[
https://issues.apache.org/jira/browse/KNOX-3553?focusedWorklogId=1052963&page=com.atlassian.jira.plugin.system.issuetabpanels:worklog-tabpanel#worklog-1052963
]
ASF GitHub Bot logged work on KNOX-3553:
----------------------------------------
Author: ASF GitHub Bot
Created on: 06/Nov/26 09:29
Start Date: 06/Nov/26 09:29
Worklog Time Spent: 10m
Work Description: github-actions[bot] commented on PR #1493:
URL: https://github.com/apache/knox/pull/1493#issuecomment-6681671476
## Test Results
5 files 5 suites 1m 22s ⏱️
198 tests 196 ✅ 2 💤 0 ❌
239 runs 237 ✅ 2 💤 0 ❌
Results for commit c2212fdd.
[test-results]:data:application/gzip;base64,H4sIANad7WoC/02MwQ6DIBAFf8Vw7gGWVKA/Y3CBZFOVBuHU9N+LRtHjzMubLws0+ZW9uuejY2uh3MCVZDPFpaKGynXJ2yaMPmlYC+Ku+ku96VNVewzB0lQFb8KnFNNhUlm2JkhzwJkEqZq5ijvfgjvfexjnmXIFhgACgnPaOoOCg9KCyzCqUfbKjRjQW9t7rtnvDwGIGUUEAQAA
Issue Time Tracking
-------------------
Worklog Id: (was: 1052963)
Time Spent: 20m (was: 10m)
> HadoopGroupProvider marks the roles lookup as executed even when the embedded
> LDAP search finds no user entry
> -------------------------------------------------------------------------------------------------------------
>
> Key: KNOX-3553
> URL: https://issues.apache.org/jira/browse/KNOX-3553
> Project: Apache Knox
> Issue Type: Bug
> Components: Authorization, LDAP, Server
> Affects Versions: 3.0.0
> Reporter: Sandor Molnar
> Assignee: Sandor Molnar
> Priority: Blocker
> Fix For: 3.1.0
>
> Time Spent: 20m
> Remaining Estimate: 0h
>
> When {{HadoopGroupProvider}} uses the embedded LDAP service
> ({{use.ldap.service=true}}) and the {{LDAPRolesLookupInterceptor}} is
> configured, {{HadoopGroupProviderFilter#hadoopGroups}} always sets the
> {{ROLES_LOOKUP_EXECUTED}} request attribute:
> {code:java}
> if (request != null && ldapService.hasRolesLookupInterceptor()) {
> request.setAttribute(ROLES_LOOKUP_EXECUTED, Boolean.TRUE.toString());
> }
> {code}
> The interceptor only does a roles lookup for each user entry the search
> returns. A principal that isn't in LDAP (e.g. a Kubernetes service account
> authenticated by {{JWTProvider}}) gets 0 entries back, so no lookup runs. The
> flag still says it did, so {{AbstractAuthResource#lookupRoles}} skips its own
> lookup. The roles configured for that principal are then missing from
> {{X-Knox-Actor-Groups}}.
> *Steps to reproduce:*
> # Set up a topology with {{JWTProvider}} (federation),
> {{HadoopGroupProvider}} ({{LdapGroupsMapping}}, {{use.ldap.service=true}})
> and {{KNOX-AUTH-SERVICE}}, with the roles lookup interceptor enabled on the
> embedded LDAP.
> # Assign a role to a k8s service account in the roles service.
> # Call {{/auth/api/v1/pre}} with that service account's JWT.
> *Actual:* The LDAP log shows "Found 0 entries" and {{X-Knox-Actor-Groups}}
> has no role.
> *Expected:* {{X-Knox-Actor-Groups}} contains the configured role.
> *Proposed fix:* Set {{ROLES_LOOKUP_EXECUTED}} only when the user's entry was
> actually found and processed by the interceptor. Otherwise the auth service
> falls back to its own roles lookup.
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
