[
https://issues.apache.org/jira/browse/KNOX-3387?focusedWorklogId=1031499&page=com.atlassian.jira.plugin.system.issuetabpanels:worklog-tabpanel#worklog-1031499
]
ASF GitHub Bot logged work on KNOX-3387:
----------------------------------------
Author: ASF GitHub Bot
Created on: 21/Jul/26 13:54
Start Date: 21/Jul/26 13:54
Worklog Time Spent: 10m
Work Description: smolnar82 closed pull request #1313: KNOX-3387: Forward
proxy-namespace searches to the LDAP backend when proxy and remote base DNs
differ
URL: https://github.com/apache/knox/pull/1313
Issue Time Tracking
-------------------
Worklog Id: (was: 1031499)
Time Spent: 40m (was: 0.5h)
> HadoopGroupProvider returns no groups when the embedded LDAP proxy base DN
> differs from the remote base DN
> ----------------------------------------------------------------------------------------------------------
>
> Key: KNOX-3387
> URL: https://issues.apache.org/jira/browse/KNOX-3387
> Project: Apache Knox
> Issue Type: Task
> Components: Server
> Affects Versions: 3.0.0
> Reporter: Sandor Molnar
> Assignee: Sandor Molnar
> Priority: Major
> Fix For: 3.0.0
>
> Time Spent: 40m
> Remaining Estimate: 0h
>
> h2. Summary
> With the embedded Knox LDAP service ({{{}gateway.ldap.enabled=true{}}}) using
> an LDAP proxy backend, group lookups via {{HadoopGroupProvider}}
> ({{{}use.ldap.service=true{}}}) return an empty group list whenever the proxy
> base DN differs from the remote base DN.
> h2. Steps to Reproduce
> # Configure a proxy backend where {{gateway.ldap.base.dn}} !=
> {{{}remoteBaseDn{}}}, e.g. {{dc=proxy,dc=com}} vs {{{}dc=example,dc=com{}}}.
> # Authenticate as a user who belongs to a group on the remote server.
> # Send a request through a topology using {{HadoopGroupProvider}} with
> {{{}use.ldap.service=true{}}}.
> Expected: the user's remote groups are returned. Actual: empty list.
> {code:java}
> DEBUG services.ldap (UserSearchInterceptor.java:search(88)) - LDAP Search:
> dc=proxy,dc=com | (uid=admin)
> DEBUG knox.gateway (HadoopGroupProviderFilter.java:mapGroupPrincipals(115)) -
> Found groups for principal admin : []
> {code}
> h2. Root Cause
> {{KnoxLDAPServerManager.getUserGroups()}} searches under the proxy base DN.
> {{UserSearchInterceptor.search()}} only forwards to the backend when
> {{isUnderBackendBaseDn()}} passes, but that check compares the
> proxy-namespace search base against {{{}LdapProxyBackend.getBaseDn(){}}},
> which returns the remote base DN. So
> {{"dc=proxy,dc=com".endsWith("dc=example,dc=com")}} is {{{}false{}}}, the
> backend is never queried, and no {{memberOf}} values are found.
> This contradicts the backend's own contract: {{LdapProxyBackend.search()}}
> expects a proxy-namespace base and translates it internally.
> ({{{}FileBackend{}}} is unaffected — it has a single base DN.)
> h2. Workaround
> Set {{gateway.ldap.base.dn}} equal to {{{}remoteBaseDn{}}}. This makes
> translation a no-op and lets the guard pass, but disables namespace
> translation.
> h2. Proposed Fix
> Have {{isUnderBackendBaseDn()}} evaluate the search base against the proxy
> base DN (add {{getProxyBaseDn()}} to {{{}LdapBackend{}}}); accept a base
> under either the proxy or remote namespace, since both are registered as
> partitions. Add a test covering {{{}proxyBaseDn != remoteBaseDn{}}}.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
