[
https://issues.apache.org/jira/browse/KNOX-3385?focusedWorklogId=1031496&page=com.atlassian.jira.plugin.system.issuetabpanels:worklog-tabpanel#worklog-1031496
]
ASF GitHub Bot logged work on KNOX-3385:
----------------------------------------
Author: ASF GitHub Bot
Created on: 21/Jul/26 13:49
Start Date: 21/Jul/26 13:49
Worklog Time Spent: 10m
Work Description: handavid opened a new pull request, #1314:
URL: https://github.com/apache/knox/pull/1314
[KNOX-3385](https://issues.apache.org/jira/browse/KNOX-3385) - Ldap Proxy
accepts search using either proxy or remote base dn
## What changes were proposed in this pull request?
A method is added to the LdapBackend to indicate whether a given search base
is applicable to that backend. The LdapProxyBackend implements this to accept
searches against either the proxy dn or remote dn. Searches are limited to the
specified user and group search bases to reject searches for schema, config,
etc.
## How was this patch tested?
Unit tests were added to the LdapProxyBackendTest class to verify that the
new method returns true for both the proxy and remote DNs.
## Integration Tests
gateway-site.xml was updated to have a different proxy base dn. Workflow
tests were added to `test_knox_ldap_proxy_search.py` to search by proxy dn.
## UI changes
none
Please review [Knox Contributing
Process](https://cwiki.apache.org/confluence/display/KNOX/Contribution+Process#ContributionProcess-GithubWorkflow)
before opening a pull request.
Issue Time Tracking
-------------------
Worklog Id: (was: 1031496)
Remaining Estimate: 0h
Time Spent: 10m
> Knox LDAP Proxy accepts proxy base dn
> -------------------------------------
>
> Key: KNOX-3385
> URL: https://issues.apache.org/jira/browse/KNOX-3385
> Project: Apache Knox
> Issue Type: Improvement
> Components: Server
> Reporter: David Han
> Assignee: David Han
> Priority: Major
> Fix For: 3.0.0
>
> Time Spent: 10m
> Remaining Estimate: 0h
>
> The UserSearchInterceptor was modified to only forward the search to the
> backend if the base dn of the search matches the backend base dn. We should
> also forward searches that use the proxy base dn.
> The initial restriction was put in place to prevent system/operational
> searches. The new implementation should also respect this restriction.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
