[
https://issues.apache.org/jira/browse/KNOX-3374?focusedWorklogId=1028853&page=com.atlassian.jira.plugin.system.issuetabpanels:worklog-tabpanel#worklog-1028853
]
ASF GitHub Bot logged work on KNOX-3374:
----------------------------------------
Author: ASF GitHub Bot
Created on: 09/Jul/26 06:35
Start Date: 09/Jul/26 06:35
Worklog Time Spent: 10m
Work Description: hanicz opened a new pull request, #1301:
URL: https://github.com/apache/knox/pull/1301
…lesLookupInterceptor is enabled
[KNOX-3374](https://issues.apache.org/jira/browse/KNOX-3374) - Fix inherited
roles missing from auth headers when LDAP roles-lookup interceptor is active
## What changes were proposed in this pull request?
Reworked the KNOX-3374 fix per review feedback.
- Revert previous [PR](https://github.com/apache/knox/pull/1300)
- `AbstractAuthResource` checks for `rolesLookupInterceptor` enabled.
1. **Interceptor configured**: the Subject's GroupPrincipal's are already
role names.
2. **Interceptor not configured**: Subject has raw groups, lookupRoles
call is necessary.
- New unit tests to verify the behaviour
## How was this patch tested?
Unit tests, manual e2e tests
Roles:
```
[
{ "id": "admin", "type": "user",
"roles": [ { "scope": "console", "name": "admin" } ] },
{ "id": "me-test-group-a", "type": "group",
"roles": [ { "scope": "ws-1", "name": "viewer" } ] },
{ "id": "me-test-group-b", "type": "group",
"roles": [ { "scope": "ws-2", "name": "user" } ] }
]
```
Tested with rolesLookupInterceptor enabled and disabled
```
curl -kvs -u admin:admin-password \
https://localhost:8443/gateway/sandbox/auth/api/v1/extauthz/anything
< username: admin
< roles: ws-1:viewer,console:admin,ws-2:user
```
## Integration Tests
N/A
## UI changes
N/A
Issue Time Tracking
-------------------
Worklog Id: (was: 1028853)
Time Spent: 50m (was: 40m)
> Inherited roles missing from auth headers when LDAP roles-lookup interceptor
> is active
> --------------------------------------------------------------------------------------
>
> Key: KNOX-3374
> URL: https://issues.apache.org/jira/browse/KNOX-3374
> Project: Apache Knox
> Issue Type: Bug
> Components: Server
> Affects Versions: 3.0.0
> Reporter: Tamás Hanicz
> Assignee: Tamás Hanicz
> Priority: Major
> Fix For: 3.0.0
>
> Time Spent: 50m
> Remaining Estimate: 0h
>
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
