[
https://issues.apache.org/jira/browse/KNOX-3546?focusedWorklogId=1053928&page=com.atlassian.jira.plugin.system.issuetabpanels:worklog-tabpanel#worklog-1053928
]
ASF GitHub Bot logged work on KNOX-3546:
----------------------------------------
Author: ASF GitHub Bot
Created on: 10/Nov/26 22:52
Start Date: 10/Nov/26 22:52
Worklog Time Spent: 10m
Work Description: handavid opened a new pull request, #1503:
URL: https://github.com/apache/knox/pull/1503
[KNOX-3546](https://issues.apache.org/jira/browse/KNOX-3546) - Fix all
groups search in roles lookup interceptor
## What changes were proposed in this pull request?
ApacheDS modifies incoming search filters by ORing with
(objectClass=referral). The determination by the LDAPRolesLookupInterceptor for
whether a search is an "all groups" did not handle this case properly to ensure
that broader searches would still pass through to the LDAP backends.
This commit specifically recognizes (objectClass=referral) when determining
if a search filter is for "all groups".
## How was this patch tested?
Unit tests were modified to cover this filter.
## Integration Tests
The workload test was unskipped and run
## UI changes
no UI changes
Issue Time Tracking
-------------------
Worklog Id: (was: 1053928)
Remaining Estimate: 0h
Time Spent: 10m
> LDAP proxy roles lookup: role listing from an ancestor of ou=groups is never
> detected because ApacheDS adds (objectClass=referral) to the search filter
> --------------------------------------------------------------------------------------------------------------------------------------------------------
>
> Key: KNOX-3546
> URL: https://issues.apache.org/jira/browse/KNOX-3546
> Project: Apache Knox
> Issue Type: Bug
> Components: LDAP
> Affects Versions: 3.0.0
> Reporter: Sandor Molnar
> Assignee: David Han
> Priority: Major
> Fix For: 3.1.0
>
> Time Spent: 10m
> Remaining Estimate: 0h
>
> A group search from an ancestor of {{ou=groups,<proxy base dn>}} (for example
> the proxy root {{{}dc=proxy,dc=com{}}}) with a group objectClass filter
> should be answered with the roles from the role lookup service
> ({{{}listRoles(){}}}). It isn't. The backend groups are translated to roles
> instead, so roles that are assigned only to users are missing from the result.
> *Reproduce* (using the E2E {{{}roles.json{}}}, where {{platform:deployer}} is
> assigned only to the user {{{}recursiveuser{}}}):
> {code:java}
> ldapsearch -x -H ldap://localhost:3890 -b 'dc=proxy,dc=com'
> '(objectClass=groupOfNames)' cn
> {code}
> Expected: every role, including {{{}platform:deployer{}}}. Actual: only the
> roles mapped from backend groups.
> *Root cause:* ApacheDS {{SearchRequestHandler.modifyFilter}} rewrites the
> client's filter to {{{}(|<filter>(objectClass=referral)){}}}, so that
> referral entries are returned too. It skips the rewrite only when the filter
> is {{(objectClass=*)}} or the request carries the ManageDsaIT control
> ({{{}2.16.840.1.113730.3.4.2{}}}). The interceptors therefore get
> {{{}(|(objectClass=groupOfNames)(objectClass=referral)){}}}.
> For a search from an ancestor of {{{}ou=groups{}}},
> {{LDAPRolesLookupInterceptor.isAllGroupsFilterForAncestor}} requires every OR
> branch to be a group objectClass filter. {{objectClass=referral}} isn't one,
> so the search is never detected as a role listing, and {{handleSearch}}
> translates the backend groups instead.
> Searches based at {{ou=groups}} aren't affected. There the OR rule only needs
> one matching branch.
> The bug has been there since KNOX-3487. The unit tests didn't catch it
> because they hand the interceptor the unwrapped filter. The E2E test didn't
> catch it because every role in {{roles.json}} was assigned to a group, so
> translating the groups gave the same set of roles.
> *Workaround:* search from {{{}ou=groups,<proxy base dn>{}}}, or send the
> ManageDsaIT control.
> *Proposed fix:*
> * In {{{}isAllGroupsSearch{}}}, remove the {{(objectClass=referral)}} branch
> that ApacheDS added before checking the filter.
> * Add unit tests that use the rewritten filter: group filters from the root
> are detected as listings, and non-group filters still aren't.
> * Remove the {{@unittest.skip}} from
> {{test_list_all_roles_from_proxy_root_with_group_filter}} in
> {{.github/workflows/tests/test_knox_ldap_proxy_search_with_role_lookup.py}}
> (skipped in KNOX-3539).
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
