[
https://issues.apache.org/jira/browse/KNOX-3337?focusedWorklogId=1023534&page=com.atlassian.jira.plugin.system.issuetabpanels:worklog-tabpanel#worklog-1023534
]
ASF GitHub Bot logged work on KNOX-3337:
----------------------------------------
Author: ASF GitHub Bot
Created on: 03/Jun/26 14:21
Start Date: 03/Jun/26 14:21
Worklog Time Spent: 10m
Work Description: github-actions[bot] commented on PR #1247:
URL: https://github.com/apache/knox/pull/1247#issuecomment-4613351535
## Test Results
22 tests 22 ✅ 2s ⏱️
1 suites 0 💤
1 files 0 ❌
Results for commit 01a57494.
[test-results]:data:application/gzip;base64,H4sIAE44IGoC/12Myw7CIBBFf6Vh7QKYobX+jEEeycS2GB4r479Lq8HW3T3nJufJPE0usUsnTh1LhXIDW6LOFJaKsmI98nrJBtdUjPkzd3pUw5vwmqaDcDGG+DWxLK247kPwI369jXe5jfc1E+aZcgXGhVYDjghCegO9QlBoYJQ9qNtZowPrQAyWs9cbbnhLUv8AAAA=
Issue Time Tracking
-------------------
Worklog Id: (was: 1023534)
Time Spent: 0.5h (was: 20m)
> Enhance KnoxLdapService with Pluggable Role Lookup Support
> ----------------------------------------------------------
>
> Key: KNOX-3337
> URL: https://issues.apache.org/jira/browse/KNOX-3337
> Project: Apache Knox
> Issue Type: Improvement
> Components: Server
> Affects Versions: 3.0.0
> Reporter: Sandor Molnar
> Assignee: Sandor Molnar
> Priority: Critical
> Fix For: 3.0.0
>
> Time Spent: 0.5h
> Remaining Estimate: 0h
>
> Currently, the KnoxLdapService provides user and group information directly
> from its configured LDAP backend. In many deployment scenarios, particularly
> in modern cloud-native environments, there is a requirement to map these
> LDAP-authenticated identities and their group memberships to higher-level
> application roles managed by an external source.
> This JIRA introduces a pluggable role lookup mechanism within KnoxLdapService
> that allows Knox to intercept group resolution and instead populate roles
> from either a local configuration file (for testing purposes) or a remote
> REST API.
> *Key Features*
> 1. *Pluggable Interface:* Introduction of LdapRolesLookup to allow for
> extensible lookup strategies.
> 2. *REST Implementation:* A client implementation that POSTs user ID and
> group lists to a configured endpoint to retrieve role mappings, following a
> specific OpenAPI schema.
> 3. *File-based Implementation:* A JSON-based lookup strategy for static
> environments, using the same data structure as the REST API.
> 4. *Configuration-driven:* New gateway-site.xml properties to toggle
> lookup types and configure endpoints or file paths.
> *Proposed Configuration*
> * {{{}gateway.ldap.roles.lookup.strategy{}}}: Enables the lookup (file or
> rest).
> * {{{}gateway.ldap.roles.lookup.rest.api.endpoint{}}}: The destination URL
> for REST lookups.
> * {{{}gateway.ldap.roles.lookup.file.path{}}}: the file path which points to
> the JSON mapping file.
> *Data Contract:*
> The implementation will exchange JSON payloads containing a user_id and an
> array of groups, receiving a response containing a list of RoleAssignment
> objects (consisting of scope and name).
>
> This enhancement will allow for more dynamic and flexible authorization
> workflows in Knox-managed environments.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
