[
https://issues.apache.org/jira/browse/KNOX-3487?focusedWorklogId=1048387&page=com.atlassian.jira.plugin.system.issuetabpanels:worklog-tabpanel#worklog-1048387
]
ASF GitHub Bot logged work on KNOX-3487:
----------------------------------------
Author: ASF GitHub Bot
Created on: 20/Oct/26 07:43
Start Date: 20/Oct/26 07:43
Worklog Time Spent: 10m
Work Description: handavid commented on code in PR #1454:
URL: https://github.com/apache/knox/pull/1454#discussion_r4322594599
##########
gateway-server/src/main/java/org/apache/knox/gateway/services/ldap/backend/LdapProxyBackend.java:
##########
@@ -861,13 +919,49 @@ private List<Entry> getUserGroupsInternal(LdapConnection
connection, Dn... dns)
return groups;
}
- String filter = buildMultipleGroupMemberFilter(dns);
-
- groups.addAll(performPagedSearch(connection, remoteGroupSearchBase,
filter, SearchScope.SUBTREE, "cn"));
+ groups.addAll(performSplitSearch(connection, remoteGroupSearchBase,
buildMultipleGroupMemberFilters(dns), SearchScope.SUBTREE, "cn"));
return groups;
}
+ /**
+ * Splits a filter that exceeds maxFilterLength into several filters whose
combined results are
+ * equivalent to the original filter. A filter that can't be split is
returned as is.
+ */
+ private List<String> splitFilter(String filter) throws LdapException {
+ if (maxFilterLength <= 0 || filter.length() <= maxFilterLength) {
+ return List.of(filter);
+ }
+ try {
+ // Remote attributes may be unknown to the local schema so parse
without a schema manager
+ List<ExprNode> pieces =
FilterSplitter.split(FilterParser.parse(filter), maxFilterLength);
+ LOG.ldapFilterSplit(filter.length(), maxFilterLength,
pieces.size());
+ return
pieces.stream().map(ExprNode::toString).collect(Collectors.toList());
+ } catch (java.text.ParseException e) {
+ throw new LdapException("Unable to split oversized filter: " +
e.getMessage(), e);
+ }
+ }
+
+ /**
+ * Executes each filter as a separate paged search and combines the
results, removing entries
+ * returned by more than one query. Stops early once maxResultSetSize
entries have been collected.
+ */
+ protected List<Entry> performSplitSearch(LdapConnection connection, String
baseDn, List<String> filters, SearchScope scope, String... attributes) throws
LdapException, CursorException, IOException {
+ if (filters.size() == 1) {
+ return performPagedSearch(connection, baseDn, filters.get(0),
scope, attributes);
+ }
+ Map<String, Entry> combined = new LinkedHashMap<>();
+ for (String filter : filters) {
+ for (Entry entry : performPagedSearch(connection, baseDn, filter,
scope, attributes)) {
+ combined.putIfAbsent(entry.getDn().getNormName(), entry);
+ }
+ if (maxResultSetSize != 0 && combined.size() >= maxResultSetSize) {
+ break;
+ }
+ }
+ return new ArrayList<>(combined.values());
Review Comment:
truncated both the split search and paged search in case a single page is
larger than the maxResultSetSize
Issue Time Tracking
-------------------
Worklog Id: (was: 1048387)
Time Spent: 1.5h (was: 1h 20m)
> LDAP Proxy find all members of a role
> -------------------------------------
>
> Key: KNOX-3487
> URL: https://issues.apache.org/jira/browse/KNOX-3487
> Project: Apache Knox
> Issue Type: Improvement
> Components: Server
> Affects Versions: 3.1.0
> Reporter: David Han
> Assignee: David Han
> Priority: Major
> Fix For: 3.1.0
>
> Time Spent: 1.5h
> Remaining Estimate: 0h
>
> When role lookup is enabled on the LDAP Proxy, the LDAP Proxy should be able
> to return all users that are assigned a role. E.g.,
> {code}
> ldapsearch -b 'ou=users,DC=proxy,DC=com' -s sub
> '(memberOf=cn=rolename,ou=groups,dc=proxy,dc=com)' '*'
> {code}
> This would require calling the roles lookup service to get the mapped users
> and groups for the given role. Then modifying the search filter to replace
> the rolename with the users and groups.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
