Sandor Molnar created KNOX-3553:
-----------------------------------
Summary: HadoopGroupProvider marks the roles lookup as executed
even when the embedded LDAP search finds no user entry
Key: KNOX-3553
URL: https://issues.apache.org/jira/browse/KNOX-3553
Project: Apache Knox
Issue Type: Bug
Components: Authorization, LDAP, Server
Affects Versions: 3.0.0
Reporter: Sandor Molnar
Assignee: Sandor Molnar
Fix For: 3.1.0
When {{HadoopGroupProvider}} uses the embedded LDAP service
({{use.ldap.service=true}}) and the {{LDAPRolesLookupInterceptor}} is
configured, {{HadoopGroupProviderFilter#hadoopGroups}} always sets the
{{ROLES_LOOKUP_EXECUTED}} request attribute:
{code:java}
if (request != null && ldapService.hasRolesLookupInterceptor()) {
request.setAttribute(ROLES_LOOKUP_EXECUTED, Boolean.TRUE.toString());
}
{code}
The interceptor only does a roles lookup for each user entry the search
returns. A principal that isn't in LDAP (e.g. a Kubernetes service account
authenticated by {{JWTProvider}}) gets 0 entries back, so no lookup runs. The
flag still says it did, so {{AbstractAuthResource#lookupRoles}} skips its own
lookup. The roles configured for that principal are then missing from
{{X-Knox-Actor-Groups}}.
*Steps to reproduce:*
# Set up a topology with {{JWTProvider}} (federation), {{HadoopGroupProvider}}
({{LdapGroupsMapping}}, {{use.ldap.service=true}}) and {{KNOX-AUTH-SERVICE}},
with the roles lookup interceptor enabled on the embedded LDAP.
# Assign a role to a k8s service account in the roles service.
# Call {{/auth/api/v1/pre}} with that service account's JWT.
*Actual:* The LDAP log shows "Found 0 entries" and {{X-Knox-Actor-Groups}} has
no role.
*Expected:* {{X-Knox-Actor-Groups}} contains the configured role.
*Proposed fix:* Set {{ROLES_LOOKUP_EXECUTED}} only when the user's entry was
actually found and processed by the interceptor. Otherwise the auth service
falls back to its own roles lookup.
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
