smolnar82 opened a new pull request, #1479: URL: https://github.com/apache/knox/pull/1479
[KNOX-3539](https://issues.apache.org/jira/browse/KNOX-3539) - Add an option to lowercase the user ID in the LDAP proxy roles-lookup interceptor ## What changes were proposed in this pull request? The LDAP proxy's roles-lookup interceptor takes the roles-lookup user id from the `uid` of the entry the backend returns, not from the name the client searched with. With Active Directory, that `uid` is the canonical `sAMAccountName` (e.g. `Admin`), whatever case the user logged in with. A roles service that stores assignments under the login-typed, lowercase id (`admin`) then finds no roles. This PR adds a new gateway-site property: | Property | Default | Description | |----------|---------|-------------| | `gateway.ldap.roles.lookup.lowercase.user.id` | `false` | When `true`, `LDAPRolesLookupInterceptor` lowercases the user id (`Locale.ROOT`) before calling the roles lookup service. | - `GatewayConfig`/`GatewayConfigImpl`: new property and `isLdapRolesLookupLowercaseUserId()`. The `gateway.ldap.roles.` keys now share an `LDAP_ROLES_PREFIX` constant. - `KnoxLDAPServerManager`: passes the flag to `rolesLookup` interceptors through their existing config map (`LDAPRolesLookupInterceptor.LOWERCASE_USER_ID`). - `LDAPRolesLookupInterceptor`: applies the flag to the lookup key only. The entry returned to the client, including its `uid`, is unchanged. - Docs: `knox-site/docs/service_ldap_server.md`. Behavior is unchanged by default. ## How was this patch tested? Unit tests: - `GatewayConfigImplTest#testLdapRolesLookupLowercaseUserId`: default `false`, and can be enabled. - `LDAPRolesLookupInterceptorTest`: - `testRolesLookupKeepsUserIdCaseByDefault` - `testRolesLookupLowercasesUserIdWhenEnabled` - `testRolesLookupLowercaseUserIdDoesNotChangeReturnedEntry` The new REST E2E pass below was run locally with Docker Compose: 35 passed, 2 skipped. ## Integration Tests This adds a **REST roles lookup E2E pass**. It runs on every PR, like the HashiCorp Vault pass, and isn't label-gated. - `compose/role-lookup-rest/mock_roles_api.py`: a stdlib-only mock of the roles REST API that serves `compose/role-lookup/roles.json`. It implements the lookup (POST), paged list (GET) and get-by-id endpoints. - `compose/docker-compose.role-lookup-rest.yml`: adds the `roles-api` service and recreates `knox` with `compose/role-lookup-rest/gateway-site.xml`, which sets `strategy=rest` and `gateway.ldap.roles.lookup.lowercase.user.id=true`. - `tests/test_knox_ldap_proxy_search_with_rest_role_lookup.py`: - inherits every test from the file-strategy roles lookup suite, so the REST strategy gets the same coverage; - adds lowercase user id tests. `roles.json` now assigns `platform:deployer` to the user id `recursiveuser`. The demo directory's uid is the mixed-case `recursiveUser`, so the role is only resolved when the user id is lowercased. The tests check this with differently cased search filters, and also check that the returned `uid` keeps its case. - The file-strategy suite (still opt-in, not run in CI) gains matching default-behaviour tests: case is kept, and the reverse lookup of a role assigned to a user id of a different case still works. - `tests.yml`: new steps that run the pass, dump diagnostics (knox and roles-api logs) on failure, and upload `test-results-rest-role-lookup.xml`. The default `docker-compose.yml` run ignores `test*_with_rest_role_lookup.py`. ``` $ docker compose -f .github/workflows/compose/docker-compose.yml -f .github/workflows/compose/docker-compose.role-lookup-rest.yml up -d --force-recreate knox roles-api && sleep 30 [+] up 6/6 ✔ Container compose-ldap-1 Running 0.0s ✔ Container compose-k3s-1 Running 0.0s ✔ Container compose-roles-api-1 Healthy 12.1s ✔ Container compose-knox-1 Started 8.9s ✔ Container compose-knox-dev-1 Started 0.1s ✔ Container compose-k8s-bootstrap-1 Exited 0.6s $ docker compose -f .github/workflows/compose/docker-compose.yml -f .github/workflows/compose/docker-compose.role-lookup-rest.yml run --rm tests bash -c "pip install -r requirements.txt && pytest test*_with_rest_role_lookup.py --junitxml=test-results-rest-role-lookup.xml" [+] 6/6t 6/64 ✔ Container compose-roles-api-1 Healthy 0.6s ✔ Container compose-ldap-1 Running 0.0s ✔ Container compose-k3s-1 Running 0.0s ✔ Container compose-knox-1 Running 0.0s ✔ Container compose-knox-dev-1 Started 0.1s ✔ Container compose-k8s-bootstrap-1 Exited 0.6s Container compose-tests-run-3eaa2f249c1b Creating Container compose-tests-run-3eaa2f249c1b Created ... =============================================================================================================== test session starts ================================================================================================================ platform linux -- Python 3.10.20, pytest-9.0.3, pluggy-1.7.0 rootdir: /tests plugins: platformdirs-4.12.4 collected 37 items test_knox_ldap_proxy_search_with_rest_role_lookup.py ......s.........................s.... [100%] ================================================================================================================= warnings summary ================================================================================================================= ... -- Docs: https://docs.pytest.org/en/stable/how-to/capture-warnings.html ------------------------------------------------------------------------------------------- generated xml file: /tests/test-results-rest-role-lookup.xml ------------------------------------------------------------------------------------------- ==================================================================================================== 35 passed, 2 skipped, 2 warnings in 0.97s ======================= ``` -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
