handavid opened a new pull request, #1454: URL: https://github.com/apache/knox/pull/1454
[KNOX-3486](https://issues.apache.org/jira/browse/KNOX-3486) - LDAP Proxy supports role listing [KNOX-3487](https://issues.apache.org/jira/browse/KNOX-3487) - LDAP Proxy supports reverse role lookups ## What changes were proposed in this pull request? Reverse role lookup (role to members) and role listing is added to the LdapRolesLookupService. This is supported by both file and rest-based implementations. Role listing is performed by analyzing the search to determine if it returns all groups. The overall LDAP search is then short-circuited and role entries are returned from the roles "list" endpoint instead. Reverse role lookup is performed by expanding "memberOf" expressions in the search filter to the matching users and groups as returned from the roles "get" endpoint. Additional improvements to memberOf handling was added to the LdapProxyBackend to expand the search filter if "useMemberOf" is set to false. This expansion uses the same recursive resolution max depth that is used for transitive membership calcuations. These changes may increase the size of the search filter. The LdapProxyBackend will split the search filter into multiple backend searches if it becomes too large. ## How was this patch tested? Unit tests were added for the new functionality. Role list and get functionality was tested against file and rest endpoints. ## Integration Tests (Please add or update integration tests [`.github/workflows/tests`](.github/workflows/tests) for the feature you are adding. If no unit test is added, please explain why. Check out [`.github/workflows/tests/README.md`](./workflows/tests/README.md) for instructions) Workflow tests were added to test_knox_ldap_proxy_search_with_role_lookup.py ## UI changes no UI changes -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
