[
https://issues.apache.org/jira/browse/KNOX-3374?focusedWorklogId=1028643&page=com.atlassian.jira.plugin.system.issuetabpanels:worklog-tabpanel#worklog-1028643
]
ASF GitHub Bot logged work on KNOX-3374:
----------------------------------------
Author: ASF GitHub Bot
Created on: 08/Jul/26 08:29
Start Date: 08/Jul/26 08:29
Worklog Time Spent: 10m
Work Description: hanicz opened a new pull request, #1300:
URL: https://github.com/apache/knox/pull/1300
…les-lookup interceptor is active
[KNOX-3374](https://issues.apache.org/jira/browse/KNOX-3374) - Inherited
roles missing from auth headers when LDAP roles-lookup interceptor is active
## What changes were proposed in this pull request?
- `KnoxLDAPServerManager.getUserGroups()` now attaches a
`RolesLookupBypassControl` to its LDAP search, so it returns raw group names
instead of interceptor-rewritten role names.
- Eliminates a double roles-lookup: `LDAPRolesLookupInterceptor` was
rewriting memberOf to roles, and `AbstractAuthResource` then called the roles
API again with those roles-as-groups — which returned only the user's direct
roles, dropping inherited ones.
- External LDAP-proxy clients are unaffected; the interceptor still rewrites
memberOf on their searches.
- New
`KnoxLDAPServerManagerTest#testGetUserGroupsReturnsRawGroupsEvenWhenRolesInterceptorRewritesMemberOf`
— installs the real roles interceptor over a test entries interceptor serving
a user with memberOf group DNs; asserts getUserGroups returns raw group names,
not the mocked roles.
## How was this patch tested?
Unit tests
E2Etests:
Without changes:
```
ldapsearch -x -H ldap://localhost:10389 \
-D "uid=admin,ou=people,dc=hadoop,dc=apache,dc=org" -w admin-password \
-b "dc=hadoop,dc=apache,dc=org" "(uid=admin)" memberOf
# admin, people, hadoop.apache.org
dn: uid=admin,ou=people,dc=hadoop,dc=apache,dc=org
memberOf: cn=ws-1:viewer,ou=groups,ou=groups,dc=hadoop,dc=apache,dc=org
memberOf: cn=ws-2:user,ou=groups,ou=groups,dc=hadoop,dc=apache,dc=org
```
```
curl -kvs -u admin:admin-password \
https://localhost:8443/gateway/sandbox/auth/api/v1/extauthz/anything
< username: admin
< roles: console:admin
```
With the fix:
```
ldapsearch -x -H ldap://localhost:10389 \
-D "uid=admin,ou=people,dc=hadoop,dc=apache,dc=org" -w admin-password \
-b "dc=hadoop,dc=apache,dc=org" "(uid=admin)" memberOf
# admin, people, hadoop.apache.org
dn: uid=admin,ou=people,dc=hadoop,dc=apache,dc=org
memberOf: cn=ws-1:viewer,ou=groups,ou=groups,dc=hadoop,dc=apache,dc=org
memberOf: cn=ws-2:user,ou=groups,ou=groups,dc=hadoop,dc=apache,dc=org
```
```
curl -kvs -u admin:admin-password \
https://localhost:8443/gateway/sandbox/auth/api/v1/extauthz/anything
< username: admin
< roles: ws-1:viewer,console:admin,ws-2:user
```
## Integration Tests
N/A
## UI changes
N/A
Issue Time Tracking
-------------------
Worklog Id: (was: 1028643)
Remaining Estimate: 0h
Time Spent: 10m
> Inherited roles missing from auth headers when LDAP roles-lookup interceptor
> is active
> --------------------------------------------------------------------------------------
>
> Key: KNOX-3374
> URL: https://issues.apache.org/jira/browse/KNOX-3374
> Project: Apache Knox
> Issue Type: Bug
> Components: Server
> Affects Versions: 3.0.0
> Reporter: Tamás Hanicz
> Assignee: Tamás Hanicz
> Priority: Major
> Time Spent: 10m
> Remaining Estimate: 0h
>
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
