Sandor Molnar created KNOX-3546:
-----------------------------------
Summary: LDAP proxy roles lookup: role listing from an ancestor
of ou=groups is never detected because ApacheDS adds (objectClass=referral) to
the search filter
Key: KNOX-3546
URL: https://issues.apache.org/jira/browse/KNOX-3546
Project: Apache Knox
Issue Type: Bug
Components: LDAP
Affects Versions: 3.0.0
Reporter: Sandor Molnar
Assignee: Sandor Molnar
Fix For: 3.1.0
A group search from an ancestor of {{ou=groups,<proxy base dn>}} (for example
the proxy root {{{}dc=proxy,dc=com{}}}) with a group objectClass filter should
be answered with the roles from the role lookup service ({{{}listRoles(){}}}).
It isn't. The backend groups are translated to roles instead, so roles that are
assigned only to users are missing from the result.
*Reproduce* (using the E2E {{{}roles.json{}}}, where {{platform:deployer}} is
assigned only to the user {{{}recursiveuser{}}}):
{code:java}
ldapsearch -x -H ldap://localhost:3890 -b 'dc=proxy,dc=com'
'(objectClass=groupOfNames)' cn
{code}
Expected: every role, including {{{}platform:deployer{}}}. Actual: only the
roles mapped from backend groups.
*Root cause:* ApacheDS {{SearchRequestHandler.modifyFilter}} rewrites the
client's filter to {{{}(|<filter>(objectClass=referral)){}}}, so that referral
entries are returned too. It skips the rewrite only when the filter is
{{(objectClass=*)}} or the request carries the ManageDsaIT control
({{{}2.16.840.1.113730.3.4.2{}}}). The interceptors therefore get
{{{}(|(objectClass=groupOfNames)(objectClass=referral)){}}}.
For a search from an ancestor of {{{}ou=groups{}}},
{{LDAPRolesLookupInterceptor.isAllGroupsFilterForAncestor}} requires every OR
branch to be a group objectClass filter. {{objectClass=referral}} isn't one, so
the search is never detected as a role listing, and {{handleSearch}} translates
the backend groups instead.
Searches based at {{ou=groups}} aren't affected. There the OR rule only needs
one matching branch.
The bug has been there since KNOX-3487. The unit tests didn't catch it because
they hand the interceptor the unwrapped filter. The E2E test didn't catch it
because every role in {{roles.json}} was assigned to a group, so translating
the groups gave the same set of roles.
*Workaround:* search from {{{}ou=groups,<proxy base dn>{}}}, or send the
ManageDsaIT control.
*Proposed fix:*
* In {{{}isAllGroupsSearch{}}}, remove the {{(objectClass=referral)}} branch
that ApacheDS added before checking the filter.
* Add unit tests that use the rewritten filter: group filters from the root
are detected as listings, and non-group filters still aren't.
* Remove the {{@unittest.skip}} from
{{test_list_all_roles_from_proxy_root_with_group_filter}} in
{{.github/workflows/tests/test_knox_ldap_proxy_search_with_role_lookup.py}}
(skipped in KNOX-3539).
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
