smolnar82 opened a new pull request, #1329: URL: https://github.com/apache/knox/pull/1329
[KNOX-3397](https://issues.apache.org/jira/browse/KNOX-3397) - Allow the actor groups header name to be configured explicitly ## What changes were proposed in this pull request? [KNOX-3354](https://issues.apache.org/jira/browse/KNOX-3354) removed the index suffix from the actor groups header when roles are resolved at the resource layer (rather than in the LDAP interceptors), so that the configured actor groups header is not postfixed. This is useful in environments where role lookup is configured locally. However, a topology may instead use the RemoteAuthFilter to authenticate requests, where the remote counterpart is configured for role lookup. In that case remote.auth.group.header returns roles rather than groups, but the `KNOX-AUTH-SERVICE` configured in the topology still emits the suffixed version of `preauth.auth.header.actor.groups.prefix`, causing a mismatch. To give operators explicit control over this, this PR introduces a new configuration parameter in AbstractAuthResource: `preauth.auth.header.actor.groups`. When declared, it takes precedence over the existing `preauth.auth.header.actor.groups.prefix` parameter and is used directly as the groups header name in the response, without any index suffix. When the new parameter is not set, behavior is unchanged (fully backward compatible). The header-name selection logic was also extracted into a small private `createGroupsHeaderName(...)` helper for readability. ## How was this patch tested? - Added a unit test (PreAuthResourceTest#testExplicitGroupsHeaderTakesPrecedenceOverPrefix) that configures both the explicit header and a prefix, and verifies the explicit header is emitted directly, exactly once, with no index suffix. - Ran the full PreAuthResourceTest suite: Tests run: 9, Failures: 0, Errors: 0, Skipped: 0. ## Integration Tests N/A ## UI changes N/A -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
