LOG.ldapUserEntry(backendEntry.toString());
+ } else {
+ LOG.ldapUserNull(username);
+ }
}
}
} catch (Exception e) {
- LOG.ldapServiceStopFailed(e);
+ LOG.ldapSearchFailed(baseDn, filter, e);
}
}
// Return cursor with our results - use a simple approach
- return new EntryFilteringCursorImpl(new ListCursor<>(entries),
ctx, directoryService.getSchemaManager());
+ return new EntryFilteringCursorImpl(new ListCursor<>(entries),
ctx, schemaManager);
}
return originalResults;
diff --git
a/gateway-server/src/main/java/org/apache/knox/gateway/services/ldap/interceptor/UserSearchInterceptorFactory.java
b/gateway-server/src/main/java/org/apache/knox/gateway/services/ldap/interceptor/UserSearchInterceptorFactory.java
new file mode 100644
index 000000000..862d3a964
--- /dev/null
+++
b/gateway-server/src/main/java/org/apache/knox/gateway/services/ldap/interceptor/UserSearchInterceptorFactory.java
@@ -0,0 +1,36 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.knox.gateway.services.ldap.interceptor;
+
+import org.apache.directory.server.core.api.interceptor.Interceptor;
+
+import java.util.Map;
+
+public class UserSearchInterceptorFactory implements
KnoxLdapInterceptorFactory {
+ public static final String TYPE = "backend";
+
+ @Override
+ public Interceptor create(String name, Map<String, String> config) throws
Exception {
+ return new UserSearchInterceptor(name, config);
+ }
+
+ @Override
+ public String getType() {
+ return TYPE;
+ }
+}
diff --git
a/gateway-server/src/main/java/org/apache/knox/gateway/util/KnoxCLI.java
b/gateway-server/src/main/java/org/apache/knox/gateway/util/KnoxCLI.java
index b1465a7af..784c416c1 100644
--- a/gateway-server/src/main/java/org/apache/knox/gateway/util/KnoxCLI.java
+++ b/gateway-server/src/main/java/org/apache/knox/gateway/util/KnoxCLI.java
@@ -1911,6 +1911,7 @@ public class KnoxCLI extends Configured implements Tool {
return;
}
+ services.start();
try {
final KnoxLDAPService ldapService =
services.getService(ServiceType.LDAP_SERVICE);
out.println("Querying KnoxLDAPService for groups of user: " +
username);
diff --git
a/gateway-server/src/main/resources/META-INF/services/org.apache.knox.gateway.services.ldap.backend.LdapBackend
b/gateway-server/src/main/resources/META-INF/services/org.apache.knox.gateway.services.ldap.backend.LdapBackendFactory
similarity index 83%
copy from
gateway-server/src/main/resources/META-INF/services/org.apache.knox.gateway.services.ldap.backend.LdapBackend
copy to
gateway-server/src/main/resources/META-INF/services/org.apache.knox.gateway.services.ldap.backend.LdapBackendFactory
index c8bd82de6..424d400b8 100644
---
a/gateway-server/src/main/resources/META-INF/services/org.apache.knox.gateway.services.ldap.backend.LdapBackend
+++
b/gateway-server/src/main/resources/META-INF/services/org.apache.knox.gateway.services.ldap.backend.LdapBackendFactory
@@ -16,6 +16,6 @@
# limitations under the License.
##########################################################################
-# Built-in LDAP backend implementations
-org.apache.knox.gateway.services.ldap.backend.FileBackend
-org.apache.knox.gateway.services.ldap.backend.LdapProxyBackend
\ No newline at end of file
+# Built-in LDAP backend factory implementations
+org.apache.knox.gateway.services.ldap.backend.FileBackendFactory
+org.apache.knox.gateway.services.ldap.backend.LdapProxyBackendFactory
\ No newline at end of file
diff --git
a/gateway-server/src/main/resources/META-INF/services/org.apache.knox.gateway.services.ldap.backend.LdapBackend
b/gateway-server/src/main/resources/META-INF/services/org.apache.knox.gateway.services.ldap.interceptor.KnoxLdapInterceptorFactory
similarity index 80%
rename from
gateway-server/src/main/resources/META-INF/services/org.apache.knox.gateway.services.ldap.backend.LdapBackend
rename to
gateway-server/src/main/resources/META-INF/services/org.apache.knox.gateway.services.ldap.interceptor.KnoxLdapInterceptorFactory
index c8bd82de6..3275b3329 100644
---
a/gateway-server/src/main/resources/META-INF/services/org.apache.knox.gateway.services.ldap.backend.LdapBackend
+++
b/gateway-server/src/main/resources/META-INF/services/org.apache.knox.gateway.services.ldap.interceptor.KnoxLdapInterceptorFactory
@@ -16,6 +16,6 @@
# limitations under the License.
##########################################################################
-# Built-in LDAP backend implementations
-org.apache.knox.gateway.services.ldap.backend.FileBackend
-org.apache.knox.gateway.services.ldap.backend.LdapProxyBackend
\ No newline at end of file
+# Built-in LDAP interceptor factory implementations
+org.apache.knox.gateway.services.ldap.interceptor.UserSearchInterceptorFactory
+org.apache.knox.gateway.services.ldap.interceptor.DuplicateUserFilteringInterceptorFactory
\ No newline at end of file
diff --git a/gateway-server/src/main/resources/conf/gateway-site.xml
b/gateway-server/src/main/resources/conf/gateway-site.xml
index ce7525e2d..70ab3b188 100644
--- a/gateway-server/src/main/resources/conf/gateway-site.xml
+++ b/gateway-server/src/main/resources/conf/gateway-site.xml
@@ -63,9 +63,9 @@ limitations under the License.
</property>
<property>
- <name>gateway.ldap.backend.type</name>
- <value>ldap</value>
- <description>Backend type for LDAP service. Currently supported: file,
ldap. Future: jdbc, knox.</description>
+ <name>gateway.ldap.interceptor.names</name>
+ <value>ldapproxy,duplicatefilter</value>
+ <description>Interceptor names for LDAP service in priority
order.</description>
</property>
<property>
@@ -74,61 +74,86 @@ limitations under the License.
<description>Path to JSON data file for file-based backend. Supports
${GATEWAY_DATA_HOME} variable.</description>
</property>
- <!-- LDAP backend proxy configuration (active when
gateway.ldap.backend.type=ldap) -->
+ <!-- LDAP backend proxy configuration (active when
gateway.ldap.interceptor.names includes ldapproxy) -->
+ <property>
+ <name>gateway.ldap.interceptor.ldapproxy.interceptorType</name>
+ <value>backend</value>
+ <description>Interceptor type.</description>
+ </property>
+ <property>
+ <name>gateway.ldap.interceptor.ldapproxy.backendType</name>
+ <value>ldap</value>
+ <description>Backend type for LDAP service. Currently supported: file,
ldap. Future: jdbc, knox.</description>
+ </property>
<property>
- <name>gateway.ldap.backend.ldap.url</name>
+ <name>gateway.ldap.interceptor.ldapproxy.url</name>
<value>ldap://localhost:33389</value>
<description>LDAP server URL for proxy backend</description>
</property>
<property>
- <name>gateway.ldap.backend.ldap.remoteBaseDn</name>
+ <name>gateway.ldap.interceptor.ldapproxy.remoteBaseDn</name>
<value>dc=hadoop,dc=apache,dc=org</value>
<description>Base DN of the remote LDAP server</description>
</property>
<property>
- <name>gateway.ldap.backend.ldap.systemUsername</name>
+ <name>gateway.ldap.interceptor.ldapproxy.systemUsername</name>
<value>uid=guest,ou=people,dc=hadoop,dc=apache,dc=org</value>
<description>LDAP bind DN for proxy backend
authentication</description>
</property>
<property>
- <name>gateway.ldap.backend.ldap.systemPassword</name>
+ <name>gateway.ldap.interceptor.ldapproxy.systemPassword</name>
<value>guest-password</value>
<description>LDAP bind password for proxy backend
authentication</description>
</property>
<!-- Backend-specific configuration using prefixed properties -->
- <!-- Uncomment and configure based on backend type specified in
gateway.ldap.backend.type -->
+ <!-- Uncomment and configure based on interceptor names specified in
gateway.ldap.interceptor.names -->
- <!-- File backend configuration (gateway.ldap.backend.type=file) -->
+ <!-- File backend configuration
(gateway.ldap.interceptor.<interceptorName>.backendType=file) -->
<!--
<property>
- <name>gateway.ldap.backend.file.dataFile</name>
+ <name>gateway.ldap.interceptor.ldapfile.interceptorType</name>
+ <value>backend</value>
+ <description>Interceptor type.</description>
+ </property>
+ <property>
+ <name>gateway.ldap.interceptor.ldapfile.backendType</name>
+ <value>file</value>
+ <description>Backend type for LDAP service. Currently supported: file,
ldap. Future: jdbc, knox.</description>
+ </property>
+ <property>
+ <name>gateway.ldap.interceptor.ldapfile.dataFile</name>
<value>${GATEWAY_DATA_HOME}/ldap-users.json</value>
<description>Path to JSON file containing user and group
data</description>
</property>
-->
- <!-- LDAP proxy backend configuration (gateway.ldap.backend.type=ldap) -->
+ <!-- LDAP proxy backend configuration
(gateway.ldap.interceptor.<interceptorName>.backendType=ldap) -->
<!-- This backend proxies to an external LDAP server (e.g., demo LDAP) -->
<!--
Example 1: Using Knox demo LDAP server (default port 33389)
<property>
- <name>gateway.ldap.backend.ldap.url</name>
+ <name>gateway.ldap.interceptor.demoldap.backendType</name>
+ <value>ldap</value>
+ <description>Backend type for LDAP service. Currently supported: file,
ldap. Future: jdbc, knox.</description>
+ </property>
+ <property>
+ <name>gateway.ldap.interceptor.demoldap.url</name>
<value>ldap://localhost:33389</value>
<description>LDAP server URL</description>
</property>
<property>
- <name>gateway.ldap.backend.ldap.remoteBaseDn</name>
+ <name>gateway.ldap.interceptor.demoldap.remoteBaseDn</name>
<value>dc=hadoop,dc=apache,dc=org</value>
<description>Base DN of the remote LDAP server</description>
</property>
<property>
- <name>gateway.ldap.backend.ldap.systemUsername</name>
+ <name>gateway.ldap.interceptor.demoldap.systemUsername</name>
<value>uid=guest,ou=people,dc=hadoop,dc=apache,dc=org</value>
<description>LDAP bind DN for authentication</description>
</property>
<property>
- <name>gateway.ldap.backend.ldap.systemPassword</name>
+ <name>gateway.ldap.interceptor.demoldap.systemPassword</name>
<value>guest-password</value>
<description>LDAP bind password</description>
</property>
@@ -137,32 +162,37 @@ limitations under the License.
<!--
Example 2: Using external LDAP with authentication (supports both naming
conventions)
<property>
- <name>gateway.ldap.backend.ldap.url</name>
+ <name>gateway.ldap.interceptor.externalldap.backendType</name>
+ <value>ldap</value>
+ <description>Backend type for LDAP service. Currently supported: file,
ldap. Future: jdbc, knox.</description>
+ </property>
+ <property>
+ <name>gateway.ldap.interceptor.externalldap.url</name>
<value>ldap://ldap.example.com:389</value>
<description>LDAP server URL</description>
</property>
<property>
- <name>gateway.ldap.backend.ldap.remoteBaseDn</name>
+ <name>gateway.ldap.interceptor.externalldap.remoteBaseDn</name>
<value>dc=example,dc=com</value>
<description>Base DN of the remote LDAP server</description>
</property>
<property>
- <name>gateway.ldap.backend.ldap.systemUsername</name>
+ <name>gateway.ldap.interceptor.externalldap.systemUsername</name>
<value>cn=admin,dc=example,dc=com</value>
<description>LDAP bind DN for authentication (or use
bindDn)</description>
</property>
<property>
- <name>gateway.ldap.backend.ldap.systemPassword</name>
+ <name>gateway.ldap.interceptor.externalldap.systemPassword</name>
<value>secret</value>
<description>LDAP bind password (or use bindPassword)</description>
</property>
<property>
- <name>gateway.ldap.backend.ldap.userSearchBase</name>
+ <name>gateway.ldap.interceptor.externalldap.userSearchBase</name>
<value>ou=people,dc=example,dc=com</value>
<description>Base DN for user searches on remote server (defaults to
ou=people,{remoteBaseDn})</description>
</property>
<property>
- <name>gateway.ldap.backend.ldap.groupSearchBase</name>
+ <name>gateway.ldap.interceptor.externalldap.groupSearchBase</name>
<value>ou=groups,dc=example,dc=com</value>
<description>Base DN for group searches on remote server (defaults to
ou=groups,{remoteBaseDn})</description>
</property>
@@ -170,58 +200,75 @@ limitations under the License.
<!--
Alternative: Use host and port instead of URL
<property>
- <name>gateway.ldap.backend.ldap.host</name>
+ <name>gateway.ldap.interceptor.externalldap.host</name>
<value>localhost</value>
<description>LDAP server hostname</description>
</property>
<property>
- <name>gateway.ldap.backend.ldap.port</name>
+ <name>gateway.ldap.interceptor.externalldap.port</name>
<value>33389</value>
<description>LDAP server port</description>
</property>
-->
- <!-- Database backend configuration (gateway.ldap.backend.type=database)
-->
+ <!-- Database backend configuration (gateway.ldap.backend.type=jdbc) -->
<!--
<property>
- <name>gateway.ldap.backend.database.jdbc-url</name>
+ <name>gateway.ldap.interceptor.jdbc.backendType</name>
+ <value>jdbc</value>
+ <description>Backend type for LDAP service. Currently supported: file,
ldap. Future: jdbc, knox.</description>
+ </property>
+ <property>
+ <name>gateway.ldap.interceptor.jdbc.url</name>
<value>jdbc:mysql://localhost:3306/knox</value>
<description>JDBC connection URL</description>
</property>
<property>
- <name>gateway.ldap.backend.database.driver</name>
+ <name>gateway.ldap.interceptor.jdbc.driver</name>
<value>com.mysql.cj.jdbc.Driver</value>
<description>JDBC driver class name</description>
</property>
<property>
- <name>gateway.ldap.backend.database.username</name>
+ <name>gateway.ldap.interceptor.jdbc.username</name>
<value>knox_user</value>
<description>Database username</description>
</property>
<property>
- <name>gateway.ldap.backend.database.password</name>
+ <name>gateway.ldap.interceptor.jdbc.password</name>
<value>secret</value>
<description>Database password</description>
</property>
-->
- <!-- Knox Auth backend configuration (gateway.ldap.backend.type=knox-auth)
-->
+ <!-- Knox Auth backend configuration (gateway.ldap.backend.type=knox) -->
<!--
<property>
- <name>gateway.ldap.backend.knox-auth.url</name>
+ <name>gateway.ldap.interceptor.knox.backendType</name>
+ <value>knox</value>
+ <description>Backend type for LDAP service. Currently supported: file,
ldap. Future: jdbc, knox.</description>
+ </property>
+ <property>
+ <name>gateway.ldap.interceptor.knox.url</name>
<value>https://knox-server/gateway/sandbox/knoxauth/api</value>
<description>Knox authentication service URL</description>
</property>
<property>
- <name>gateway.ldap.backend.knox-auth.username</name>
+ <name>gateway.ldap.interceptor.knox.username</name>
<value>admin</value>
<description>Knox admin username</description>
</property>
<property>
- <name>gateway.ldap.backend.knox-auth.password</name>
+ <name>gateway.ldap.interceptor.knox.password</name>
<value>admin-password</value>
<description>Knox admin password</description>
</property>
-->
+ <!-- Duplicate Filter Interceptor -->
+ <property>
+ <name>gateway.ldap.interceptor.duplicatefilter.interceptorType</name>
+ <value>duplicateuserfilter</value>
+ <description>Interceptor type.</description>
+ </property>
+
</configuration>
\ No newline at end of file
diff --git
a/gateway-server/src/test/java/org/apache/knox/gateway/services/ldap/KnoxLDAPServerManagerTest.java
b/gateway-server/src/test/java/org/apache/knox/gateway/services/ldap/KnoxLDAPServerManagerTest.java
index 4528c8b4a..c41afb0c0 100644
---
a/gateway-server/src/test/java/org/apache/knox/gateway/services/ldap/KnoxLDAPServerManagerTest.java
+++
b/gateway-server/src/test/java/org/apache/knox/gateway/services/ldap/KnoxLDAPServerManagerTest.java
@@ -19,17 +19,22 @@ package org.apache.knox.gateway.services.ldap;
import org.apache.knox.gateway.config.GatewayConfig;
import org.easymock.EasyMock;
+import org.apache.directory.api.ldap.model.name.Dn;
+import org.apache.knox.gateway.services.ldap.interceptor.UserSearchInterceptor;
import org.junit.Test;
import org.junit.Before;
import org.junit.After;
import java.io.File;
+import java.net.ServerSocket;
import java.util.HashMap;
+import java.util.List;
import java.util.Map;
import static org.easymock.EasyMock.expect;
import static org.easymock.EasyMock.replay;
import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertNotNull;
import static org.junit.Assert.assertTrue;
import static org.junit.Assert.assertFalse;
@@ -41,6 +46,7 @@ public class KnoxLDAPServerManagerTest {
private KnoxLDAPServerManager serverManager;
private File tempWorkDir;
private File tempLdapFile;
+ private int port;
@Before
public void setUp() throws Exception {
@@ -59,6 +65,11 @@ public class KnoxLDAPServerManagerTest {
try (java.io.BufferedWriter writer =
java.nio.file.Files.newBufferedWriter(tempLdapFile.toPath(),
java.nio.charset.StandardCharsets.UTF_8)) {
writer.write("{\"users\":[{\"dn\":\"uid=admin,ou=people,dc=test,dc=com\",\"uid\":\"admin\",\"cn\":\"Administrator\",\"userPassword\":\"admin-password\"}],\"groups\":[]}");
}
+
+ // pick an unused port
+ try (ServerSocket socket = new ServerSocket(0)) {
+ port = socket.getLocalPort();
+ }
}
@After
@@ -77,16 +88,17 @@ public class KnoxLDAPServerManagerTest {
public void testInitializeWithFileBackend() throws Exception {
GatewayConfig mockConfig =
EasyMock.createNiceMock(GatewayConfig.class);
expect(mockConfig.getGatewayDataDir()).andReturn(tempWorkDir.getParent()).anyTimes();
- expect(mockConfig.getLDAPPort()).andReturn(3890).anyTimes();
+ expect(mockConfig.getLDAPPort()).andReturn(port).anyTimes();
expect(mockConfig.getLDAPBaseDN()).andReturn("dc=test,dc=com").anyTimes();
- expect(mockConfig.getLDAPBackendType()).andReturn("file").anyTimes();
+
expect(mockConfig.getLDAPInterceptorNames()).andReturn(List.of("filebackend")).anyTimes();
expect(mockConfig.getLDAPBackendDataFile()).andReturn(tempLdapFile.getAbsolutePath()).anyTimes();
- expect(mockConfig.getLDAPBackendConfig("file")).andReturn(new
HashMap<>()).anyTimes();
+ Map<String, String> backendConfig =
createFileBackendInterceptorConfig();
+
expect(mockConfig.getLDAPInterceptorConfig("filebackend")).andReturn(backendConfig).anyTimes();
replay(mockConfig);
serverManager.initialize(mockConfig);
- assertEquals("Port should be set correctly", 3890,
serverManager.getPort());
+ assertEquals("Port should be set correctly", port,
serverManager.getPort());
assertEquals("Base DN should be set correctly", "dc=test,dc=com",
serverManager.getBaseDn());
assertFalse("Should not be running after initialize",
serverManager.isRunning());
}
@@ -95,44 +107,62 @@ public class KnoxLDAPServerManagerTest {
public void testInitializeWithLdapBackend() throws Exception {
GatewayConfig mockConfig =
EasyMock.createNiceMock(GatewayConfig.class);
expect(mockConfig.getGatewayDataDir()).andReturn(tempWorkDir.getParent()).anyTimes();
- expect(mockConfig.getLDAPPort()).andReturn(3891).anyTimes();
-
expect(mockConfig.getLDAPBaseDN()).andReturn("dc=proxy,dc=com").anyTimes();
- expect(mockConfig.getLDAPBackendType()).andReturn("ldap").anyTimes();
-
- Map<String, String> backendConfig = new HashMap<>();
- backendConfig.put("url", "ldap://localhost:33389";);
- backendConfig.put("remoteBaseDn", "dc=hadoop,dc=apache,dc=org");
- backendConfig.put("systemUsername",
"cn=admin,dc=hadoop,dc=apache,dc=org");
- backendConfig.put("systemPassword", "admin-password");
-
-
expect(mockConfig.getLDAPBackendConfig("ldap")).andReturn(backendConfig).anyTimes();
+ expect(mockConfig.getLDAPPort()).andReturn(port).anyTimes();
+
expect(mockConfig.getLDAPBaseDN()).andReturn("dc=test,dc=com").anyTimes();
+
expect(mockConfig.getLDAPInterceptorNames()).andReturn(List.of("ldapbackend")).anyTimes();
+ Map<String, String> backendConfig =
createLdapBackendInterceptorConfig();
+
expect(mockConfig.getLDAPInterceptorConfig("ldapbackend")).andReturn(backendConfig).anyTimes();
replay(mockConfig);
serverManager.initialize(mockConfig);
- assertEquals("Port should be set correctly", 3891,
serverManager.getPort());
- assertEquals("Base DN should be set correctly", "dc=proxy,dc=com",
serverManager.getBaseDn());
+ assertEquals("Port should be set correctly", port,
serverManager.getPort());
+ assertEquals("Base DN should be set correctly", "dc=test,dc=com",
serverManager.getBaseDn());
assertFalse("Should not be running after initialize",
serverManager.isRunning());
}
@Test(expected = Exception.class)
- public void testInitializeWithInvalidBackendType() throws Exception {
+ public void testInitializeWithInvalidInterceptorType() throws Exception {
GatewayConfig mockConfig =
EasyMock.createNiceMock(GatewayConfig.class);
expect(mockConfig.getGatewayDataDir()).andReturn(tempWorkDir.getParent()).anyTimes();
-
expect(mockConfig.getLDAPBackendType()).andReturn("invalid").anyTimes();
- expect(mockConfig.getLDAPBackendConfig("invalid")).andReturn(new
HashMap<>()).anyTimes();
+
expect(mockConfig.getLDAPInterceptorNames()).andReturn(List.of("invalid")).anyTimes();
+ Map<String, String> backendConfig = new HashMap<>();
+ backendConfig.put("interceptorType", "badinterceptor");
+ expect(mockConfig.getLDAPInterceptorConfig("invalid")).andReturn(new
HashMap<>()).anyTimes();
replay(mockConfig);
serverManager.initialize(mockConfig);
}
+ @Test
+ public void testInitializeWithMultipleBackends() throws Exception {
+ GatewayConfig mockConfig =
EasyMock.createNiceMock(GatewayConfig.class);
+
expect(mockConfig.getGatewayDataDir()).andReturn(tempWorkDir.getParent()).anyTimes();
+ expect(mockConfig.getLDAPPort()).andReturn(port).anyTimes();
+
expect(mockConfig.getLDAPBaseDN()).andReturn("dc=test,dc=com").anyTimes();
+
expect(mockConfig.getLDAPInterceptorNames()).andReturn(List.of("filebackend",
"ldapbackend")).anyTimes();
+
expect(mockConfig.getLDAPBackendDataFile()).andReturn(tempLdapFile.getAbsolutePath()).anyTimes();
+ Map<String, String> fileBackendConfig =
createFileBackendInterceptorConfig();
+
expect(mockConfig.getLDAPInterceptorConfig("filebackend")).andReturn(fileBackendConfig).anyTimes();
+ Map<String, String> ldapBackendConfig =
createLdapBackendInterceptorConfig();
+
expect(mockConfig.getLDAPInterceptorConfig("ldapbackend")).andReturn(ldapBackendConfig).anyTimes();
+ replay(mockConfig);
+
+ serverManager.initialize(mockConfig);
+
+ assertEquals("Port should be set correctly", port,
serverManager.getPort());
+ assertEquals("Base DN should be set correctly", "dc=test,dc=com",
serverManager.getBaseDn());
+ assertFalse("Should not be running after initialize",
serverManager.isRunning());
+ }
+
@Test
public void testLockFileCleanup() throws Exception {
GatewayConfig mockConfig =
EasyMock.createNiceMock(GatewayConfig.class);
expect(mockConfig.getGatewayDataDir()).andReturn(tempWorkDir.getParent()).anyTimes();
- expect(mockConfig.getLDAPBackendType()).andReturn("file").anyTimes();
+
expect(mockConfig.getLDAPInterceptorNames()).andReturn(List.of("filebackend")).anyTimes();
expect(mockConfig.getLDAPBackendDataFile()).andReturn(tempLdapFile.getAbsolutePath()).anyTimes();
- expect(mockConfig.getLDAPBackendConfig("file")).andReturn(new
HashMap<>()).anyTimes();
+ Map<String, String> backendConfig =
createFileBackendInterceptorConfig();
+
expect(mockConfig.getLDAPInterceptorConfig("filebackend")).andReturn(backendConfig).anyTimes();
replay(mockConfig);
// The manager will use tempWorkDir.getParent()/ldap-server as workDir
@@ -162,9 +192,11 @@ public class KnoxLDAPServerManagerTest {
public void testStopBeforeStart() throws Exception {
GatewayConfig mockConfig =
EasyMock.createNiceMock(GatewayConfig.class);
expect(mockConfig.getGatewayDataDir()).andReturn(tempWorkDir.getParent()).anyTimes();
- expect(mockConfig.getLDAPBackendType()).andReturn("file").anyTimes();
+
expect(mockConfig.getLDAPInterceptorNames()).andReturn(List.of("filebackend")).anyTimes();
expect(mockConfig.getLDAPBackendDataFile()).andReturn(tempLdapFile.getAbsolutePath()).anyTimes();
- expect(mockConfig.getLDAPBackendConfig("file")).andReturn(new
HashMap<>()).anyTimes();
+ Map<String, String> backendConfig =
createFileBackendInterceptorConfig();
+
expect(mockConfig.getLDAPInterceptorConfig("filebackend")).andReturn(backendConfig).anyTimes();
+
replay(mockConfig);
serverManager.initialize(mockConfig);
@@ -177,9 +209,10 @@ public class KnoxLDAPServerManagerTest {
public void testMultipleStopCalls() throws Exception {
GatewayConfig mockConfig =
EasyMock.createNiceMock(GatewayConfig.class);
expect(mockConfig.getGatewayDataDir()).andReturn(tempWorkDir.getParent()).anyTimes();
- expect(mockConfig.getLDAPBackendType()).andReturn("file").anyTimes();
+
expect(mockConfig.getLDAPInterceptorNames()).andReturn(List.of("filebackend")).anyTimes();
expect(mockConfig.getLDAPBackendDataFile()).andReturn(tempLdapFile.getAbsolutePath()).anyTimes();
- expect(mockConfig.getLDAPBackendConfig("file")).andReturn(new
HashMap<>()).anyTimes();
+ Map<String, String> backendConfig =
createFileBackendInterceptorConfig();
+
expect(mockConfig.getLDAPInterceptorConfig("filebackend")).andReturn(backendConfig).anyTimes();
replay(mockConfig);
serverManager.initialize(mockConfig);
@@ -196,6 +229,119 @@ public class KnoxLDAPServerManagerTest {
serverManager.start();
}
+ @Test
+ public void testStartWithFileBackend() throws Exception {
+ GatewayConfig mockConfig =
EasyMock.createNiceMock(GatewayConfig.class);
+
expect(mockConfig.getGatewayDataDir()).andReturn(tempWorkDir.getParent()).anyTimes();
+ expect(mockConfig.getLDAPPort()).andReturn(port).anyTimes();
+
expect(mockConfig.getLDAPBaseDN()).andReturn("dc=test,dc=com").anyTimes();
+
expect(mockConfig.getLDAPInterceptorNames()).andReturn(List.of("filebackend")).anyTimes();
+
expect(mockConfig.getLDAPBackendDataFile()).andReturn(tempLdapFile.getAbsolutePath()).anyTimes();
+ Map<String, String> backendConfig =
createFileBackendInterceptorConfig();
+
expect(mockConfig.getLDAPInterceptorConfig("filebackend")).andReturn(backendConfig).anyTimes();
+ replay(mockConfig);
+
+ serverManager.initialize(mockConfig);
+
+ serverManager.start();
+
+ UserSearchInterceptor interceptor = (UserSearchInterceptor)
serverManager.directoryService.getInterceptor("filebackend");
+ assertNotNull("Interceptor should not be null", interceptor);
+ assertEquals("File backend dn should match configuration",
+ backendConfig.get("baseDn"),
interceptor.getBackend().getBaseDn());
+ // LdapNoSuchObjectException will be thrown if expected partition does
not exist
+ serverManager.directoryService.getPartitionNexus().getPartition(
+ new Dn(serverManager.directoryService.getSchemaManager(),
backendConfig.get("baseDn")));
+ }
+
+ @Test
+ public void testStartWithLdapProxyBackend() throws Exception {
+ GatewayConfig mockConfig =
EasyMock.createNiceMock(GatewayConfig.class);
+
expect(mockConfig.getGatewayDataDir()).andReturn(tempWorkDir.getParent()).anyTimes();
+ expect(mockConfig.getLDAPPort()).andReturn(port).anyTimes();
+
expect(mockConfig.getLDAPBaseDN()).andReturn("dc=proxy,dc=com").anyTimes();
+
expect(mockConfig.getLDAPInterceptorNames()).andReturn(List.of("ldapbackend")).anyTimes();
+ Map<String, String> backendConfig =
createLdapBackendInterceptorConfig();
+
expect(mockConfig.getLDAPInterceptorConfig("ldapbackend")).andReturn(backendConfig).anyTimes();
+ replay(mockConfig);
+
+ serverManager.initialize(mockConfig);
+
+ serverManager.start();
+
+ // Ensure that the partitions are created and backends registered with
the UserSearchInterceptor
+ UserSearchInterceptor interceptor = (UserSearchInterceptor)
serverManager.directoryService.getInterceptor("ldapbackend");
+ assertNotNull("Interceptor should not be null", interceptor);
+ assertEquals("LDAP backend dn should match configuration",
+ backendConfig.get("remoteBaseDn"),
interceptor.getBackend().getBaseDn());
+ // LdapNoSuchObjectException will be thrown if expected partition does
not exist
+ serverManager.directoryService.getPartitionNexus().getPartition(
+ new Dn(serverManager.directoryService.getSchemaManager(),
backendConfig.get("baseDn")));
+ }
+
+ @Test
+ public void testStartWithMultipleBackends() throws Exception {
+ GatewayConfig mockConfig =
EasyMock.createNiceMock(GatewayConfig.class);
+
expect(mockConfig.getGatewayDataDir()).andReturn(tempWorkDir.getParent()).anyTimes();
+ expect(mockConfig.getLDAPPort()).andReturn(port).anyTimes();
+
expect(mockConfig.getLDAPBaseDN()).andReturn("dc=test,dc=com").anyTimes();
+
expect(mockConfig.getLDAPInterceptorNames()).andReturn(List.of("filebackend",
"ldapbackend")).anyTimes();
+
expect(mockConfig.getLDAPBackendDataFile()).andReturn(tempLdapFile.getAbsolutePath()).anyTimes();
+ Map<String, String> fileBackendConfig =
createFileBackendInterceptorConfig();
+
expect(mockConfig.getLDAPInterceptorConfig("filebackend")).andReturn(fileBackendConfig).anyTimes();
+ Map<String, String> ldapBackendConfig =
createLdapBackendInterceptorConfig();
+
expect(mockConfig.getLDAPInterceptorConfig("ldapbackend")).andReturn(ldapBackendConfig).anyTimes();
+ replay(mockConfig);
+
+ serverManager.initialize(mockConfig);
+
+ serverManager.start();
+
+ // Ensure that the partitions are created and backends registered with
the file backend interceptor
+ UserSearchInterceptor fileInterceptor = (UserSearchInterceptor)
serverManager.directoryService.getInterceptor("filebackend");
+ assertNotNull("Interceptor should not be null", fileInterceptor);
+ assertEquals("File backend dn should match configuration",
+ fileBackendConfig.get("baseDn"),
fileInterceptor.getBackend().getBaseDn());
+ // LdapNoSuchObjectException will be thrown if expected partition does
not exist
+ serverManager.directoryService.getPartitionNexus().getPartition(
+ new Dn(serverManager.directoryService.getSchemaManager(),
fileBackendConfig.get("baseDn")));
+
+ // Ensure that the partitions are created and backends registered with
the ldap backend interceptor
+ UserSearchInterceptor ldapInterceptor = (UserSearchInterceptor)
serverManager.directoryService.getInterceptor("ldapbackend");
+ assertNotNull("Interceptor should not be null", ldapInterceptor);
+ assertEquals("LDAP backend dn should match configuration",
+ ldapBackendConfig.get("remoteBaseDn"),
ldapInterceptor.getBackend().getBaseDn());
+ // LdapNoSuchObjectException will be thrown if expected partition does
not exist
+ serverManager.directoryService.getPartitionNexus().getPartition(
+ new Dn(serverManager.directoryService.getSchemaManager(),
ldapBackendConfig.get("baseDn")));
+ }
+
+ @Test
+ public void testGetUserGroups() {
+
+ }
+
+ private Map<String, String> createFileBackendInterceptorConfig() {
+ Map<String, String> config = new HashMap<>();
+ config.put("interceptorType", "backend");
+ config.put("backendType", "file");
+ config.put("baseDn", "dc=file,dc=com");
+ config.put("dataFile", tempLdapFile.getAbsolutePath());
+ return config;
+ }
+
+ private Map<String, String> createLdapBackendInterceptorConfig() {
+ Map<String, String> config = new HashMap<>();
+ config.put("interceptorType", "backend");
+ config.put("backendType", "ldap");
+ config.put("baseDn", "dc=proxy,dc=com");
+ config.put("url", "ldap://localhost:33389";);
+ config.put("remoteBaseDn", "dc=hadoop,dc=apache,dc=org");
+ config.put("systemUsername", "cn=admin,dc=hadoop,dc=apache,dc=org");
+ config.put("systemPassword", "admin-password");
+ return config;
+ }
+
private void cleanupTempFiles() {
if (tempLdapFile != null && tempLdapFile.exists()) {
tempLdapFile.delete();
diff --git
a/gateway-server/src/test/java/org/apache/knox/gateway/services/ldap/KnoxLDAPServiceTest.java
b/gateway-server/src/test/java/org/apache/knox/gateway/services/ldap/KnoxLDAPServiceTest.java
index 40777b253..399e05485 100644
---
a/gateway-server/src/test/java/org/apache/knox/gateway/services/ldap/KnoxLDAPServiceTest.java
+++
b/gateway-server/src/test/java/org/apache/knox/gateway/services/ldap/KnoxLDAPServiceTest.java
@@ -25,6 +25,7 @@ import org.junit.After;
import java.io.File;
import java.util.HashMap;
+import java.util.List;
import java.util.Map;
import static org.junit.Assert.assertEquals;
@@ -169,13 +170,15 @@ public class KnoxLDAPServiceTest {
expect(mockConfig.getGatewayDataDir()).andReturn(tempDataDir.getAbsolutePath()).atLeastOnce();
expect(mockConfig.getLDAPPort()).andReturn(3890).times(1).andReturn(3891).anyTimes();
expect(mockConfig.getLDAPBaseDN()).andReturn("file".equals(backendType) ?
"dc=test,dc=com" : "dc=proxy,dc=com").atLeastOnce();
-
expect(mockConfig.getLDAPBackendType()).andReturn(backendType).atLeastOnce();
-
expect(mockConfig.getLDAPBackendConfig(backendType)).andReturn(buildBackendConfig(backendType)).atLeastOnce();
+
expect(mockConfig.getLDAPInterceptorNames()).andReturn(List.of("testbackend")).atLeastOnce();
+
expect(mockConfig.getLDAPInterceptorConfig("testbackend")).andReturn(buildBackendConfig(backendType)).atLeastOnce();
replay(mockConfig);
}
private Map<String, String> buildBackendConfig(String backendType) {
final Map<String, String> backendConfig = new HashMap<>();
+ backendConfig.put("interceptorType", "backend");
+ backendConfig.put("backendType", backendType);
if ("ldap".equals(backendType)) {
backendConfig.put("url", "ldap://localhost:33389";);
backendConfig.put("remoteBaseDn", "dc=hadoop,dc=apache,dc=org");
diff --git
a/gateway-server/src/test/java/org/apache/knox/gateway/services/ldap/backend/BackendFactoryTest.java
b/gateway-server/src/test/java/org/apache/knox/gateway/services/ldap/backend/BackendFactoryTest.java
index fde29a087..cfb8fa2d5 100644
---
a/gateway-server/src/test/java/org/apache/knox/gateway/services/ldap/backend/BackendFactoryTest.java
+++
b/gateway-server/src/test/java/org/apache/knox/gateway/services/ldap/backend/BackendFactoryTest.java
@@ -54,20 +54,20 @@ public class BackendFactoryTest {
@Test
public void testServiceLoaderDiscovery() {
- ServiceLoader<LdapBackend> loader =
ServiceLoader.load(LdapBackend.class);
+ ServiceLoader<LdapBackendFactory> loader =
ServiceLoader.load(LdapBackendFactory.class);
// Should discover at least the built-in backends
boolean foundFileBackend = false;
boolean foundLdapBackend = false;
- for (LdapBackend backend : loader) {
- String backendName = backend.getName();
- if ("file".equals(backendName)) {
+ for (LdapBackendFactory factory : loader) {
+ String backendType = factory.getType();
+ if ("file".equals(backendType)) {
foundFileBackend = true;
- assertTrue("File backend should be FileBackend instance",
backend instanceof FileBackend);
- } else if ("ldap".equals(backendName)) {
+ assertTrue("File backend should be FileBackend instance",
factory instanceof FileBackendFactory);
+ } else if ("ldap".equals(backendType)) {
foundLdapBackend = true;
- assertTrue("LDAP backend should be LdapProxyBackend instance",
backend instanceof LdapProxyBackend);
+ assertTrue("LDAP backend should be LdapProxyBackend instance",
factory instanceof LdapProxyBackendFactory);
}
}
@@ -77,48 +77,57 @@ public class BackendFactoryTest {
@Test
public void testCreateFileBackend() throws Exception {
- LdapBackend fileBackend = BackendFactory.createBackend("file", config);
+ config.put("backendType", "file");
+ LdapBackend fileBackend = BackendFactory.createBackend("testbackend",
config);
assertNotNull("File backend should be created", fileBackend);
assertTrue("Should create FileBackend instance", fileBackend
instanceof FileBackend);
- assertEquals("Backend name should be 'file'", "file",
fileBackend.getName());
+ assertEquals("Backend type should be 'file'", "file",
fileBackend.getType());
+ assertEquals("Backend name should be 'testbackend'", "testbackend",
fileBackend.getName());
}
@Test
public void testCreateLdapBackend() throws Exception {
+ config.put("backendType", "ldap");
config.put("url", "ldap://localhost:389";);
config.put("remoteBaseDn", "dc=hadoop,dc=apache,dc=org");
- LdapBackend ldapBackend = BackendFactory.createBackend("ldap", config);
+ LdapBackend ldapBackend = BackendFactory.createBackend("testbackend",
config);
assertNotNull("LDAP backend should be created", ldapBackend);
assertTrue("Should create LdapProxyBackend instance", ldapBackend
instanceof LdapProxyBackend);
- assertEquals("Backend name should be 'ldap'", "ldap",
ldapBackend.getName());
+ assertEquals("Backend type should be 'ldap'", "ldap",
ldapBackend.getType());
+ assertEquals("Backend name should be 'testbackend'", "testbackend",
ldapBackend.getName());
}
@Test
- public void testCaseInsensitiveBackendNames() throws Exception {
+ public void testCaseInsensitiveFileBackend() throws Exception {
// Test uppercase
- LdapBackend upperCaseBackend = BackendFactory.createBackend("FILE",
config);
- assertTrue("Should create FileBackend with uppercase name",
upperCaseBackend instanceof FileBackend);
+ config.put("backendType", "FILE");
+ LdapBackend upperCaseBackend = BackendFactory.createBackend("UPPER",
config);
+ assertTrue("Should create FileBackend with uppercase type",
upperCaseBackend instanceof FileBackend);
// Test mixed case
- LdapBackend mixedCaseBackend = BackendFactory.createBackend("File",
config);
- assertTrue("Should create FileBackend with mixed case name",
mixedCaseBackend instanceof FileBackend);
+ config.put("backendType", "File");
+ LdapBackend mixedCaseBackend = BackendFactory.createBackend("Mixed",
config);
+ assertTrue("Should create FileBackend with mixed case type",
mixedCaseBackend instanceof FileBackend);
}
@Test(expected = IllegalArgumentException.class)
public void testUnknownBackendThrowsException() throws Exception {
- BackendFactory.createBackend("unknown", config);
+ config.put("backendType", "unknown");
+ BackendFactory.createBackend("testbackend", config);
}
@Test(expected = IllegalArgumentException.class)
public void testNullBackendNameThrowsException() throws Exception {
- BackendFactory.createBackend(null, config);
+ config.put("backendType", null);
+ BackendFactory.createBackend("testbackend", config);
}
@Test(expected = IllegalArgumentException.class)
public void testEmptyBackendNameThrowsException() throws Exception {
- BackendFactory.createBackend("", config);
+ config.put("backendType", "");
+ BackendFactory.createBackend("testbackend", config);
}
}
\ No newline at end of file
diff --git
a/gateway-server/src/test/java/org/apache/knox/gateway/services/ldap/backend/LdapProxyBackendTest.java
b/gateway-server/src/test/java/org/apache/knox/gateway/services/ldap/backend/LdapProxyBackendTest.java
index 0aba49487..85152cea0 100644
---
a/gateway-server/src/test/java/org/apache/knox/gateway/services/ldap/backend/LdapProxyBackendTest.java
+++
b/gateway-server/src/test/java/org/apache/knox/gateway/services/ldap/backend/LdapProxyBackendTest.java
@@ -39,7 +39,6 @@ import
org.apache.knox.gateway.security.ldap.SimpleDirectoryService;
import org.apache.knox.gateway.services.ldap.SchemaManagerFactory;
import org.junit.After;
import org.junit.AfterClass;
-import org.junit.Before;
import org.junit.BeforeClass;
import org.junit.Test;
@@ -137,20 +136,17 @@ public class LdapProxyBackendTest {
}
}
- @Before
- public void setUp() throws Exception {
- ldapProxyBackend = new LdapProxyBackend();
- }
-
@After
public void tearDown() throws Exception {
- ldapProxyBackend.close();
+ if (ldapProxyBackend != null) {
+ ldapProxyBackend.close();
+ }
}
@Test
public void testGetUserByDefaultUserSearchFilter() throws Exception {
// default searches by uid and uses group search for membership
- ldapProxyBackend.initialize(ldapBackendConfig);
+ ldapProxyBackend = new LdapProxyBackend("testbackend",
ldapBackendConfig);
Entry entry = ldapProxyBackend.getUser("ldaptest1", schemaManager);
validateUserEntry(entry, "ldaptest1", "TestCn1",
"[email protected]", "Test user ldaptest1");
@@ -161,7 +157,7 @@ public class LdapProxyBackendTest {
@Test
public void testGetUserNotFound() throws Exception {
- ldapProxyBackend.initialize(ldapBackendConfig);
+ ldapProxyBackend = new LdapProxyBackend("testbackend",
ldapBackendConfig);
Entry entry = ldapProxyBackend.getUser("nouser", schemaManager);
assertNull(entry);
@@ -170,7 +166,7 @@ public class LdapProxyBackendTest {
@Test
public void testGetUserByUID() throws Exception {
Map<String, String> config = createConfigWithUserAttr("uid");
- ldapProxyBackend.initialize(config);
+ ldapProxyBackend = new LdapProxyBackend("testbackend", config);
Entry entry = ldapProxyBackend.getUser("ldaptest1", schemaManager);
validateUserEntry(entry, "ldaptest1", "TestCn1",
"[email protected]", "Test user ldaptest1");
@@ -182,7 +178,7 @@ public class LdapProxyBackendTest {
@Test
public void testGetUserByCN() throws Exception {
Map<String, String> config = createConfigWithUserAttr("cn");
- ldapProxyBackend.initialize(config);
+ ldapProxyBackend = new LdapProxyBackend("testbackend", config);
Entry entry = ldapProxyBackend.getUser("TestCn1", schemaManager);
validateUserEntry(entry, "TestCn1", "TestCn1",
"[email protected]", "Test user ldaptest1");
@@ -194,7 +190,7 @@ public class LdapProxyBackendTest {
@Test
public void testGetUserBySAMAccountName() throws Exception {
Map<String, String> config =
createConfigWithUserAttr("sAMAccountName");
- ldapProxyBackend.initialize(config);
+ ldapProxyBackend = new LdapProxyBackend("testbackend", config);
Entry entry = ldapProxyBackend.getUser("TestSam1", schemaManager);
validateUserEntry(entry, "TestSam1", "TestCn1",
"[email protected]", "Test user ldaptest1");
@@ -208,7 +204,7 @@ public class LdapProxyBackendTest {
public void testGetUserUseMemberOf() throws Exception {
Map<String, String> config = new HashMap<>(ldapBackendConfig);
config.put("useMemberOf", "true");
- ldapProxyBackend.initialize(config);
+ ldapProxyBackend = new LdapProxyBackend("testbackend", config);
Entry entry = ldapProxyBackend.getUser("ldaptest2", schemaManager);
validateUserEntry(entry, "ldaptest2", "TestCn2",
"[email protected]", "Test user ldaptest2");
@@ -219,7 +215,7 @@ public class LdapProxyBackendTest {
@Test
public void testGetUserGroups() throws Exception {
- ldapProxyBackend.initialize(ldapBackendConfig);
+ ldapProxyBackend = new LdapProxyBackend("testbackend",
ldapBackendConfig);
List<String> userGroups = ldapProxyBackend.getUserGroups("ldaptest1");
assertTrue(userGroups.contains("group1"));
@@ -228,7 +224,7 @@ public class LdapProxyBackendTest {
@Test
public void testGetUserGroupsNoGroups() throws Exception {
- ldapProxyBackend.initialize(ldapBackendConfig);
+ ldapProxyBackend = new LdapProxyBackend("testbackend",
ldapBackendConfig);
List<String> userGroups = ldapProxyBackend.getUserGroups("ldaptest2");
assertTrue(userGroups.isEmpty());
@@ -236,7 +232,7 @@ public class LdapProxyBackendTest {
@Test
public void testGetUserGroupsNoUser() throws Exception {
- ldapProxyBackend.initialize(ldapBackendConfig);
+ ldapProxyBackend = new LdapProxyBackend("testbackend",
ldapBackendConfig);
List<String> userGroups = ldapProxyBackend.getUserGroups("nobody");
assertTrue(userGroups.isEmpty());
@@ -246,7 +242,7 @@ public class LdapProxyBackendTest {
public void testGetUserGroupsUseMemberOf() throws Exception {
Map<String, String> config = new HashMap<>(ldapBackendConfig);
config.put("useMemberOf", "true");
- ldapProxyBackend.initialize(config);
+ ldapProxyBackend = new LdapProxyBackend("testbackend", config);
List<String> userGroups = ldapProxyBackend.getUserGroups("ldaptest2");
assertTrue(userGroups.contains("groupMemberOf1"));
@@ -257,7 +253,7 @@ public class LdapProxyBackendTest {
public void testGetUserGroupsUseMemberOfNoGroups() throws Exception {
Map<String, String> config = new HashMap<>(ldapBackendConfig);
config.put("useMemberOf", "true");
- ldapProxyBackend.initialize(config);
+ ldapProxyBackend = new LdapProxyBackend("testbackend", config);
List<String> userGroups = ldapProxyBackend.getUserGroups("ldaptest1");
assertTrue(userGroups.isEmpty());
@@ -267,7 +263,7 @@ public class LdapProxyBackendTest {
public void testGetUserGroupsUseMemberOfNoUser() throws Exception {
Map<String, String> config = new HashMap<>(ldapBackendConfig);
config.put("useMemberOf", "true");
- ldapProxyBackend.initialize(config);
+ ldapProxyBackend = new LdapProxyBackend("testbackend", config);
List<String> userGroups = ldapProxyBackend.getUserGroups("nobody");
assertTrue(userGroups.isEmpty());
@@ -275,19 +271,19 @@ public class LdapProxyBackendTest {
@Test
public void testSearchUsers() throws Exception {
- ldapProxyBackend.initialize(ldapBackendConfig);
+ ldapProxyBackend = new LdapProxyBackend("testbackend",
ldapBackendConfig);
validateUserSearch("*", 3, Set.of("ldaptest1", "ldaptest2", "guest"));
}
@Test
public void testSearchUsersPartial() throws Exception {
- ldapProxyBackend.initialize(ldapBackendConfig);
+ ldapProxyBackend = new LdapProxyBackend("testbackend",
ldapBackendConfig);
validateUserSearch("ldap*", 2, Set.of("ldaptest1", "ldaptest2"));
}
@Test
public void testSearchUsersNoneFound() throws Exception {
- ldapProxyBackend.initialize(ldapBackendConfig);
+ ldapProxyBackend = new LdapProxyBackend("testbackend",
ldapBackendConfig);
List<Entry> entries = ldapProxyBackend.searchUsers("nobody*",
schemaManager);
assertTrue(entries.isEmpty());
}
@@ -295,21 +291,21 @@ public class LdapProxyBackendTest {
@Test
public void testSearchUsersByCn() throws Exception {
Map<String, String> config = createConfigWithUserAttr("cn");
- ldapProxyBackend.initialize(config);
+ ldapProxyBackend = new LdapProxyBackend("testbackend", config);
validateUserSearch("*", 3, Set.of("TestCn1", "TestCn2", "Guest"));
}
@Test
public void testSearchUsersPartialByCn() throws Exception {
Map<String, String> config = createConfigWithUserAttr("cn");
- ldapProxyBackend.initialize(config);
+ ldapProxyBackend = new LdapProxyBackend("testbackend", config);
validateUserSearch("TestCn*", 2, Set.of("TestCn1", "TestCn2"));
}
@Test
public void testSearchUsersNoneFoundByCn() throws Exception {
Map<String, String> config = createConfigWithUserAttr("cn");
- ldapProxyBackend.initialize(config);
+ ldapProxyBackend = new LdapProxyBackend("testbackend", config);
List<Entry> entries = ldapProxyBackend.searchUsers("nobody*",
schemaManager);
assertTrue(entries.isEmpty());
}
@@ -317,21 +313,21 @@ public class LdapProxyBackendTest {
@Test
public void testSearchUsersBySAMAccountName() throws Exception {
Map<String, String> config =
createConfigWithUserAttr("sAMAccountName");
- ldapProxyBackend.initialize(config);
+ ldapProxyBackend = new LdapProxyBackend("testbackend", config);
validateUserSearch("*", 2, Set.of("TestSam1", "TestSam2"));
}
@Test
public void testSearchUsersPartialBySAMAccountName() throws Exception {
Map<String, String> config =
createConfigWithUserAttr("sAMAccountName");
- ldapProxyBackend.initialize(config);
+ ldapProxyBackend = new LdapProxyBackend("testbackend", config);
validateUserSearch("TestSam*", 2, Set.of("TestSam1", "TestSam2"));
}
@Test
public void testSearchUsersNoneFoundBySAMAccountName() throws Exception {
Map<String, String> config =
createConfigWithUserAttr("sAMAccountName");
- ldapProxyBackend.initialize(config);
+ ldapProxyBackend = new LdapProxyBackend("testbackend", config);
List<Entry> entries = ldapProxyBackend.searchUsers("nobody*",
schemaManager);
assertTrue(entries.isEmpty());
}
@@ -339,7 +335,7 @@ public class LdapProxyBackendTest {
@Test
public void testGetRecursiveUserGroupsDepth2() throws Exception {
Map<String, String> config = createRecursiveConfig(2);
- ldapProxyBackend.initialize(config);
+ ldapProxyBackend = new LdapProxyBackend("testbackend", config);
List<String> userGroups =
ldapProxyBackend.getUserGroups("recursiveUser");
assertEquals(4, userGroups.size());
@@ -352,7 +348,7 @@ public class LdapProxyBackendTest {
@Test
public void testGetRecursiveUserGroupsDepth4() throws Exception {
Map<String, String> config = createRecursiveConfig(4);
- ldapProxyBackend.initialize(config);
+ ldapProxyBackend = new LdapProxyBackend("testbackend", config);
List<String> userGroups =
ldapProxyBackend.getUserGroups("recursiveUser");
assertEquals(6, userGroups.size());
@@ -367,7 +363,7 @@ public class LdapProxyBackendTest {
@Test
public void testGetRecursiveUserGroupsWithCycle() throws Exception {
Map<String, String> config = createRecursiveConfig(10);
- ldapProxyBackend.initialize(config);
+ ldapProxyBackend = new LdapProxyBackend("testbackend", config);
List<String> userGroups =
ldapProxyBackend.getUserGroups("recursiveUser");
assertTrue(userGroups.contains("cycleGroupA"));
@@ -377,7 +373,7 @@ public class LdapProxyBackendTest {
@Test
public void testGetUserRecursiveGroups() throws Exception {
Map<String, String> config = createRecursiveConfig(5);
- ldapProxyBackend.initialize(config);
+ ldapProxyBackend = new LdapProxyBackend("testbackend", config);
Entry entry = ldapProxyBackend.getUser("recursiveUser", schemaManager);
validateMemberOf(entry, Set.of(
@@ -394,7 +390,7 @@ public class LdapProxyBackendTest {
Map<String, String> config = createRecursiveConfig(5);
final AtomicInteger cacheHits = new AtomicInteger(0);
- ldapProxyBackend = new LdapProxyBackend() {
+ ldapProxyBackend = new LdapProxyBackend("testbackend", config) {
@Override
protected Map<String, Set<Entry>> createResolvedParentsCache() {
return new HashMap<>() {
@@ -408,7 +404,6 @@ public class LdapProxyBackendTest {
};
}
};
- ldapProxyBackend.initialize(config);
// Search for all recursive users (recursiveUser and recursiveUser2)
// They share level1Group, cycleGroupA, and all their ancestors.
diff --git
a/gateway-server/src/test/java/org/apache/knox/gateway/services/ldap/interceptor/DuplicateUserFilteringInterceptorTest.java
b/gateway-server/src/test/java/org/apache/knox/gateway/services/ldap/interceptor/DuplicateUserFilteringInterceptorTest.java
new file mode 100644
index 000000000..828937074
--- /dev/null
+++
b/gateway-server/src/test/java/org/apache/knox/gateway/services/ldap/interceptor/DuplicateUserFilteringInterceptorTest.java
@@ -0,0 +1,166 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.knox.gateway.services.ldap.interceptor;
+
+import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertFalse;
+import static org.junit.Assert.assertTrue;
+
+import org.apache.directory.api.ldap.model.cursor.ListCursor;
+import org.apache.directory.api.ldap.model.entry.Attribute;
+import org.apache.directory.api.ldap.model.entry.DefaultEntry;
+import org.apache.directory.api.ldap.model.entry.Entry;
+import org.apache.directory.api.ldap.model.entry.Value;
+import org.apache.directory.api.ldap.model.exception.LdapException;
+import org.apache.directory.api.ldap.model.schema.SchemaManager;
+import org.apache.directory.server.core.api.CoreSession;
+import org.apache.directory.server.core.api.DirectoryService;
+import org.apache.directory.server.core.api.filtering.EntryFilteringCursor;
+import org.apache.directory.server.core.api.filtering.EntryFilteringCursorImpl;
+import org.apache.directory.server.core.api.interceptor.BaseInterceptor;
+import
org.apache.directory.server.core.api.interceptor.context.SearchOperationContext;
+import org.apache.knox.gateway.security.ldap.SimpleDirectoryService;
+import org.apache.knox.gateway.services.ldap.SchemaManagerFactory;
+import org.junit.After;
+import org.junit.Before;
+import org.junit.Test;
+
+import java.util.List;
+
+/**
+ * Unit tests for DuplicateUserFilteringInterceptor.
+ */
+public class DuplicateUserFilteringInterceptorTest {
+
+ private static final String TEST_INTERCEPTOR = "TEST";
+ private static final String NEXT_INTERCEPTOR = "NEXT";
+
+ private DuplicateUserFilteringInterceptor interceptor;
+
+ private DirectoryService directoryService;
+ private SchemaManager schemaManager;
+ private ConfigurableEntriesTestInterceptor nextInterceptor;
+ private SearchOperationContext ctx;
+ private CoreSession session;
+
+ @Before
+ public void setUp() throws Exception {
+ directoryService = new SimpleDirectoryService();
+ directoryService.setShutdownHookEnabled(false);
+ schemaManager = SchemaManagerFactory.createSchemaManager();
+ directoryService.setSchemaManager(schemaManager);
+
+ interceptor = new DuplicateUserFilteringInterceptor(TEST_INTERCEPTOR);
+ interceptor.init(directoryService);
+ directoryService.addLast(interceptor);
+
+ nextInterceptor = new
ConfigurableEntriesTestInterceptor(NEXT_INTERCEPTOR);
+ nextInterceptor.init(directoryService);
+ directoryService.addLast(nextInterceptor);
+
+ session = directoryService.getSession();
+
+ ctx = new SearchOperationContext(session);
+ ctx.setInterceptors(List.of(TEST_INTERCEPTOR, NEXT_INTERCEPTOR));
+
+ }
+
+ @After
+ public void tearDown() throws Exception {
+ directoryService.shutdown();
+ }
+
+ @Test
+ public void testEmptyCursor() throws Exception {
+ nextInterceptor.setEntries(List.of());
+
+ try (EntryFilteringCursor results = interceptor.search(ctx)) {
+ assertFalse("Results should be empty", results.next());
+ }
+
+ EntryFilteringCursor nextInterceptorCursor =
nextInterceptor.getCursor();
+ assertTrue("Cursor must be closed", nextInterceptorCursor.isClosed());
+ }
+
+ @Test
+ public void testNoDuplicateEntries() throws Exception {
+ Entry entry1 = new DefaultEntry(schemaManager);
+ entry1.add("uid", "user1");
+ Entry entry2 = new DefaultEntry(schemaManager);
+ entry2.add("uid", "user2");
+ nextInterceptor.setEntries(List.of(entry1, entry2));
+
+ try (EntryFilteringCursor results = interceptor.search(ctx)) {
+ assertNextEntryUid(results, "user1");
+ assertNextEntryUid(results, "user2");
+ assertFalse("No more entries expected", results.next());
+ }
+
+ EntryFilteringCursor nextInterceptorCursor =
nextInterceptor.getCursor();
+ assertTrue("Cursor must be closed", nextInterceptorCursor.isClosed());
+ }
+
+ @Test
+ public void testDuplicateEntries() throws Exception {
+ Entry entry1 = new DefaultEntry(schemaManager);
+ entry1.add("uid", "user1");
+ Entry entry2 = new DefaultEntry(schemaManager);
+ entry2.add("uid", "user1");
+ nextInterceptor.setEntries(List.of(entry1, entry2));
+
+ try (EntryFilteringCursor results = interceptor.search(ctx)) {
+ assertNextEntryUid(results, "user1");
+ assertFalse("No more entries expected", results.next());
+ }
+
+ EntryFilteringCursor nextInterceptorCursor =
nextInterceptor.getCursor();
+ assertTrue("Cursor must be closed", nextInterceptorCursor.isClosed());
+ }
+
+ private void assertNextEntryUid(EntryFilteringCursor cursor, String uid)
throws Exception {
+ assertTrue("Cursor should have another entry", cursor.next());
+ Entry entry = cursor.get();
+ Attribute uidAttr = entry.get("uid");
+ assertEquals("Attribute should have only one value", 1,
uidAttr.size());
+ Value value = uidAttr.get();
+ assertEquals("Uid should match " + uid, uid, value.getString());
+ }
+
+ private static class ConfigurableEntriesTestInterceptor extends
BaseInterceptor {
+ private List<Entry> entries;
+ private EntryFilteringCursor cursor;
+
+ ConfigurableEntriesTestInterceptor(String name) {
+ super(name);
+ }
+
+ public void setEntries(List<Entry> entries) {
+ this.entries = entries;
+ }
+
+ public EntryFilteringCursor getCursor() {
+ return cursor;
+ }
+
+ @Override
+ public EntryFilteringCursor search(SearchOperationContext
searchContext) throws LdapException {
+ cursor = new EntryFilteringCursorImpl(new ListCursor<>(entries),
searchContext, schemaManager);
+ return cursor;
+ }
+ }
+}
\ No newline at end of file
diff --git
a/gateway-spi-common/src/main/java/org/apache/knox/gateway/GatewayTestConfig.java
b/gateway-spi-common/src/main/java/org/apache/knox/gateway/GatewayTestConfig.java
index 80ab4e0c8..745002ae3 100644
---
a/gateway-spi-common/src/main/java/org/apache/knox/gateway/GatewayTestConfig.java
+++
b/gateway-spi-common/src/main/java/org/apache/knox/gateway/GatewayTestConfig.java
@@ -1246,8 +1246,8 @@ public class GatewayTestConfig extends Configuration
implements GatewayConfig {
}
@Override
- public String getLDAPBackendType() {
- return "file";
+ public List<String> getLDAPInterceptorNames() {
+ return List.of("testinterceptor");
}
@Override
@@ -1261,7 +1261,7 @@ public class GatewayTestConfig extends Configuration
implements GatewayConfig {
}
@Override
- public Map<String, String> getLDAPBackendConfig(String backendType) {
+ public Map<String, String> getLDAPInterceptorConfig(String backendType) {
return Collections.emptyMap();
}
diff --git
a/gateway-spi/src/main/java/org/apache/knox/gateway/config/GatewayConfig.java
b/gateway-spi/src/main/java/org/apache/knox/gateway/config/GatewayConfig.java
index 6116a3d4c..7ecb2980d 100644
---
a/gateway-spi/src/main/java/org/apache/knox/gateway/config/GatewayConfig.java
+++
b/gateway-spi/src/main/java/org/apache/knox/gateway/config/GatewayConfig.java
@@ -128,7 +128,7 @@ public interface GatewayConfig {
String LDAP_ENABLED = "gateway.ldap.enabled";
String LDAP_PORT = "gateway.ldap.port";
String LDAP_BASE_DN = "gateway.ldap.base.dn";
- String LDAP_BACKEND_TYPE = "gateway.ldap.backend.type";
+ String LDAP_INTERCEPTOR_NAMES = "gateway.ldap.interceptor.names";
String LDAP_BACKEND_DATA_FILE = "gateway.ldap.backend.data.file";
String LDAP_RECURSIVE_GROUP_RESOLUTION =
"gateway.ldap.recursive.group.resolution";
String LDAP_RECURSIVE_GROUP_RESOLUTION_MAX_DEPTH =
"gateway.ldap.recursive.group.resolution.max.depth";
@@ -1069,10 +1069,10 @@ public interface GatewayConfig {
*/
String getLDAPBaseDN();
- /**
- * @return the backend type for LDAP (file, ldap, jdbc, etc.)
- */
- String getLDAPBackendType();
+ /**
+ * @return the list of interceptor names for LDAP server
+ */
+ List<String> getLDAPInterceptorNames();
/**
* @return the path to the data file for file-based backend
@@ -1080,14 +1080,14 @@ public interface GatewayConfig {
String getLDAPBackendDataFile();
/**
- * Get backend-specific configuration properties.
- * Returns all properties with prefix "gateway.ldap.backend.{backendType}."
+ * Get interceptor-specific configuration properties.
+ * Returns all properties with prefix
"gateway.ldap.interceptor.{interceptorName}."
* with the prefix stripped from the keys.
*
- * @param backendType the backend type (e.g., "file", "ldap", "database")
+ * @param interceptor the interceptor name
* @return map of configuration key-value pairs for the specified backend
*/
- Map<String, String> getLDAPBackendConfig(String backendType);
+ Map<String, String> getLDAPInterceptorConfig(String interceptor);
/**
* @return true if recursive group resolution is enabled for LDAP service
diff --git a/knox-site/docs/service_ldap_server.md
b/knox-site/docs/service_ldap_server.md
index 51080f69a..1ad0f1ab0 100644
--- a/knox-site/docs/service_ldap_server.md
+++ b/knox-site/docs/service_ldap_server.md
@@ -7,7 +7,8 @@ The Knox LDAP Service provides an embedded LDAP server within
the Knox Gateway.
Introduced in [KNOX-3247](https://issues.apache.org/jira/browse/KNOX-3247),
the Knox LDAP Service leverages Apache Directory Server (ApacheDS) to provide a
lightweight, embedded LDAP server. Its primary goal is to provide a consistent
LDAP interface for authentication and group lookups, even when the underlying
identity store is not a traditional LDAP server or is a remote server that
requires proxying.
Key features include:
-- **Pluggable Backends**: Support for different data sources (JSON files,
remote LDAP/AD).
+- **Pluggable LDAP Interceptors**: Support for customization of LDAP search
behavior including combining results from multiple LDAP backends.
+- **Pluggable Backends**: Support for multiple, different data sources (JSON
files, remote LDAP/AD).
- **Embedded Server**: No need for an external LDAP server for simple use
cases or testing.
- **Active Directory Integration**: Optimized for proxying to AD with support
for `sAMAccountName`.
@@ -16,13 +17,13 @@ Key features include:
The Knox LDAP Service is integrated as a core gateway service. It consists of
the following components:
1. **KnoxLDAPServerManager**: Manages the lifecycle of the ApacheDS instance.
-2. **GroupLookupInterceptor**: A custom ApacheDS interceptor that captures
search requests. If an entry is not found in the local ApacheDS partitions, it
delegates the lookup to the configured backend.
-3. **LdapBackend**: A pluggable interface for fetching user and group data.
+2. **UserLookupInterceptor**: A custom ApacheDS interceptor that captures
search requests. If an entry is not found in the local ApacheDS partitions, it
delegates the lookup to the configured backend.
+3. **LdapBackend**: A pluggable interface for fetching user and group data.
Implementations are included for reading users from a file or connecting to a
remote LDAP server.
4. **SchemaManagerFactory**: Programmatically extends the ApacheDS schema to
include AD-specific attributes like `sAMAccountName`.
When a client performs an LDAP search:
1. The request hits the embedded ApacheDS server.
-2. The `GroupLookupInterceptor` intercepts the search.
+2. The `UserLookupInterceptor` intercepts the search.
3. The interceptor checks the results of the local search.
4. If not found, it queries the configured `LdapBackend`.
5. Results from the backend are converted into LDAP entries and returned to
the client.
@@ -38,17 +39,39 @@ The service is configured in `gateway-site.xml`.
| `gateway.ldap.enabled` | `false` | Enables or disables the embedded LDAP
service. |
| `gateway.ldap.port` | `3890` | The port on which the LDAP server listens. |
| `gateway.ldap.base.dn` | `dc=proxy,dc=com` | The base DN for the LDAP
server. |
-| `gateway.ldap.backend.type` | `file` | The type of backend to use (`file` or
`proxy`). |
+| `gateway.ldap.interceptor.names` | N/A | A comma separated list of
interceptors to use. A separate interceptor configuration block will be used
for each name. |
+
+### Interceptor Types
+
+#### Common Interceptor Properties
+
+| Property | Default Value | Description |
+| :--- | :--- | :--- |
+| `gateway.ldap.interceptor.<name>.interceptorType` | N/A | The type of
interceptor to use (`backend` or `duplicateuserfilter`). |
+
+#### Duplicate User Filter Interceptor (`backend`)
+
+The duplicate user filter interceptor ensures that each `Entry` has a unique
`uid`. This interceptor removes entries that have a duplicate `uid`.
+
+#### User Search Interceptor (`duplicateuserfilter`)
+
+The user search interceptor is created if the `interceptorType` configuration
is set to `backend`. This interceptor forwards search queries to its configured
backend.
### Backend Types
+#### Common Backend Properties
+
+| Property | Default Value | Description |
+| :--- | :--- | :--- |
+| `gateway.ldap.interceptor.<name>.backendType` | N/A | The type of backend to
use (`file` or `ldap`). |
+
#### File Backend (`file`)
The file backend reads user and group definitions from a JSON file. This is
ideal for testing or small, static environments.
| Property | Default Value | Description |
| :--- | :--- | :--- |
-| `gateway.ldap.backend.data.file` | `${GATEWAY_DATA_HOME}/ldap-users.json` |
Path to the JSON data file. |
+| `gateway.ldap.interceptor.<name>.file` |
`${GATEWAY_DATA_HOME}/ldap-users.json` | Path to the JSON data file. |
**JSON File Format Example:**
```json
@@ -67,24 +90,24 @@ The file backend reads user and group definitions from a
JSON file. This is idea
}
```
-#### Proxy Backend (`proxy`)
+#### LDAP Proxy Backend (`ldap`)
The proxy backend delegates lookups to a remote LDAP or Active Directory
server.
| Property | Default Value | Description |
| :--- | :--- | :--- |
-| `gateway.ldap.backend.proxy.url` | N/A | Remote LDAP URL (e.g.,
`ldap://remote-host:389`). |
-| `gateway.ldap.backend.proxy.host` | N/A | Host of remote LDAP (used if `url`
is not provided). |
-| `gateway.ldap.backend.proxy.port` | N/A | Port of remote LDAP (used if `url`
is not provided). |
-| `gateway.ldap.backend.proxy.remoteBaseDn` | N/A | **Required**. The base DN
of the remote LDAP server. |
-| `gateway.ldap.backend.proxy.systemUsername` | N/A | Bind DN for the remote
server (alias: `bindDn`). |
-| `gateway.ldap.backend.proxy.systemPassword` | N/A | Password for the bind DN
(alias: `bindPassword`). |
-| `gateway.ldap.backend.proxy.userSearchBase` | `ou=people,{remoteBaseDn}` |
Base DN for user searches on the remote server. |
-| `gateway.ldap.backend.proxy.groupSearchBase` | `ou=groups,{remoteBaseDn}` |
Base DN for group searches on the remote server. |
-| `gateway.ldap.backend.proxy.userIdentifierAttribute` | `uid` | Attribute
used for user lookup (e.g., `sAMAccountName` for AD). |
-| `gateway.ldap.backend.proxy.groupMemberAttribute` | `memberUid` | Attribute
used for group membership (e.g., `member` for AD). |
-| `gateway.ldap.backend.proxy.useMemberOf` | `false` | If `true`, use the
`memberOf` attribute for efficient group lookups. |
-| `gateway.ldap.backend.proxy.poolMaxActive` | `8` | Maximum number of active
connections in the pool. |
+| `gateway.ldap.interceptor.<name>.url` | N/A | Remote LDAP URL (e.g.,
`ldap://remote-host:389`). |
+| `gateway.ldap.interceptor.<name>.host` | N/A | Host of remote LDAP (used if
`url` is not provided). |
+| `gateway.ldap.interceptor.<name>.port` | N/A | Port of remote LDAP (used if
`url` is not provided). |
+| `gateway.ldap.interceptor.<name>.remoteBaseDn` | N/A | **Required**. The
base DN of the remote LDAP server. |
+| `gateway.ldap.interceptor.<name>.systemUsername` | N/A | Bind DN for the
remote server (alias: `bindDn`). |
+| `gateway.ldap.interceptor.<name>.systemPassword` | N/A | Password for the
bind DN (alias: `bindPassword`). |
+| `gateway.ldap.interceptor.<name>.userSearchBase` |
`ou=people,{remoteBaseDn}` | Base DN for user searches on the remote server. |
+| `gateway.ldap.interceptor.<name>.groupSearchBase` |
`ou=groups,{remoteBaseDn}` | Base DN for group searches on the remote server. |
+| `gateway.ldap.interceptor.<name>.userIdentifierAttribute` | `uid` |
Attribute used for user lookup (e.g., `sAMAccountName` for AD). |
+| `gateway.ldap.interceptor.<name>.groupMemberAttribute` | `memberUid` |
Attribute used for group membership (e.g., `member` for AD). |
+| `gateway.ldap.interceptor.<name>.useMemberOf` | `false` | If `true`, use the
`memberOf` attribute for efficient group lookups. |
+| `gateway.interceptor.<name>.proxy.poolMaxActive` | `8` | Maximum number of
active connections in the pool. |
## Active Directory (AD) Integration
@@ -95,11 +118,12 @@ The Knox LDAP Service includes several optimizations for
working with Active Dir
- **Schema Extensions**: AD-specific attributes (`memberOf`, `sAMAccountName`)
are programmatically added to the embedded ApacheDS schema to prevent
"attribute not found" errors during proxying.
- **Case Sensitivity**: Search filters are handled to accommodate AD's
case-insensitive nature for user identifiers.
-## Usage Example (AD Proxy)
+## Usage Example
-To configure Knox to act as an LDAP proxy for an Active Directory server:
+To configure Knox to act as an LDAP proxy for a local file and an Active
Directory server:
```xml
+<!-- LDAP Proxy Service Configuration -->
<property>
<name>gateway.ldap.enabled</name>
<value>true</value>
@@ -109,37 +133,74 @@ To configure Knox to act as an LDAP proxy for an Active
Directory server:
<value>389</value>
</property>
<property>
- <name>gateway.ldap.backend.type</name>
- <value>proxy</value>
+ <name>gateway.ldap.base.dn</name>
+ <value>dc=proxy,dc=com</value>
+</property>
+
+<property>
+ <name>gateway.ldap.interceptor.names</name>
+ <value>localfile,adexample,duplicatefilter</value>
+</property>
+
+<!-- File-based LDAP backend -->
+<property>
+ <name>gateway.ldap.interceptor.localfile.interceptorType</name>
+ <value>backend</value>
+</property>
+<property>
+ <name>gateway.ldap.interceptor.localfile.backendType</name>
+ <value>file</value>
+</property>
+<property>
+ <name>gateway.ldap.interceptor.localfile.file</name>
+ <value>${GATEWAY_DATA_HOME}/ldap-users.json</value>
+</property>
+
+<!-- LDAP backend proxy configuration -->
+<property>
+ <name>gateway.ldap.interceptor.adexample.interceptorType</name>
+ <value>backend</value>
+</property>
+<property>
+ <name>gateway.ldap.interceptor.adexample.backendType</name>
+ <value>ldap</value>
</property>
<property>
- <name>gateway.ldap.backend.proxy.url</name>
+ <name>gateway.ldap.interceptor.adexample.url</name>
<value>ldap://ad.example.com:389</value>
</property>
<property>
- <name>gateway.ldap.backend.proxy.remoteBaseDn</name>
+ <name>gateway.ldap.interceptor.adexample.remoteBaseDn</name>
<value>dc=example,dc=com</value>
</property>
<property>
- <name>gateway.ldap.backend.proxy.systemUsername</name>
- <value>CN=ReadOnlyUser,CN=Users,DC=example,DC=com</value>
+ <name>gateway.ldap.interceptor.adexample.systemUsername</name>
+ <value>cn=ReadOnlyUser,cn=Users,dc=example,dc=com</value>
</property>
<property>
- <name>gateway.ldap.backend.proxy.systemPassword</name>
- <value>secret-password</value>
+ <name>gateway.ldap.interceptor.adexample.systemPassword</name>
+ <value>guest-password</value>
</property>
<property>
- <name>gateway.ldap.backend.proxy.userIdentifierAttribute</name>
+ <name>gateway.ldap.interceptor.adexample.userIdentifierAttribute</name>
<value>sAMAccountName</value>
</property>
<property>
- <name>gateway.ldap.backend.proxy.groupMemberAttribute</name>
+ <name>gateway.ldap.interceptor.adexample.groupMemberAttribute</name>
<value>member</value>
</property>
<property>
- <name>gateway.ldap.backend.proxy.useMemberOf</name>
+ <name>gateway.ldap.interceptor.adexample.useMemberOf</name>
<value>true</value>
</property>
+
+<!-- Duplicate Filter Interceptor -->
+<property>
+ <name>gateway.ldap.interceptor.duplicatefilter.interceptorType</name>
+ <value>duplicateuserfilter</value>
+</property>
+
+<!-- End LDAP Proxy Service Configuration -->
```
## Troubleshooting
