[
https://issues.apache.org/jira/browse/KNOX-3541?focusedWorklogId=1052551&page=com.atlassian.jira.plugin.system.issuetabpanels:worklog-tabpanel#worklog-1052551
]
ASF GitHub Bot logged work on KNOX-3541:
----------------------------------------
Author: ASF GitHub Bot
Created on: 04/Nov/26 23:14
Start Date: 04/Nov/26 23:14
Worklog Time Spent: 10m
Work Description: smolnar82 merged PR #1482:
URL: https://github.com/apache/knox/pull/1482
Issue Time Tracking
-------------------
Worklog Id: (was: 1052551)
Time Spent: 40m (was: 0.5h)
> Embedded LDAP server: base-object search on proxied user DNs fails, and the
> in-memory bind user is first authenticated against the backend
> ------------------------------------------------------------------------------------------------------------------------------------------
>
> Key: KNOX-3541
> URL: https://issues.apache.org/jira/browse/KNOX-3541
> Project: Apache Knox
> Issue Type: Bug
> Components: LDAP
> Affects Versions: 3.0.0
> Reporter: Sandor Molnar
> Assignee: Sandor Molnar
> Priority: Major
> Fix For: 3.1.0
>
> Time Spent: 40m
> Remaining Estimate: 0h
>
> Two issues in {{UserSearchInterceptor}} of Knox's embedded LDAP server (proxy
> backend):
> h3. 1. Base-object search on a proxied entry fails
> {{search()}} calls {{next(ctx)}} on the local partition first. A _base-object
> search_ on a user DN that only exists in the proxied backend, e.g.
> {code:java}
> ldapsearch -H ldap://localhost:10389 -D
> uid=proxy-user,ou=people,dc=proxy,dc=com -w ... -s base -b
> uid=alice,ou=people,dc=proxy,dc=com
> {code}
> fails with result 80, {{{}LdapNoSuchObjectException: ERR_648 Invalid search
> base{}}}. The backend is never consulted. A _subtree search_ under
> {{ou=people,dc=proxy,dc=com}} for the same user succeeds. Clients that read a
> user entry directly by DN (a common LDAP pattern) cannot use the embedded
> server.
> *Expected:* when the local partition reports no-such-object for a search base
> the backend supports ({{{}LdapProxyBackend.isSupportedSearchBase{}}}),
> continue with the backend search.
> h3. 2. The in-memory bind user is first tried against the backend
> {{bind()}} always tries the backend first, even for the configured in-memory
> bind user ({{{}gateway.ldap.bind.user{}}} /
> {{{}gateway_ldap_bind_password{}}}). Every such bind does a failed remote
> bind and logs a WARN (sometimes also a {{{}WriteToClosedSessionException{}}})
> before the in-memory authenticator succeeds. This adds latency and log noise,
> and it sends the gateway bind credential to the backend directory.
> *Expected:* when the bind DN equals the configured in-memory bind user,
> authenticate it locally and skip the backend.
> Related: KNOX-3533 (pass requested attributes to the backend search). With
> item 1 fixed, the KnoxIDF LDAP user-parameter provider would also work
> against the embedded server with a plain {{{}userDnTemplate{}}}, without
> {{userSearchBase}} (see KNOX-3540).
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
