[
https://issues.apache.org/jira/browse/KNOX-3389?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18098269#comment-18098269
]
ASF subversion and git services commented on KNOX-3389:
-------------------------------------------------------
Commit 76fa85b5c08c1869e9db2e021536a2696841d748 in knox's branch
refs/heads/master from Sandor Molnar
[ https://gitbox.apache.org/repos/asf?p=knox.git;h=76fa85b5c ]
KNOX-3389: Embedded LDAP getUserGroups drops roles-lookup roles that have no
backing group (#1318)
> Embedded LDAP getUserGroups drops roles-lookup roles that have no backing
> group
> -------------------------------------------------------------------------------
>
> Key: KNOX-3389
> URL: https://issues.apache.org/jira/browse/KNOX-3389
> Project: Apache Knox
> Issue Type: Bug
> Components: Server
> Affects Versions: 3.0.0
> Reporter: Sandor Molnar
> Assignee: Sandor Molnar
> Priority: Major
> Fix For: 3.0.0
>
> Time Spent: 1h
> Remaining Estimate: 0h
>
> When the embedded Knox LDAP server has the roles lookup interceptor enabled,
> resolved roles are written to the user entry as memberOf values. If the user
> has no existing groups (so there is no template group DN to build a full DN
> from), {{LDAPRolesLookupInterceptor.addRoleAttribute}} stores each role as a
> bare RDN, e.g. {{memberOf: cn=platform:awc-admin-sam}}, with no trailing DN
> components.
> {{KnoxLDAPServerManager.getUserGroups}} then fails to return these as groups.
> It extracts the CN by taking the substring between {{cn=}} and the first
> comma, but a bare RDN has no comma {{(indexOf(',') returns -1)}}, so the
> value is silently skipped and the roles never surface as groups.
> *Repro:* embedded LDAP pointed at a demo backend whose LDIF defines users but
> no groups, with {{rolesLookup}} in {{gateway.ldap.interceptor.names}}.
> Authenticate a user (e.g. {{sam}}) whose roles resolve to
> {{platform:awc-admin-sam}} and {{ml-workspace-abc:viewer-sam}}. Knox resolves
> the roles and writes them to {{memberOf}} as {{cn=<role>}}, but
> {{getUserGroups("sam")}} returns an empty list.
> *Fix:* when the roles lookup interceptor is active, handle bare-RDN
> {{memberOf}} values by taking everything after {{cn=}}. Full DNs continue to
> be parsed as before, and a no-comma value without the interceptor is still
> skipped as unexpected data.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
