smolnar82 opened a new pull request, #1306: URL: https://github.com/apache/knox/pull/1306
[KNOX-3374](https://issues.apache.org/jira/browse/KNOX-3374) - Avoid duplicate LDAP roles lookup between the identity-assertion layer and the PreAuth/ExtAuthz auth services ## What changes were proposed in this pull request? During roles-lookup testing it turned out that Knox performed the remote roles lookup twice for a single request, and the second lookup could return the wrong roles: - once on the identity-assertion layer, while `HadoopGroupProviderFilter` resolves groups against Knox's embedded LDAP server (the `LDAPRolesLookupInterceptor` does the lookup as part of the group search), and - again in the `PreAuth` / `ExtAuthz` auth services (`AbstractAuthResource#lookupRoles`). Because the interceptor already looked roles up on the authentication layer, the second call in the auth resource is redundant. This PR makes the auth-service-level roles lookup conditional: it now happens only if - the roles-lookup service is enabled (existing condition), and - roles were not already looked up on the authentication layer. We deliberately keep the auth-service lookup for the case where the topology's Shiro config points to an external LDAP server (not Knox's embedded one) but roles are still wanted: a valid Apache scenario. The case where the interceptor is not configured but the roles-lookup service is present is not supported: those deployments must configure the `LDAPRolesLookupInterceptor`. **How it works** - A new request attribute constant `AbstractIdentityAssertionBase.ROLES_LOOKUP_EXECUTED` is introduced to flag, per request, that roles were already resolved on the authentication layer. - `HadoopGroupProviderFilter` sets this attribute when it resolves groups via `KnoxLDAPService` and the embedded LDAP server has the roles-lookup interceptor active. To support this, `KnoxLDAPService/KnoxLDAPServerManager` now expose `hasRolesLookupInterceptor()`, computed once at startup from the configured interceptor chain. - Because the interceptor already performs the lookup,` KnoxLDAPServerManager#getUserGroups` no longer attaches the `RolesLookupBypassControl` to the group search request (reverted changes from #1300). - `AbstractAuthResource` reads the attribute (via a new abstract `getRequest()` implemented by PreAuthResource and ExtAuthzResource) and skips its own lookupRoles call - and emits a single roles header - when roles were already resolved upstream. - The `mapGroupPrincipals(...)` SPI method gains a `ServletRequest` parameter so implementations can decorate the request with the flag. All identity-assertion filters (common, concat, hadoop-groups, no-doas, pseudo, regex, switchcase) are updated for the new signature. ## How was this patch tested? Ran the affected module unit tests (`gateway-provider-identity-assertion-*, gateway-service-auth, gateway-server`). Added / updated unit tests: - `HadoopGroupProviderFilterTest#testLdapServiceIntegrationWithRolesLookupInterceptor` - verifies the `ROLES_LOOKUP_EXECUTED` attribute is set on the request when the interceptor is active. - `PreAuthResourceTest#testRolesAreNotPopulatedTwice` - verifies the auth resource does not call lookupRoles again (strict mock) and emits the roles header only once when the flag is set. - `ExtAuthzResourceTest / PreAuthResourceTest` updated to inject the `HttpServletRequest` and stub the `ROLES_LOOKUP_EXECUTED` attribute. - All `mapGroupPrincipals(...)` call sites in existing filter tests updated for the new signature. - Removed `KnoxLDAPServerManagerTest#testGetUserGroupsReturnsRawGroupsEvenWhenRolesInterceptorRewritesMemberOf`, which asserted the now-removed bypass-control behavior on the group search. Manually tested against the sandbox topology, covering both roles-lookup paths: - Embedded LDAP service + HadoopGroupProvider (use.ldap.service=true) — roles are looked up once on the identity-assertion layer via the interceptor, and the PreAuth service correctly skips the duplicate lookup. - Demo LDAP + HadoopGroupProvider (use.ldap.service=false) — the identity-assertion layer does not run the interceptor, so the PreAuth service performs the roles lookup as before. ``` ~ $ curl -iku admin:admin-password http://localhost:8443/gateway/sandbox/auth/api/v1/pre HTTP/1.1 200 OK Date: Wed, 15 Jul 2026 11:33:17 GMT Set-Cookie: KNOXSESSIONID=node01clcgs9svska5dvd0c0dfdpzb4.node0; Path=/gateway/sandbox; Secure; HttpOnly Expires: Thu, 01 Jan 1970 00:00:00 GMT Set-Cookie: rememberMe=deleteMe; Path=/gateway/sandbox; Max-Age=0; Expires=Tue, 14-Jul-2026 11:33:17 GMT; SameSite=lax x-knox-username: admin x-knox-roles: platform:awc-admin-admin,ml-workspace-abc:viewer-admin Content-Length: 0 ``` ## Integration Tests N/A ## UI changes N/A -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
