[
https://issues.apache.org/jira/browse/KNOX-3397?focusedWorklogId=1032364&page=com.atlassian.jira.plugin.system.issuetabpanels:worklog-tabpanel#worklog-1032364
]
ASF GitHub Bot logged work on KNOX-3397:
----------------------------------------
Author: ASF GitHub Bot
Created on: 27/Jul/26 09:17
Start Date: 27/Jul/26 09:17
Worklog Time Spent: 10m
Work Description: github-actions[bot] commented on PR #1329:
URL: https://github.com/apache/knox/pull/1329#issuecomment-5089518617
## Test Results
40 tests 40 ✅ 6s ⏱️
3 suites 0 💤
3 files 0 ❌
Results for commit 418d53b3.
[test-results]:data:application/gzip;base64,H4sIABgiZ2oC/12MSQ7CMBAEvxL5zCH2TEzgM8irNCKJkZcT4u84AbJw66qW6sk8DS6xawOnhqVCeQVbosoUpoqyYj3yfGH7g1sqxvyZOz2q2YRXNByEizHEr4llWovzPgQ/YustvMstvK+ZMI6UKzDkve1AA6BDwdXFKoeyh05r0UrBPYAQ1rsze70Br8+lx/8AAAA=
Issue Time Tracking
-------------------
Worklog Id: (was: 1032364)
Time Spent: 20m (was: 10m)
> Remove index suffix from actor groups header explicitly in
> AbstractAuthResource
> -------------------------------------------------------------------------------
>
> Key: KNOX-3397
> URL: https://issues.apache.org/jira/browse/KNOX-3397
> Project: Apache Knox
> Issue Type: Bug
> Components: Server
> Affects Versions: 3.0.0
> Reporter: Sandor Molnar
> Assignee: Sandor Molnar
> Priority: Major
> Fix For: 3.0.0
>
> Time Spent: 20m
> Remaining Estimate: 0h
>
> h3. Background
> KNOX-3354 introduced a change in {{AbstractAuthResource}} that removes the
> index suffix from the actor groups header when roles are resolved.
> Specifically, when role lookup happens at the resource layer (rather than in
> the LDAP interceptors), the configured actor groups header is no longer
> postfixed. This is useful in environments where role lookup is configured
> locally.
> h3. Problem
> A topology may instead use the {{RemoteAuthFilter}} to authenticate requests,
> where the remote counterpart is configured for role lookup. In that case,
> {{remote.auth.group.header}} returns roles rather than groups. However, the
> {{KNOX-AUTH-SERVICE}} configured in the topology still emits the suffixed
> version of {{preauth.auth.header.actor.groups.prefix}}, causing a mismatch.
> h3. Proposed change
> To give operators explicit control over this behavior, we introduce a new
> configuration parameter:
> {{preauth.auth.header.actor.groups}}
> When this parameter is declared, it takes precedence over the existing
> {{preauth.auth.header.actor.groups.prefix}} parameter and is used directly as
> the groups header in the response (without any suffix).
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
