hanicz opened a new pull request, #1300: URL: https://github.com/apache/knox/pull/1300
…les-lookup interceptor is active [KNOX-3374](https://issues.apache.org/jira/browse/KNOX-3374) - Inherited roles missing from auth headers when LDAP roles-lookup interceptor is active ## What changes were proposed in this pull request? - `KnoxLDAPServerManager.getUserGroups()` now attaches a `RolesLookupBypassControl` to its LDAP search, so it returns raw group names instead of interceptor-rewritten role names. - Eliminates a double roles-lookup: `LDAPRolesLookupInterceptor` was rewriting memberOf to roles, and `AbstractAuthResource` then called the roles API again with those roles-as-groups — which returned only the user's direct roles, dropping inherited ones. - External LDAP-proxy clients are unaffected; the interceptor still rewrites memberOf on their searches. - New `KnoxLDAPServerManagerTest#testGetUserGroupsReturnsRawGroupsEvenWhenRolesInterceptorRewritesMemberOf` — installs the real roles interceptor over a test entries interceptor serving a user with memberOf group DNs; asserts getUserGroups returns raw group names, not the mocked roles. ## How was this patch tested? Unit tests E2Etests: Without changes: ``` ldapsearch -x -H ldap://localhost:10389 \ -D "uid=admin,ou=people,dc=hadoop,dc=apache,dc=org" -w admin-password \ -b "dc=hadoop,dc=apache,dc=org" "(uid=admin)" memberOf # admin, people, hadoop.apache.org dn: uid=admin,ou=people,dc=hadoop,dc=apache,dc=org memberOf: cn=ws-1:viewer,ou=groups,ou=groups,dc=hadoop,dc=apache,dc=org memberOf: cn=ws-2:user,ou=groups,ou=groups,dc=hadoop,dc=apache,dc=org ``` ``` curl -kvs -u admin:admin-password \ https://localhost:8443/gateway/sandbox/auth/api/v1/extauthz/anything < username: admin < roles: console:admin ``` With the fix: ``` ldapsearch -x -H ldap://localhost:10389 \ -D "uid=admin,ou=people,dc=hadoop,dc=apache,dc=org" -w admin-password \ -b "dc=hadoop,dc=apache,dc=org" "(uid=admin)" memberOf # admin, people, hadoop.apache.org dn: uid=admin,ou=people,dc=hadoop,dc=apache,dc=org memberOf: cn=ws-1:viewer,ou=groups,ou=groups,dc=hadoop,dc=apache,dc=org memberOf: cn=ws-2:user,ou=groups,ou=groups,dc=hadoop,dc=apache,dc=org ``` ``` curl -kvs -u admin:admin-password \ https://localhost:8443/gateway/sandbox/auth/api/v1/extauthz/anything < username: admin < roles: ws-1:viewer,console:admin,ws-2:user ``` ## Integration Tests N/A ## UI changes N/A -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
