[
https://issues.apache.org/jira/browse/KNOX-3422?focusedWorklogId=1038224&page=com.atlassian.jira.plugin.system.issuetabpanels:worklog-tabpanel#worklog-1038224
]
ASF GitHub Bot logged work on KNOX-3422:
----------------------------------------
Author: ASF GitHub Bot
Created on: 27/Aug/26 07:12
Start Date: 27/Aug/26 07:12
Worklog Time Spent: 10m
Work Description: hanicz commented on code in PR #1357:
URL: https://github.com/apache/knox/pull/1357#discussion_r3869504563
##########
gateway-server/src/main/java/org/apache/knox/gateway/services/ldap/KnoxLDAPServerManager.java:
##########
@@ -145,6 +151,19 @@ public void initialize(GatewayConfig config) throws
Exception {
workDir.mkdirs();
}
+ /**
+ * Validates that the bind dn, if configured, matches the base dn for the
embedded
+ * LDAP service (e.g. {@code ou=system} or {@code ou=people,<baseDn>}).
+ */
+ private void validateBindUser() throws Exception {
+ if (!StringUtils.isBlank(bindUser)) {
+ Dn bindUserDn = new Dn(bindUser);
+ if (!(bindUserDn.isDescendantOf("ou=system") ||
bindUserDn.isDescendantOf("ou=people," + this.baseDn))) {
+ throw new IllegalArgumentException("Bind user must be a
descendant of ou=system or ou=people" + this.baseDn);
Review Comment:
nit: missing `,` in message
##########
gateway-server/src/main/java/org/apache/knox/gateway/services/ldap/authn/InMemoryBindAuthenticator.java:
##########
@@ -0,0 +1,60 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.knox.gateway.services.ldap.authn;
+
+import org.apache.directory.api.ldap.model.constants.AuthenticationLevel;
+import org.apache.directory.api.ldap.model.exception.LdapException;
+import org.apache.directory.api.ldap.model.name.Dn;
+import org.apache.directory.server.core.api.LdapPrincipal;
+import
org.apache.directory.server.core.api.interceptor.context.BindOperationContext;
+import org.apache.directory.server.core.authn.AbstractAuthenticator;
+
+import java.nio.charset.StandardCharsets;
+
+/**
+ * Authenticator for an in-memory user.
+ */
+public class InMemoryBindAuthenticator extends AbstractAuthenticator {
+
+ private final Dn bindDn;
+ private final String bindPassword;
+
+ public InMemoryBindAuthenticator(Dn bindDn, String bindPassword)
+ throws LdapException {
+ super(AuthenticationLevel.SIMPLE, bindDn);
+ this.bindDn = bindDn;
+ this.bindPassword = bindPassword;
+ }
+
+ @Override
+ public LdapPrincipal authenticate(BindOperationContext bindContext) throws
LdapException {
+ Dn dn = bindContext.getDn();
+
+ // Check if authenticating as the configured in-memory user
+ if (bindDn.equals(dn)) {
+ byte[] passwordBytes = bindContext.getCredentials();
+ String password = new String(passwordBytes,
StandardCharsets.UTF_8);
+ if (bindPassword.equals(password)) {
Review Comment:
I think if the password doesn't match this should throw a
LdapAuthenticationException.
##########
gateway-server/src/main/java/org/apache/knox/gateway/services/ldap/KnoxLDAPServerManager.java:
##########
@@ -435,22 +453,24 @@ private void createBaseEntriesForDn(SchemaManager
schemaManager, String dn) thro
}
/**
- * Create the entry used by external clients to bind against the embedded
LDAP server.
- * The bind DN's parent container (e.g. {@code ou=system} or {@code
ou=people,<baseDn>})
- * must already exist. The entry is added using the privileged admin
session, which is
- * unaffected by the anonymous-access setting.
+ * Configure the Authenticator used by external clients to bind against
the embedded LDAP server.
*/
- private void createBindUser(SchemaManager schemaManager, String
bindPassword) throws Exception {
- Dn bindDn = new Dn(schemaManager, bindUser);
- if (!directoryService.getAdminSession().exists(bindDn)) {
- String rdnValue = bindDn.getRdn().getValue();
- Entry bindEntry = new DefaultEntry(schemaManager);
- bindEntry.setDn(bindDn);
- bindEntry.add("objectClass", "top", "person",
"organizationalPerson", "inetOrgPerson");
- bindEntry.add("cn", rdnValue);
- bindEntry.add("sn", rdnValue);
- bindEntry.add("userPassword", bindPassword);
- directoryService.getAdminSession().add(bindEntry);
+ private void configureInMemoryBindUser(String bindPassword) throws
Exception {
+ String id = "inmemoryuser";
Review Comment:
nit: this is an unused variable
Issue Time Tracking
-------------------
Worklog Id: (was: 1038224)
Time Spent: 0.5h (was: 20m)
> LDAP Proxy shouldn't create user from gateway.ldap.bind.user config
> -------------------------------------------------------------------
>
> Key: KNOX-3422
> URL: https://issues.apache.org/jira/browse/KNOX-3422
> Project: Apache Knox
> Issue Type: Improvement
> Components: Server
> Affects Versions: 3.0.0
> Reporter: David Han
> Assignee: David Han
> Priority: Major
> Fix For: 3.1.0
>
> Time Spent: 0.5h
> Remaining Estimate: 0h
>
> This user configured using the gateway.ldap.bind.user configuration is used
> to bind against the LDAP Proxy. The gateway server currently creates a user
> in the local LDAP using this configuration and the aliased password. The
> downside of this approach is that there is currently no tracking for this
> user and no way to automatically remove this user if the config changes nor
> rotate the password. This user is also returned in search queries against the
> LDAP Proxy.
> I propose creating a new authentication interceptor to manage this user
> in-memory. This way the user won't be persisted and will automatically be
> unable to authenticate if the configuration changes.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
