[
https://issues.apache.org/jira/browse/KNOX-3538?focusedWorklogId=1054014&page=com.atlassian.jira.plugin.system.issuetabpanels:worklog-tabpanel#worklog-1054014
]
ASF GitHub Bot logged work on KNOX-3538:
----------------------------------------
Author: ASF GitHub Bot
Created on: 11/Nov/26 10:06
Start Date: 11/Nov/26 10:06
Worklog Time Spent: 10m
Work Description: smolnar82 commented on code in PR #1502:
URL: https://github.com/apache/knox/pull/1502#discussion_r4536523143
##########
gateway-server/src/main/java/org/apache/knox/gateway/services/ldap/interceptor/AttributeNormalizationInterceptor.java:
##########
@@ -0,0 +1,179 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.knox.gateway.services.ldap.interceptor;
+
+import com.google.common.annotations.VisibleForTesting;
+import org.apache.directory.api.ldap.model.constants.SchemaConstants;
+import org.apache.directory.api.ldap.model.entry.Attribute;
+import org.apache.directory.api.ldap.model.entry.DefaultAttribute;
+import org.apache.directory.api.ldap.model.entry.Entry;
+import org.apache.directory.api.ldap.model.entry.Value;
+import org.apache.directory.api.ldap.model.exception.LdapException;
+import org.apache.directory.api.ldap.model.name.Dn;
+import org.apache.directory.api.ldap.model.schema.AttributeType;
+import org.apache.directory.api.ldap.model.schema.MatchingRule;
+import
org.apache.directory.api.ldap.model.schema.normalizers.DeepTrimToLowerNormalizer;
+import org.apache.directory.server.core.api.filtering.EntryFilter;
+import org.apache.directory.server.core.api.filtering.EntryFilteringCursor;
+import org.apache.directory.server.core.api.interceptor.BaseInterceptor;
+import
org.apache.directory.server.core.api.interceptor.context.LookupOperationContext;
+import
org.apache.directory.server.core.api.interceptor.context.SearchOperationContext;
+import org.apache.knox.gateway.services.ldap.LdapUtils;
+
+import java.util.ArrayList;
+import java.util.List;
+import java.util.Locale;
+import java.util.regex.Matcher;
+import java.util.regex.Pattern;
+
+/**
+ * Interceptor that lowercases the values of case-insensitive attributes in
the entries it returns,
+ * so that clients see one canonical form regardless of how the backing
directory cased them.
+ * <p>
+ * The values of three kinds of attributes are lowercased: attributes whose
equality matching rule in
+ * the schema ignores case (e.g. {@code caseIgnoreMatch}, {@code
caseIgnoreIA5Match}), DN-valued
+ * attributes such as {@code member} and {@code memberOf},
name-and-optional-UID attributes such as
+ * {@code uniqueMember}, and {@code objectClass}. The entry DN is lowercased
as well.
+ * <p>
+ * It acts on the results of the interceptors listed after it, so list it
before any interceptor
+ * whose output it should normalize: interceptors that compare {@code
objectClass} values or parse
+ * group names from {@code memberOf} DNs must see the backend's original
values. Search results are
+ * normalized lazily, as the cursor is read.
+ */
+public class AttributeNormalizationInterceptor extends BaseInterceptor {
+
+ // RFC 4517 Name and Optional UID: a DN optionally followed by #'<binary
digits>'B. The UID suffix
+ // is syntax, not text, so only the DN part may be lowercased.
+ private static final Pattern NAME_AND_OPTIONAL_UID =
Pattern.compile("^(.*?)(#'[01]*'B)?$", Pattern.DOTALL);
+
+ private final EntryFilter normalizingFilter = new EntryFilter() {
+ @Override
+ public boolean accept(SearchOperationContext operation, Entry result)
throws LdapException {
+ normalize(result);
+ return true;
+ }
+
+ @Override
+ public String toString(String tabs) {
+ return tabs + "AttributeNormalizationFilter";
+ }
+ };
+
+ public AttributeNormalizationInterceptor(String name) {
+ super(name);
+ }
+
+ @Override
+ public Entry lookup(LookupOperationContext ctx) throws LdapException {
+ return normalize(next(ctx));
+ }
+
+ @Override
+ public EntryFilteringCursor search(SearchOperationContext ctx) throws
LdapException {
+ final EntryFilteringCursor cursor = next(ctx);
+ cursor.addEntryFilter(normalizingFilter);
+ return cursor;
+ }
+
+ @VisibleForTesting
+ Entry normalize(Entry entry) throws LdapException {
+ if (entry == null) {
+ return null;
+ }
+ lowercaseDn(entry);
+ for (Attribute attribute : new ArrayList<>(entry.getAttributes())) {
+ final AttributeType attributeType =
resolveAttributeType(attribute);
+ if (!shouldNormalize(attributeType)) {
+ continue;
+ }
+ final Attribute normalized = lowercase(attribute, attributeType);
+ if (normalized != null) {
+ entry.put(normalized);
+ }
+ }
+ return entry;
+ }
+
+ private void lowercaseDn(Entry entry) throws LdapException {
+ final Dn dn = entry.getDn();
+ if (dn == null || dn.isEmpty()) {
+ return;
+ }
+ final String name = dn.getName();
+ final String lowered = name.toLowerCase(Locale.ROOT);
Review Comment:
nit: this lowercases the whole DN string, including RDN values of attribute
types that compare case-sensitively. Probably fine for the purpose, but maybe
worth one sentence in the docs.
##########
gateway-server/src/main/java/org/apache/knox/gateway/services/ldap/interceptor/AttributeNormalizationInterceptor.java:
##########
@@ -0,0 +1,179 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.knox.gateway.services.ldap.interceptor;
+
+import com.google.common.annotations.VisibleForTesting;
+import org.apache.directory.api.ldap.model.constants.SchemaConstants;
+import org.apache.directory.api.ldap.model.entry.Attribute;
+import org.apache.directory.api.ldap.model.entry.DefaultAttribute;
+import org.apache.directory.api.ldap.model.entry.Entry;
+import org.apache.directory.api.ldap.model.entry.Value;
+import org.apache.directory.api.ldap.model.exception.LdapException;
+import org.apache.directory.api.ldap.model.name.Dn;
+import org.apache.directory.api.ldap.model.schema.AttributeType;
+import org.apache.directory.api.ldap.model.schema.MatchingRule;
+import
org.apache.directory.api.ldap.model.schema.normalizers.DeepTrimToLowerNormalizer;
+import org.apache.directory.server.core.api.filtering.EntryFilter;
+import org.apache.directory.server.core.api.filtering.EntryFilteringCursor;
+import org.apache.directory.server.core.api.interceptor.BaseInterceptor;
+import
org.apache.directory.server.core.api.interceptor.context.LookupOperationContext;
+import
org.apache.directory.server.core.api.interceptor.context.SearchOperationContext;
+import org.apache.knox.gateway.services.ldap.LdapUtils;
+
+import java.util.ArrayList;
+import java.util.List;
+import java.util.Locale;
+import java.util.regex.Matcher;
+import java.util.regex.Pattern;
+
+/**
+ * Interceptor that lowercases the values of case-insensitive attributes in
the entries it returns,
+ * so that clients see one canonical form regardless of how the backing
directory cased them.
+ * <p>
+ * The values of three kinds of attributes are lowercased: attributes whose
equality matching rule in
+ * the schema ignores case (e.g. {@code caseIgnoreMatch}, {@code
caseIgnoreIA5Match}), DN-valued
+ * attributes such as {@code member} and {@code memberOf},
name-and-optional-UID attributes such as
+ * {@code uniqueMember}, and {@code objectClass}. The entry DN is lowercased
as well.
+ * <p>
+ * It acts on the results of the interceptors listed after it, so list it
before any interceptor
Review Comment:
This ordering advice is backwards. `KnoxLDAPServerManager.addInterceptors`
inserts every configured interceptor at the same `authIdx`, so the *last* name
in `gateway.ldap.interceptor.names` ends up outermost and sees the results of
the ones listed before it. The `.md` docs (line 154) get this right ("list it
after…"), and so does the CI config `demoldap,normalizer`. Someone who follows
this Javadoc would put the normalizer **before** `roleslookup`, and the roles
interceptor would then see lowercased `memberOf` values. Can we make the
Javadoc match the docs? OR remove this advice (we have the same info in the
docs anyway).
Issue Time Tracking
-------------------
Worklog Id: (was: 1054014)
Time Spent: 40m (was: 0.5h)
> LDAP Proxy normalize attributes by lowercasing
> ----------------------------------------------
>
> Key: KNOX-3538
> URL: https://issues.apache.org/jira/browse/KNOX-3538
> Project: Apache Knox
> Issue Type: Improvement
> Components: Server
> Affects Versions: 3.1.0
> Reporter: David Han
> Assignee: David Han
> Priority: Major
> Fix For: 3.1.0
>
> Time Spent: 40m
> Remaining Estimate: 0h
>
> The LDAP Proxy returns attributes in whatever casing the backed provides.
> This may cause issues in systems that are not aware which attributes are case
> sensitive or case insensitive. Provide the ability for the LDAP Proxy to
> lowercase values for case insensitive attributes.
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
