[
https://issues.apache.org/jira/browse/KNOX-3456?focusedWorklogId=1041707&page=com.atlassian.jira.plugin.system.issuetabpanels:worklog-tabpanel#worklog-1041707
]
ASF GitHub Bot logged work on KNOX-3456:
----------------------------------------
Author: ASF GitHub Bot
Created on: 15/Sep/26 15:06
Start Date: 15/Sep/26 15:06
Worklog Time Spent: 10m
Work Description: smolnar82 opened a new pull request, #1402:
URL: https://github.com/apache/knox/pull/1402
[KNOX-3456](https://issues.apache.org/jira/browse/KNOX-3456) - LDAP group
lookup for canActFor.groups
## What changes were proposed in this pull request?
KNOX-3441 landed the token-exchange delegation policy with the
`canActFor.groups` branch left as a stub (`UnsupportedOperationException` →
HTTP 501). This PR implements the group-membership check:
- **Group lookup (AC1):** When the impersonated subject does not match
`canActForUsers` and the policy's `canActForGroups` is non-empty,
`JdbcDelegationPolicyService.evaluate()` resolves the subject's groups via
`KnoxLDAPService.getUserGroups(subjectName)` and authorizes if any returned
group is in the allowed set. Injected through `DelegationPolicyServiceFactory`
(`ServiceType.LDAP_SERVICE`), mirroring `HadoopGroupProviderFilter`.
- **No mapping step (AC2):** Group names from the LDAP service (role CNs,
including bare-RDN roles surfaced by the roles-lookup interceptor) are compared
directly against the stored policy groups — a plain set-membership test, no
transformation.
- **LDAP disabled/absent (AC3):** A group-based policy with LDAP absent or
disabled is an operator misconfiguration, not a denial. It raises
`DelegationGroupLookupUnavailableException`, which `TokenExchangeHandler` maps
to HTTP 500 `server_error` with a description directing the operator to enable
LDAP — rather than silently denying with `subject_not_allowed`.
- **Lookup failure (AC4):** If the LDAP group lookup call itself throws, the
exception and stack trace are logged (at ERROR) and re-raised as
`DelegationGroupLookupUnavailableException` (chaining the cause), again
surfaced as `server_error`.
Ordering is unchanged otherwise: the group check runs last, after the
cheaper user/resource/scope checks, and is skipped entirely when the subject
already matches `canActForUsers`.
## How was this patch tested?
Automated unit tests, all green:
- `JdbcDelegationPolicyServiceTest` (58) — authorized-via-group,
deny-when-in-no-group, user-check-short-circuits-group-lookup, and the three
server_error paths (LDAP absent, LDAP disabled, lookup throws — the last
asserting the originating exception is chained as the cause).
- `TokenExchangeHandlerTest` (67) — `canActFor.groups` denial → 400
`invalid_request`; group-lookup-unavailable → 500 `server_error` with an
LDAP-oriented description.
- `DelegationPolicyServiceFactoryTest` (3) and
`H2DBDelegationPolicyServiceTest` (2) confirm the LDAP service is wired in for
both the H2 and JDBC paths.
## Integration Tests
N/A
Issue Time Tracking
-------------------
Worklog Id: (was: 1041707)
Time Spent: 0.5h (was: 20m)
> Enforce canActFor.groups in delegation policy via Knox LDAP group lookup
> -------------------------------------------------------------------------
>
> Key: KNOX-3456
> URL: https://issues.apache.org/jira/browse/KNOX-3456
> Project: Apache Knox
> Issue Type: Sub-task
> Components: Server
> Affects Versions: 3.1.0
> Reporter: Sandor Molnar
> Assignee: Sandor Molnar
> Priority: Major
> Fix For: 3.1.0
>
> Time Spent: 0.5h
> Remaining Estimate: 0h
>
> As a platform operator, I want to define delegation policies that grant
> exchange rights to LDAP groups rather than individual user lists, so that
> access follows group membership without requiring Knox policy updates for
> each user change.
> ACCEPTANCE CRITERIA:
> - When a policy has a non-empty groups list for who the actor can act for,
> Knox checks whether the subject user is a member of any listed group using
> the Knox LDAP service group lookup.
> - With the LDAP roles-lookup interceptor configured, the group names returned
> by the LDAP service match the AWC role names stored in the policy. No
> additional mapping step is required.
> - If LDAP is disabled and a policy has a non-empty groups list, the token
> exchange returns server_error with a description directing the operator to
> enable LDAP. The exchange does not silently deny with subject_not_allowed.
> - If the LDAP group lookup call throws an exception, the exchange returns
> server_error with a description, and the exception and stack trace are logged.
> Integration test: a user who is a member of a policy group is authorized. A
> user who is not a member is denied with access_denied.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
