[
https://issues.apache.org/jira/browse/KNOX-3456?focusedWorklogId=1041841&page=com.atlassian.jira.plugin.system.issuetabpanels:worklog-tabpanel#worklog-1041841
]
ASF GitHub Bot logged work on KNOX-3456:
----------------------------------------
Author: ASF GitHub Bot
Created on: 16/Sep/26 01:36
Start Date: 16/Sep/26 01:36
Worklog Time Spent: 10m
Work Description: hsheinblatt commented on code in PR #1402:
URL: https://github.com/apache/knox/pull/1402#discussion_r4021722170
##########
gateway-server/src/test/java/org/apache/knox/gateway/services/knoxidf/delegation/JdbcDelegationPolicyServiceTest.java:
##########
@@ -859,14 +861,123 @@ public void testEvaluateDenyHeadlessNotAllowed() throws
Exception {
}
@Test
- public void testEvaluateGroupsNotEmptyThrowsServerError() throws Exception {
+ public void testEvaluateAuthorizedViaGroupMembership() throws Exception {
registerPolicy("oidc", "groups",
Collections.emptySet(),
new HashSet<>(Collections.singleton("admins")),
singleResourcePolicy("/api", "read"));
- assertThrows(UnsupportedOperationException.class, () ->
+ final KnoxLDAPService ldap = EasyMock.createMock(KnoxLDAPService.class);
+ EasyMock.expect(ldap.isEnabled()).andReturn(true).anyTimes();
+
EasyMock.expect(ldap.getUserGroups("alice")).andReturn(Arrays.asList("users",
"admins")).once();
+ EasyMock.replay(ldap);
+ service.setLdapService(ldap);
+
+ final PolicyDecision decision = service.evaluate(
+ new PolicyCheckRequest("oidc", "groups", "alice", Set.of("/api"),
Collections.singleton("read"), false));
+
+ assertNull("group membership should authorize the exchange",
decision.getDenyReason());
+ assertEquals(CONFIGURED_TTL, decision.getEffectiveTtlSec());
+ EasyMock.verify(ldap);
+ }
+
+ @Test
+ public void testEvaluateDenyWhenSubjectInNoAllowedGroup() throws Exception {
+ registerPolicy("oidc", "groups",
+ Collections.emptySet(),
+ new HashSet<>(Collections.singleton("admins")),
+ singleResourcePolicy("/api", "read"));
+
+ final KnoxLDAPService ldap = EasyMock.createMock(KnoxLDAPService.class);
+ EasyMock.expect(ldap.isEnabled()).andReturn(true).anyTimes();
+
EasyMock.expect(ldap.getUserGroups("alice")).andReturn(Collections.singletonList("users")).once();
+ EasyMock.replay(ldap);
+ service.setLdapService(ldap);
+
+ final PolicyDecision decision = service.evaluate(
+ new PolicyCheckRequest("oidc", "groups", "alice", Set.of("/api"),
Collections.singleton("read"), false));
+
+ assertEquals("subject_not_allowed", decision.getDenyReason());
+ EasyMock.verify(ldap);
+ }
Review Comment:
Arguably also boundary when the user is in no groups.
Issue Time Tracking
-------------------
Worklog Id: (was: 1041841)
Time Spent: 50m (was: 40m)
> Enforce canActFor.groups in delegation policy via Knox LDAP group lookup
> -------------------------------------------------------------------------
>
> Key: KNOX-3456
> URL: https://issues.apache.org/jira/browse/KNOX-3456
> Project: Apache Knox
> Issue Type: Sub-task
> Components: Server
> Affects Versions: 3.1.0
> Reporter: Sandor Molnar
> Assignee: Sandor Molnar
> Priority: Major
> Fix For: 3.1.0
>
> Time Spent: 50m
> Remaining Estimate: 0h
>
> As a platform operator, I want to define delegation policies that grant
> exchange rights to LDAP groups rather than individual user lists, so that
> access follows group membership without requiring Knox policy updates for
> each user change.
> ACCEPTANCE CRITERIA:
> - When a policy has a non-empty groups list for who the actor can act for,
> Knox checks whether the subject user is a member of any listed group using
> the Knox LDAP service group lookup.
> - With the LDAP roles-lookup interceptor configured, the group names returned
> by the LDAP service match the AWC role names stored in the policy. No
> additional mapping step is required.
> - If LDAP is disabled and a policy has a non-empty groups list, the token
> exchange returns server_error with a description directing the operator to
> enable LDAP. The exchange does not silently deny with subject_not_allowed.
> - If the LDAP group lookup call throws an exception, the exchange returns
> server_error with a description, and the exception and stack trace are logged.
> Integration test: a user who is a member of a policy group is authorized. A
> user who is not a member is denied with access_denied.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
