smolnar82 opened a new pull request, #1482: URL: https://github.com/apache/knox/pull/1482
[KNOX-3541](https://issues.apache.org/jira/browse/KNOX-3541) - Embedded LDAP: answer base-object searches on proxied DNs from the backend, bind the in-memory bind user locally ## What changes were proposed in this pull request? This fixes two issues in `UserSearchInterceptor`, the interceptor that proxies users from a backend into Knox's embedded LDAP server. **1. Base-object search on a proxied user DN failed with ERR_648** `search()` searches the local partition first. A user such as `uid=alice,ou=people,<baseDn>` exists only in the backend. So a base-object (or one-level) search rooted at that DN failed in the local partition with `LdapNoSuchObjectException: ERR_648 Invalid search base`, and the backend was never consulted: ldapsearch -H ldap://localhost:10389 -D <bind user> -w ... -s base -b uid=alice,ou=people,dc=proxy,dc=com # result: 32 No such object / ERR_648 Invalid search base Now, when the local partition reports no-such-object for a search base that the backend supports (`LdapBackend.isSupportedSearchBase`), the interceptor continues with the backend search, using the client's original scope. Other search bases (`ou=system`, schema, root DSE, ...) still fail as before. **2. The in-memory bind user was first authenticated against the backend** `bind()` tried the backend first for every DN outside `ou=system`. That included the in-memory bind user configured with `gateway.ldap.bind.user` / `gateway_ldap_bind_password`, which usually sits under `ou=people,<baseDn>`. Every such bind did a failed remote bind and logged a WARN before the in-memory authenticator accepted it. It also sent the gateway bind credential to the backend directory. Now `KnoxLDAPServerManager` passes the bind DN to every `UserSearchInterceptor` when a bind is required. A bind with that DN skips the backend and is authenticated locally. Binds of all other users are unchanged. Two DEBUG messages were added: one for a bind handled locally, one for a search answered by the backend because the base doesn't exist locally. Notes: - With the fallback, a base-object search for a DN that exists in neither the partition nor the backend returns success with 0 entries instead of `noSuchObject`. This matches how `lookup()` already behaves. - `FileBackend.search` still ignores the scope and matches on the filter only. `LdapProxyBackend` passes the scope to the remote directory. Related: KNOX-3540 (KnoxIDF `LdapUserParamsProvider`). With this change, KnoxIDF can also read users from the embedded server with a plain `userDnTemplate` (a base-object read), without setting `userSearchBase`. ## How was this patch tested? New unit tests in `UserSearchInterceptorTest`: - binding as the configured bind user skips the backend (the DN match ignores case) - other users still authenticate against the backend when a bind user is set - a search whose base isn't found locally is answered by the backend - a not-found base outside the backend's namespace still throws `LdapNoSuchObjectException` New tests in `KnoxLDAPServerManagerTest` that start a real embedded server: - the bind DN is passed to the backend interceptor, and a network bind as that user succeeds - no bind DN is passed when no bind is required - a network base-object search on `uid=alice,ou=people,dc=test,dc=com` returns the user from the backend The new tests fail without the fix (5 of 7) and pass with it. `mvn -pl gateway-server -am verify` over the `services.ldap` tests: 337 tests pass; checkstyle, PMD, SpotBugs and forbiddenapis are clean. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
