[
https://issues.apache.org/jira/browse/KNOX-3387?focusedWorklogId=1031494&page=com.atlassian.jira.plugin.system.issuetabpanels:worklog-tabpanel#worklog-1031494
]
ASF GitHub Bot logged work on KNOX-3387:
----------------------------------------
Author: ASF GitHub Bot
Created on: 21/Jul/26 13:33
Start Date: 21/Jul/26 13:33
Worklog Time Spent: 10m
Work Description: handavid commented on PR #1313:
URL: https://github.com/apache/knox/pull/1313#issuecomment-5034690362
I have a change that I was about to post for this same problem. I opened
https://issues.apache.org/jira/browse/KNOX-3385. I'll post that shortly.
I did have a question for @smolnar82 regarding the comments in code for
```
// System/operational searches (ou=schema, cn=config, root-DSE) must not be
forwarded.
```
just using the proxy/remote base dn does not restrict these searches. My
delegates the decision to the LdapBackend so the backend can use the user or
group search base to restrict searches.
Issue Time Tracking
-------------------
Worklog Id: (was: 1031494)
Time Spent: 20m (was: 10m)
> HadoopGroupProvider returns no groups when the embedded LDAP proxy base DN
> differs from the remote base DN
> ----------------------------------------------------------------------------------------------------------
>
> Key: KNOX-3387
> URL: https://issues.apache.org/jira/browse/KNOX-3387
> Project: Apache Knox
> Issue Type: Task
> Components: Server
> Affects Versions: 3.0.0
> Reporter: Sandor Molnar
> Assignee: Sandor Molnar
> Priority: Major
> Fix For: 3.0.0
>
> Time Spent: 20m
> Remaining Estimate: 0h
>
> h2. Summary
> With the embedded Knox LDAP service ({{{}gateway.ldap.enabled=true{}}}) using
> an LDAP proxy backend, group lookups via {{HadoopGroupProvider}}
> ({{{}use.ldap.service=true{}}}) return an empty group list whenever the proxy
> base DN differs from the remote base DN.
> h2. Steps to Reproduce
> # Configure a proxy backend where {{gateway.ldap.base.dn}} !=
> {{{}remoteBaseDn{}}}, e.g. {{dc=proxy,dc=com}} vs {{{}dc=example,dc=com{}}}.
> # Authenticate as a user who belongs to a group on the remote server.
> # Send a request through a topology using {{HadoopGroupProvider}} with
> {{{}use.ldap.service=true{}}}.
> Expected: the user's remote groups are returned. Actual: empty list.
> {code:java}
> DEBUG services.ldap (UserSearchInterceptor.java:search(88)) - LDAP Search:
> dc=proxy,dc=com | (uid=admin)
> DEBUG knox.gateway (HadoopGroupProviderFilter.java:mapGroupPrincipals(115)) -
> Found groups for principal admin : []
> {code}
> h2. Root Cause
> {{KnoxLDAPServerManager.getUserGroups()}} searches under the proxy base DN.
> {{UserSearchInterceptor.search()}} only forwards to the backend when
> {{isUnderBackendBaseDn()}} passes, but that check compares the
> proxy-namespace search base against {{{}LdapProxyBackend.getBaseDn(){}}},
> which returns the remote base DN. So
> {{"dc=proxy,dc=com".endsWith("dc=example,dc=com")}} is {{{}false{}}}, the
> backend is never queried, and no {{memberOf}} values are found.
> This contradicts the backend's own contract: {{LdapProxyBackend.search()}}
> expects a proxy-namespace base and translates it internally.
> ({{{}FileBackend{}}} is unaffected — it has a single base DN.)
> h2. Workaround
> Set {{gateway.ldap.base.dn}} equal to {{{}remoteBaseDn{}}}. This makes
> translation a no-op and lets the guard pass, but disables namespace
> translation.
> h2. Proposed Fix
> Have {{isUnderBackendBaseDn()}} evaluate the search base against the proxy
> base DN (add {{getProxyBaseDn()}} to {{{}LdapBackend{}}}); accept a base
> under either the proxy or remote namespace, since both are registered as
> partitions. Add a test covering {{{}proxyBaseDn != remoteBaseDn{}}}.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
