handavid commented on code in PR #1428:
URL: https://github.com/apache/knox/pull/1428#discussion_r4140493230
##########
gateway-server/src/main/java/org/apache/knox/gateway/services/ldap/interceptor/LDAPRolesLookupInterceptor.java:
##########
@@ -78,21 +80,80 @@ public EntryFilteringCursor search(SearchOperationContext
ctx) throws LdapExcept
throw new LdapException(e);
}
- if (!entries.isEmpty()) {
- for (Entry entry : entries) {
- try {
+ final List<Entry> roleEntries = new ArrayList<>();
+ final List<Entry> resultEntries = new ArrayList<>(entries.size());
+ for (Entry entry : entries) {
+ try {
+ if (LdapUtils.isGroupEntry(entry)) {
+ roleEntries.addAll(translateGroupEntry(entry));
+ } else {
final String username =
LdapUtils.extractUsernameFromEntry(entry, "uid", "cn");
final Set<String> groups = fetchGroups(entry);
final Collection<String> roles =
rolesLookupService.lookupRoles(username, groups);
modifyEntry(entry, roles);
- } catch (Exception e) {
- LOG.ldapRolesLookupFailed("Error while updating entry with
roles lookup results", e);
- throw new LdapException(e);
+ resultEntries.add(entry);
+ }
+ } catch (Exception e) {
+ LOG.ldapRolesLookupFailed(entry.getDn().getName(), e);
+ throw new LdapException(e);
+ }
+ }
+ resultEntries.addAll(deduplicate(roleEntries));
+
+ return new EntryFilteringCursorImpl(new ListCursor<>(resultEntries),
ctx, ctx.getSession().getDirectoryService().getSchemaManager());
+ }
+
+ private Collection<? extends Entry> deduplicate(List<Entry> roleEntries)
throws LdapException {
+ Map<Dn, Entry> dedup = new HashMap<>();
+ for (Entry entry : roleEntries) {
+ Dn dn = entry.getDn();
+ if (!dedup.containsKey(dn)) {
+ dedup.put(dn, entry);
+ } else {
+ combineGroupEntry(dedup.get(dn), entry);
+ }
+ }
+ return dedup.values();
+ }
+
+ private void combineGroupEntry(Entry entry1, Entry entry2) throws
LdapException {
Review Comment:
updated to create a blank entry instead of cloning. then both members and
uniqueMembers are added as members of the new entry.
##########
gateway-server/src/main/java/org/apache/knox/gateway/services/ldap/backend/FilterMappingVisitor.java:
##########
@@ -68,6 +74,17 @@ private Object handleLeafNode(LeafNode leafNode) {
leafNode.setAttributeType(schemaManager.getAttributeType(userIdentifierAttribute));
}
+ // Map the dn-valued attributes from the proxy base dn to remote base
dn
+ if
(DN_VALUED_ATTRIBUTES.contains(currentAttribute.toLowerCase(Locale.ROOT))) {
Review Comment:
fixed
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
