smolnar82 opened a new pull request, #1313: URL: https://github.com/apache/knox/pull/1313
[KNOX-3387](https://issues.apache.org/jira/browse/KNOX-3387) - HadoopGroupProvider returns no groups when the embedded LDAP proxy base DN differs from the remote base DN ## What changes were proposed in this pull request? When the embedded Knox LDAP service (`gateway.ldap.enabled=true`) is configured with an LDAP proxy backend whose proxy base DN (`gateway.ldap.base.dn`) differs from the backend's `remoteBaseDn`, group lookups via the HadoopGroupProvider (`use.ldap.service=true`) always returned an empty group list, even when the user is a member of groups on the remote LDAP server. **Root cause:** group lookups (`KnoxLDAPServerManager.getUserGroups()`) search under the proxy base DN and flow through `UserSearchInterceptor.search()`, which only forwards to the backend when `isUnderBackendBaseDn()` passes. That check compared the proxy-namespace search base against `LdapProxyBackend.getBaseDn()`, which returns the remote base DN, so `"dc=proxy,dc=com".endsWith("dc=example,dc=com")` was `false`, the backend was never queried, and no `memberOf` values were found. This contradicts the backend's own contract: `LdapProxyBackend.search()` expects a proxy-namespace base and translates it to the remote namespace internally via `RemoteSchemaConverter`. **Changes:** - Added `getProxyBaseDn()` to the `LdapBackend` interface. `FileBackend` returns its single base DN (proxy and remote are identical for non-proxying backends); LdapProxyBackend returns `proxyBaseDn` (existing already). - Updated `UserSearchInterceptor.isUnderBackendBaseDn()` to forward a search when the base is under the proxy base DN or the remote base DN. Both namespaces are registered as partitions by `KnoxLDAPServerManager`, and `LdapProxyBackend.search()` handles either. No new configuration is introduced: `getProxyBaseDn()` exposes the already-existing value derived from `gateway.ldap.base.dn`. ## How was this patch tested? - Added `UserSearchInterceptorTest` (4 cases) exercising a backend where `proxyBaseDn != remoteBaseDn`: - proxy-namespace search is forwarded and the entry is returned exactly once (regression guard); - sub-tree search below the proxy base DN is forwarded; - remote-namespace search is still forwarded; - operational searches (e.g. ou=schema) are not forwarded. - Verified the tests fail against the pre-fix code (backend never queried → empty results) and pass with the fix. - Ran the full `org.apache.knox.gateway.services.ldap.**` suite (132 tests) — all green, checkstyle included. - Manually verified end-to-end: with `gateway.ldap.base.dn = dc=proxy,dc=com` and `remoteBaseDn = dc=example,dc=com`, HadoopGroupProvider now resolves the user's groups from the remote server; previously it logged ``` Found groups for principal admin : []. ``` now: ``` Found groups for principal admin : [engineering, operations] ``` -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
