[
https://issues.apache.org/jira/browse/KNOX-3496?focusedWorklogId=1044718&page=com.atlassian.jira.plugin.system.issuetabpanels:worklog-tabpanel#worklog-1044718
]
ASF GitHub Bot logged work on KNOX-3496:
----------------------------------------
Author: ASF GitHub Bot
Created on: 30/Sep/26 03:32
Start Date: 30/Sep/26 03:32
Worklog Time Spent: 10m
Work Description: handavid opened a new pull request, #1435:
URL: https://github.com/apache/knox/pull/1435
[KNOX-3496](https://issues.apache.org/jira/browse/KNOX-3496) - LDAP Proxy
requests memberOf attribute from backend
## What changes were proposed in this pull request?
The LdapProxyBackend now explicity requests the memberOf attribute from the
backend if the useMemberOf flag is set.
## How was this patch tested?
Manual requests were run against and OKTA LDAP server to verify the
behavior. This showed that the OKTA LDAP server would include the `memberOf`
attribute if requested in addition to '*'
```
ldapsearch -v -x -H ldaps://<okta-ldap-server>:636 -D '<user>' -w
<password> -b 'ou=users,<base dn>' -s sub '(uid=*)' '*' memberOf
```
The output was then compared to the output through the LDAP proxy
```
ldapsearch -v -x -H ldaps://<ldap-proxy-server>:636 -D '<user>' -w
<password> -b 'ou=people,<proxy base dn>' -s sub '(uid=*)' '*'
```
Unit tests were added to validate that the `memberOf` attribute is added to
the backend request when the `useMemberOf` flag is set.
(Please explain how this patch was tested. For instance: running automated
unit/integration tests, manual tests. Please write down your test steps as
detailed as possible)
## Integration Tests
no integration tests were added as these would require running an okta ldap
server
## UI changes
no UI changes
Issue Time Tracking
-------------------
Worklog Id: (was: 1044718)
Remaining Estimate: 0h
Time Spent: 10m
> LDAP Proxy memberOf optimization doesn't work if memberOf is an operational
> attribute
> -------------------------------------------------------------------------------------
>
> Key: KNOX-3496
> URL: https://issues.apache.org/jira/browse/KNOX-3496
> Project: Apache Knox
> Issue Type: Improvement
> Components: Server
> Affects Versions: 3.0.0, 3.1.0
> Reporter: David Han
> Assignee: David Han
> Priority: Major
> Fix For: 3.1.0
>
> Time Spent: 10m
> Remaining Estimate: 0h
>
> Some LDAP servers, e.g., okta, categorize the memberOf attribute as an
> operational attribute. This won't be returned when the LdapProxyBackend
> requests all user attributes. Modify the backend request to include the
> memberOf attribute if the useMemberOf flag is set.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
