handavid commented on code in PR #1431:
URL: https://github.com/apache/knox/pull/1431#discussion_r4107300753
##########
gateway-server/src/main/java/org/apache/knox/gateway/services/ldap/interceptor/LDAPRolesLookupInterceptor.java:
##########
@@ -81,7 +81,15 @@ public EntryFilteringCursor search(SearchOperationContext
ctx) throws LdapExcept
if (!entries.isEmpty()) {
for (Entry entry : entries) {
try {
- final String username =
LdapUtils.extractUsernameFromEntry(entry, "uid", "cn");
+ // Key the role lookup on the stable uid, never a display
name. The entry's DN
+ // (uid=...,ou=people,...) is always present, whereas the
uid *attribute* is
+ // stripped when the LDAP client (e.g. Hadoop
LdapGroupsMapping) does not request
+ // it, leaving only cn and resolving the wrong roles.
Prefer the uid from the DN,
+ // falling back to entry attributes for non-uid-based DNs.
+ String username =
LdapUtils.extractUsernameFromDn(entry.getDn());
Review Comment:
in active directory the sAMAccountName is the userid and the CN is
potentially a display name.
e.g., here's an example
```
# sample user, people, proxy.com
dn: CN=sample user,ou=people,dc=proxy,dc=com
sn: user
samaccountname: sampleuser
cn: sample user
objectclass: top
objectclass: organizationalPerson
objectclass: user
objectclass: inetOrgPerson
name: sample user
givenname: sample
useraccountcontrol: 66048
distinguishedname: CN=sample user,ou=people,dc=proxy,dc=com
displayname: sample user
uid: sampleuser
```
when search is configured to only return the dn
```
# sample user, people, proxy.com
dn: CN=sample user,ou=people,dc=proxy,dc=com
```
note that the LdapProxyBackend populates the uid attribute from the
sAMAccountName. We can modify the attributes on the search filter to add uid,
then strip the uid attribute out of the entries if uid wasn't originally
requested. I was already thinking about this to add the objectclass similarly
so that we can definitively distinguish between user and group entries. The PR
#1428 that I posted has a similar problem where it can't detect if an entry is
a group if the object class is not a returned attribute.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
