Sandor Molnar created KNOX-3387:
-----------------------------------
Summary: HadoopGroupProvider returns no groups when the embedded
LDAP proxy base DN differs from the remote base DN
Key: KNOX-3387
URL: https://issues.apache.org/jira/browse/KNOX-3387
Project: Apache Knox
Issue Type: Task
Components: Server
Affects Versions: 3.0.0
Reporter: Sandor Molnar
Assignee: Sandor Molnar
Fix For: 3.0.0
h2. Summary
With the embedded Knox LDAP service ({{{}gateway.ldap.enabled=true{}}}) using
an LDAP proxy backend, group lookups via {{HadoopGroupProvider}}
({{{}use.ldap.service=true{}}}) return an empty group list whenever the proxy
base DN differs from the remote base DN.
h2. Steps to Reproduce
# Configure a proxy backend where {{gateway.ldap.base.dn}} !=
{{{}remoteBaseDn{}}}, e.g. {{dc=proxy,dc=com}} vs {{{}dc=example,dc=com{}}}.
# Authenticate as a user who belongs to a group on the remote server.
# Send a request through a topology using {{HadoopGroupProvider}} with
{{{}use.ldap.service=true{}}}.
Expected: the user's remote groups are returned. Actual: empty list.
{code:java}
DEBUG services.ldap (UserSearchInterceptor.java:search(88)) - LDAP Search:
dc=proxy,dc=com | (uid=admin)
DEBUG knox.gateway (HadoopGroupProviderFilter.java:mapGroupPrincipals(115)) -
Found groups for principal admin : []
{code}
h2. Root Cause
{{KnoxLDAPServerManager.getUserGroups()}} searches under the proxy base DN.
{{UserSearchInterceptor.search()}} only forwards to the backend when
{{isUnderBackendBaseDn()}} passes, but that check compares the proxy-namespace
search base against {{{}LdapProxyBackend.getBaseDn(){}}}, which returns the
remote base DN. So {{"dc=proxy,dc=com".endsWith("dc=example,dc=com")}} is
{{{}false{}}}, the backend is never queried, and no {{memberOf}} values are
found.
This contradicts the backend's own contract: {{LdapProxyBackend.search()}}
expects a proxy-namespace base and translates it internally.
({{{}FileBackend{}}} is unaffected — it has a single base DN.)
h2. Workaround
Set {{gateway.ldap.base.dn}} equal to {{{}remoteBaseDn{}}}. This makes
translation a no-op and lets the guard pass, but disables namespace translation.
h2. Proposed Fix
Have {{isUnderBackendBaseDn()}} evaluate the search base against the proxy base
DN (add {{getProxyBaseDn()}} to {{{}LdapBackend{}}}); accept a base under
either the proxy or remote namespace, since both are registered as partitions.
Add a test covering {{{}proxyBaseDn != remoteBaseDn{}}}.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
