[
https://issues.apache.org/jira/browse/KNOX-3389?focusedWorklogId=1031647&page=com.atlassian.jira.plugin.system.issuetabpanels:worklog-tabpanel#worklog-1031647
]
ASF GitHub Bot logged work on KNOX-3389:
----------------------------------------
Author: ASF GitHub Bot
Created on: 22/Jul/26 11:24
Start Date: 22/Jul/26 11:24
Worklog Time Spent: 10m
Work Description: smolnar82 commented on PR #1318:
URL: https://github.com/apache/knox/pull/1318#issuecomment-5045196198
Cc. @handavid
Issue Time Tracking
-------------------
Worklog Id: (was: 1031647)
Time Spent: 20m (was: 10m)
> Embedded LDAP getUserGroups drops roles-lookup roles that have no backing
> group
> -------------------------------------------------------------------------------
>
> Key: KNOX-3389
> URL: https://issues.apache.org/jira/browse/KNOX-3389
> Project: Apache Knox
> Issue Type: Bug
> Components: Server
> Affects Versions: 3.0.0
> Reporter: Sandor Molnar
> Assignee: Sandor Molnar
> Priority: Major
> Fix For: 3.0.0
>
> Time Spent: 20m
> Remaining Estimate: 0h
>
> When the embedded Knox LDAP server has the roles lookup interceptor enabled,
> resolved roles are written to the user entry as memberOf values. If the user
> has no existing groups (so there is no template group DN to build a full DN
> from), {{LDAPRolesLookupInterceptor.addRoleAttribute}} stores each role as a
> bare RDN, e.g. {{memberOf: cn=platform:awc-admin-sam}}, with no trailing DN
> components.
> {{KnoxLDAPServerManager.getUserGroups}} then fails to return these as groups.
> It extracts the CN by taking the substring between {{cn=}} and the first
> comma, but a bare RDN has no comma {{(indexOf(',') returns -1)}}, so the
> value is silently skipped and the roles never surface as groups.
> *Repro:* embedded LDAP pointed at a demo backend whose LDIF defines users but
> no groups, with {{rolesLookup}} in {{gateway.ldap.interceptor.names}}.
> Authenticate a user (e.g. {{sam}}) whose roles resolve to
> {{platform:awc-admin-sam}} and {{ml-workspace-abc:viewer-sam}}. Knox resolves
> the roles and writes them to {{memberOf}} as {{cn=<role>}}, but
> {{getUserGroups("sam")}} returns an empty list.
> *Fix:* when the roles lookup interceptor is active, handle bare-RDN
> {{memberOf}} values by taking everything after {{cn=}}. Full DNs continue to
> be parsed as before, and a no-comma value without the interceptor is still
> skipped as unexpected data.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
