hanicz opened a new pull request, #1301: URL: https://github.com/apache/knox/pull/1301
…lesLookupInterceptor is enabled [KNOX-3374](https://issues.apache.org/jira/browse/KNOX-3374) - Fix inherited roles missing from auth headers when LDAP roles-lookup interceptor is active ## What changes were proposed in this pull request? Reworked the KNOX-3374 fix per review feedback. - Revert previous [PR](https://github.com/apache/knox/pull/1300) - `AbstractAuthResource` checks for `rolesLookupInterceptor` enabled. 1. **Interceptor configured**: the Subject's GroupPrincipal's are already role names. 2. **Interceptor not configured**: Subject has raw groups, lookupRoles call is necessary. - New unit tests to verify the behaviour ## How was this patch tested? Unit tests, manual e2e tests Roles: ``` [ { "id": "admin", "type": "user", "roles": [ { "scope": "console", "name": "admin" } ] }, { "id": "me-test-group-a", "type": "group", "roles": [ { "scope": "ws-1", "name": "viewer" } ] }, { "id": "me-test-group-b", "type": "group", "roles": [ { "scope": "ws-2", "name": "user" } ] } ] ``` Tested with rolesLookupInterceptor enabled and disabled ``` curl -kvs -u admin:admin-password \ https://localhost:8443/gateway/sandbox/auth/api/v1/extauthz/anything < username: admin < roles: ws-1:viewer,console:admin,ws-2:user ``` ## Integration Tests N/A ## UI changes N/A -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
