[
https://issues.apache.org/jira/browse/KNOX-3487?focusedWorklogId=1047356&page=com.atlassian.jira.plugin.system.issuetabpanels:worklog-tabpanel#worklog-1047356
]
ASF GitHub Bot logged work on KNOX-3487:
----------------------------------------
Author: ASF GitHub Bot
Created on: 14/Oct/26 04:54
Start Date: 14/Oct/26 04:54
Worklog Time Spent: 10m
Work Description: handavid opened a new pull request, #1454:
URL: https://github.com/apache/knox/pull/1454
[KNOX-3486](https://issues.apache.org/jira/browse/KNOX-3486) - LDAP Proxy
supports role listing
[KNOX-3487](https://issues.apache.org/jira/browse/KNOX-3487) - LDAP Proxy
supports reverse role lookups
## What changes were proposed in this pull request?
Reverse role lookup (role to members) and role listing is added to the
LdapRolesLookupService. This is supported by both file and rest-based
implementations.
Role listing is performed by analyzing the search to determine if it returns
all groups. The overall LDAP search is then short-circuited and role entries
are returned from the roles "list" endpoint instead.
Reverse role lookup is performed by expanding "memberOf" expressions in the
search filter to the matching users and groups as returned from the roles "get"
endpoint.
Additional improvements to memberOf handling was added to the
LdapProxyBackend to expand the search filter if "useMemberOf" is set to false.
This expansion uses the same recursive resolution max depth that is used for
transitive membership calcuations.
These changes may increase the size of the search filter. The
LdapProxyBackend will split the search filter into multiple backend searches if
it becomes too large.
## How was this patch tested?
Unit tests were added for the new functionality.
Role list and get functionality was tested against file and rest endpoints.
## Integration Tests
(Please add or update integration tests
[`.github/workflows/tests`](.github/workflows/tests) for the feature you are
adding. If no unit test is added, please explain why. Check out
[`.github/workflows/tests/README.md`](./workflows/tests/README.md) for
instructions)
Workflow tests were added to test_knox_ldap_proxy_search_with_role_lookup.py
## UI changes
no UI changes
Issue Time Tracking
-------------------
Worklog Id: (was: 1047356)
Remaining Estimate: 0h
Time Spent: 10m
> LDAP Proxy find all members of a role
> -------------------------------------
>
> Key: KNOX-3487
> URL: https://issues.apache.org/jira/browse/KNOX-3487
> Project: Apache Knox
> Issue Type: Improvement
> Components: Server
> Affects Versions: 3.1.0
> Reporter: David Han
> Assignee: David Han
> Priority: Major
> Fix For: 3.1.0
>
> Time Spent: 10m
> Remaining Estimate: 0h
>
> When role lookup is enabled on the LDAP Proxy, the LDAP Proxy should be able
> to return all users that are assigned a role. E.g.,
> {code}
> ldapsearch -b 'ou=users,DC=proxy,DC=com' -s sub
> '(memberOf=cn=rolename,ou=groups,dc=proxy,dc=com)' '*'
> {code}
> This would require calling the roles lookup service to get the mapped users
> and groups for the given role. Then modifying the search filter to replace
> the rolename with the users and groups.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
