[
https://issues.apache.org/jira/browse/KNOX-3389?focusedWorklogId=1031683&page=com.atlassian.jira.plugin.system.issuetabpanels:worklog-tabpanel#worklog-1031683
]
ASF GitHub Bot logged work on KNOX-3389:
----------------------------------------
Author: ASF GitHub Bot
Created on: 22/Jul/26 13:58
Start Date: 22/Jul/26 13:58
Worklog Time Spent: 10m
Work Description: handavid commented on code in PR #1318:
URL: https://github.com/apache/knox/pull/1318#discussion_r3630825141
##########
gateway-server/src/main/java/org/apache/knox/gateway/services/ldap/KnoxLDAPServerManager.java:
##########
@@ -470,6 +470,13 @@ public List<String> getUserGroups(String username) throws
Exception {
int commaIdx = groupDn.indexOf(',');
if (commaIdx > 0) {
groups.add(groupDn.substring(3, commaIdx));
+ } else if (hasRolesLookupInterceptor) {
Review Comment:
This looks ok, but I was wondering if we could convert the value to a `Dn`
and pull the `Rdn` instead of string splitting. e.g., something like:
```
Dn groupDn = new Dn(value.getString());
String groupName = groupDn.getRdn().getValue();
```
I feel that would be more resilient regardless of what RDN is used
Issue Time Tracking
-------------------
Worklog Id: (was: 1031683)
Time Spent: 40m (was: 0.5h)
> Embedded LDAP getUserGroups drops roles-lookup roles that have no backing
> group
> -------------------------------------------------------------------------------
>
> Key: KNOX-3389
> URL: https://issues.apache.org/jira/browse/KNOX-3389
> Project: Apache Knox
> Issue Type: Bug
> Components: Server
> Affects Versions: 3.0.0
> Reporter: Sandor Molnar
> Assignee: Sandor Molnar
> Priority: Major
> Fix For: 3.0.0
>
> Time Spent: 40m
> Remaining Estimate: 0h
>
> When the embedded Knox LDAP server has the roles lookup interceptor enabled,
> resolved roles are written to the user entry as memberOf values. If the user
> has no existing groups (so there is no template group DN to build a full DN
> from), {{LDAPRolesLookupInterceptor.addRoleAttribute}} stores each role as a
> bare RDN, e.g. {{memberOf: cn=platform:awc-admin-sam}}, with no trailing DN
> components.
> {{KnoxLDAPServerManager.getUserGroups}} then fails to return these as groups.
> It extracts the CN by taking the substring between {{cn=}} and the first
> comma, but a bare RDN has no comma {{(indexOf(',') returns -1)}}, so the
> value is silently skipped and the roles never surface as groups.
> *Repro:* embedded LDAP pointed at a demo backend whose LDIF defines users but
> no groups, with {{rolesLookup}} in {{gateway.ldap.interceptor.names}}.
> Authenticate a user (e.g. {{sam}}) whose roles resolve to
> {{platform:awc-admin-sam}} and {{ml-workspace-abc:viewer-sam}}. Knox resolves
> the roles and writes them to {{memberOf}} as {{cn=<role>}}, but
> {{getUserGroups("sam")}} returns an empty list.
> *Fix:* when the roles lookup interceptor is active, handle bare-RDN
> {{memberOf}} values by taking everything after {{cn=}}. Full DNs continue to
> be parsed as before, and a no-comma value without the interceptor is still
> skipped as unexpected data.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
