[
https://issues.apache.org/jira/browse/KNOX-3541?focusedWorklogId=1052243&page=com.atlassian.jira.plugin.system.issuetabpanels:worklog-tabpanel#worklog-1052243
]
ASF GitHub Bot logged work on KNOX-3541:
----------------------------------------
Author: ASF GitHub Bot
Created on: 03/Nov/26 19:44
Start Date: 03/Nov/26 19:44
Worklog Time Spent: 10m
Work Description: github-actions[bot] commented on PR #1482:
URL: https://github.com/apache/knox/pull/1482#issuecomment-6613779103
## Test Results
4 files 4 suites 1m 28s ⏱️
149 tests 149 ✅ 0 💤 0 ❌
173 runs 173 ✅ 0 💤 0 ❌
Results for commit 7ddd6093.
[test-results]:data:application/gzip;base64,H4sIAJQ56moC/13MSw7CIBSF4a00jB1QebsZQ7mQENtieIyMexdJRXT4/Sc5D+T8ahO6TPQ0oVR87oASdfZhr5Syui75vc1UfXRNxZj/dPP3mnAPTvv1J9gYQzxKLHv7FORAvxzK97F5OGwe/0zYNp8rkAAAjhWhC1AijbGWKykEZjC7s1gsdxoYMxY9X5aBtBYEAQAA
Issue Time Tracking
-------------------
Worklog Id: (was: 1052243)
Time Spent: 0.5h (was: 20m)
> Embedded LDAP server: base-object search on proxied user DNs fails, and the
> in-memory bind user is first authenticated against the backend
> ------------------------------------------------------------------------------------------------------------------------------------------
>
> Key: KNOX-3541
> URL: https://issues.apache.org/jira/browse/KNOX-3541
> Project: Apache Knox
> Issue Type: Bug
> Components: LDAP
> Affects Versions: 3.0.0
> Reporter: Sandor Molnar
> Assignee: Sandor Molnar
> Priority: Major
> Fix For: 3.1.0
>
> Time Spent: 0.5h
> Remaining Estimate: 0h
>
> Two issues in {{UserSearchInterceptor}} of Knox's embedded LDAP server (proxy
> backend):
> h3. 1. Base-object search on a proxied entry fails
> {{search()}} calls {{next(ctx)}} on the local partition first. A _base-object
> search_ on a user DN that only exists in the proxied backend, e.g.
> {code:java}
> ldapsearch -H ldap://localhost:10389 -D
> uid=proxy-user,ou=people,dc=proxy,dc=com -w ... -s base -b
> uid=alice,ou=people,dc=proxy,dc=com
> {code}
> fails with result 80, {{{}LdapNoSuchObjectException: ERR_648 Invalid search
> base{}}}. The backend is never consulted. A _subtree search_ under
> {{ou=people,dc=proxy,dc=com}} for the same user succeeds. Clients that read a
> user entry directly by DN (a common LDAP pattern) cannot use the embedded
> server.
> *Expected:* when the local partition reports no-such-object for a search base
> the backend supports ({{{}LdapProxyBackend.isSupportedSearchBase{}}}),
> continue with the backend search.
> h3. 2. The in-memory bind user is first tried against the backend
> {{bind()}} always tries the backend first, even for the configured in-memory
> bind user ({{{}gateway.ldap.bind.user{}}} /
> {{{}gateway_ldap_bind_password{}}}). Every such bind does a failed remote
> bind and logs a WARN (sometimes also a {{{}WriteToClosedSessionException{}}})
> before the in-memory authenticator succeeds. This adds latency and log noise,
> and it sends the gateway bind credential to the backend directory.
> *Expected:* when the bind DN equals the configured in-memory bind user,
> authenticate it locally and skip the backend.
> Related: KNOX-3533 (pass requested attributes to the backend search). With
> item 1 fixed, the KnoxIDF LDAP user-parameter provider would also work
> against the embedded server with a plain {{{}userDnTemplate{}}}, without
> {{userSearchBase}} (see KNOX-3540).
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
