[
https://issues.apache.org/jira/browse/KNOX-3554?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18139567#comment-18139567
]
ASF subversion and git services commented on KNOX-3554:
-------------------------------------------------------
Commit 7c08a4c3b2a41ecac9980f47d5036072622121a6 in knox's branch
refs/heads/master from Sandor Molnar
[ https://gitbox.apache.org/repos/asf?p=knox.git;h=7c08a4c3b ]
KNOX-3554: HadoopGroupProvider: skip the group lookup for principals known not
to exist in LDAP (#1494)
> HadoopGroupProvider: skip the group lookup for principals known not to exist
> in LDAP
> ------------------------------------------------------------------------------------
>
> Key: KNOX-3554
> URL: https://issues.apache.org/jira/browse/KNOX-3554
> Project: Apache Knox
> Issue Type: Improvement
> Components: HadoopGroupProvider
> Affects Versions: 3.0.0
> Reporter: Sandor Molnar
> Assignee: Sandor Molnar
> Priority: Major
> Fix For: 3.1.0
>
> Time Spent: 0.5h
> Remaining Estimate: 0h
>
> Some authenticated principals are known in advance not to exist in LDAP (e.g.
> Kubernetes service accounts or other workload identities arriving as JWTs).
> {{HadoopGroupProvider}} still runs a group lookup for them. With
> {{use.ldap.service=true}} that means an embedded KnoxLDAP search plus a round
> trip to the backend LDAP, which always returns nothing.
> Add a new optional {{HadoopGroupProvider}} parameter,
> {{group.lookup.skip.principal.pattern}} (a regex, full match against the
> mapped principal name). Principals matching it get no groups and no LDAP
> call, on both the Knox LDAP service and the Hadoop {{LdapGroupsMapping}}
> paths. Like any other provider parameter, it can be set centrally in
> gateway-site via {{CENTRAL_GROUP_CONFIG_PREFIX}}, e.g.
> {{gateway.group.config.group.lookup.skip.principal.pattern}}.
> {{ROLES_LOOKUP_EXECUTED}} is not set for skipped principals, so downstream
> consumers (e.g. {{KNOX-AUTH-SERVICE}}) still do their own roles lookup.
> Example:
> {code:xml}
> <param>
> <name>group.lookup.skip.principal.pattern</name>
> <value>system:serviceaccount:.*</value>
> </param>
> {code}
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
