[
https://issues.apache.org/jira/browse/KNOX-3539?focusedWorklogId=1052099&page=com.atlassian.jira.plugin.system.issuetabpanels:worklog-tabpanel#worklog-1052099
]
ASF GitHub Bot logged work on KNOX-3539:
----------------------------------------
Author: ASF GitHub Bot
Created on: 03/Nov/26 09:19
Start Date: 03/Nov/26 09:19
Worklog Time Spent: 10m
Work Description: smolnar82 opened a new pull request, #1479:
URL: https://github.com/apache/knox/pull/1479
[KNOX-3539](https://issues.apache.org/jira/browse/KNOX-3539) - Add an option
to lowercase the user ID in the LDAP proxy roles-lookup interceptor
## What changes were proposed in this pull request?
The LDAP proxy's roles-lookup interceptor takes the roles-lookup user id
from the `uid` of the entry the backend returns, not from the name the client
searched with. With Active Directory, that `uid` is the canonical
`sAMAccountName` (e.g. `Admin`), whatever case the user logged in with. A roles
service that stores assignments under the login-typed, lowercase id (`admin`)
then finds no roles.
This PR adds a new gateway-site property:
| Property | Default | Description |
|----------|---------|-------------|
| `gateway.ldap.roles.lookup.lowercase.user.id` | `false` | When `true`,
`LDAPRolesLookupInterceptor` lowercases the user id (`Locale.ROOT`) before
calling the roles lookup service. |
- `GatewayConfig`/`GatewayConfigImpl`: new property and
`isLdapRolesLookupLowercaseUserId()`. The `gateway.ldap.roles.` keys now share
an `LDAP_ROLES_PREFIX` constant.
- `KnoxLDAPServerManager`: passes the flag to `rolesLookup` interceptors
through their existing config map
(`LDAPRolesLookupInterceptor.LOWERCASE_USER_ID`).
- `LDAPRolesLookupInterceptor`: applies the flag to the lookup key only. The
entry returned to the client, including its `uid`, is unchanged.
- Docs: `knox-site/docs/service_ldap_server.md`.
Behavior is unchanged by default.
## How was this patch tested?
Unit tests:
- `GatewayConfigImplTest#testLdapRolesLookupLowercaseUserId`: default
`false`, and can be enabled.
- `LDAPRolesLookupInterceptorTest`:
- `testRolesLookupKeepsUserIdCaseByDefault`
- `testRolesLookupLowercasesUserIdWhenEnabled`
- `testRolesLookupLowercaseUserIdDoesNotChangeReturnedEntry`
The new REST E2E pass below was run locally with Docker Compose: 35 passed,
2 skipped.
## Integration Tests
This adds a **REST roles lookup E2E pass**. It runs on every PR, like the
HashiCorp Vault pass, and isn't label-gated.
- `compose/role-lookup-rest/mock_roles_api.py`: a stdlib-only mock of the
roles REST API that serves `compose/role-lookup/roles.json`. It implements the
lookup (POST), paged list (GET) and get-by-id endpoints.
- `compose/docker-compose.role-lookup-rest.yml`: adds the `roles-api`
service and recreates `knox` with `compose/role-lookup-rest/gateway-site.xml`,
which sets `strategy=rest` and
`gateway.ldap.roles.lookup.lowercase.user.id=true`.
- `tests/test_knox_ldap_proxy_search_with_rest_role_lookup.py`:
- inherits every test from the file-strategy roles lookup suite, so the
REST strategy gets the same coverage;
- adds lowercase user id tests. `roles.json` now assigns
`platform:deployer` to the user id `recursiveuser`. The demo directory's uid is
the mixed-case `recursiveUser`, so the role is only resolved when the user id
is lowercased. The tests check this with differently cased search filters, and
also check that the returned `uid` keeps its case.
- The file-strategy suite (still opt-in, not run in CI) gains matching
default-behaviour tests: case is kept, and the reverse lookup of a role
assigned to a user id of a different case still works.
- `tests.yml`: new steps that run the pass, dump diagnostics (knox and
roles-api logs) on failure, and upload `test-results-rest-role-lookup.xml`. The
default `docker-compose.yml` run ignores `test*_with_rest_role_lookup.py`.
```
$ docker compose -f .github/workflows/compose/docker-compose.yml -f
.github/workflows/compose/docker-compose.role-lookup-rest.yml up -d
--force-recreate knox roles-api && sleep 30
[+] up 6/6
✔ Container compose-ldap-1 Running
0.0s
✔ Container compose-k3s-1 Running
0.0s
✔ Container compose-roles-api-1 Healthy
12.1s
✔ Container compose-knox-1 Started
8.9s
✔ Container compose-knox-dev-1 Started
0.1s
✔ Container compose-k8s-bootstrap-1 Exited
0.6s
$ docker compose -f .github/workflows/compose/docker-compose.yml -f
.github/workflows/compose/docker-compose.role-lookup-rest.yml run --rm tests
bash -c "pip install -r requirements.txt && pytest
test*_with_rest_role_lookup.py --junitxml=test-results-rest-role-lookup.xml"
[+] 6/6t 6/64
✔ Container compose-roles-api-1 Healthy
0.6s
✔ Container compose-ldap-1 Running
0.0s
✔ Container compose-k3s-1 Running
0.0s
✔ Container compose-knox-1 Running
0.0s
✔ Container compose-knox-dev-1 Started
0.1s
✔ Container compose-k8s-bootstrap-1 Exited
0.6s
Container compose-tests-run-3eaa2f249c1b Creating
Container compose-tests-run-3eaa2f249c1b Created
...
===============================================================================================================
test session starts
================================================================================================================
platform linux
Issue Time Tracking
-------------------
Worklog Id: (was: 1052099)
Remaining Estimate: 0h
Time Spent: 10m
> Add an option to lowercase the user ID in the LDAP proxy roles-lookup
> interceptor
> ---------------------------------------------------------------------------------
>
> Key: KNOX-3539
> URL: https://issues.apache.org/jira/browse/KNOX-3539
> Project: Apache Knox
> Issue Type: Task
> Components: LDAP, Server
> Affects Versions: 3.0.0
> Reporter: Sandor Molnar
> Assignee: Sandor Molnar
> Priority: Major
> Fix For: 3.1.0
>
> Time Spent: 10m
> Remaining Estimate: 0h
>
> The LDAP proxy's {{LDAPRolesLookupInterceptor}} builds the user ID for the
> roles lookup from the {{uid}} attribute of the entry returned by the backend
> directory. For Active Directory backends, uid holds {{sAMAccountName}}. AD
> matches this attribute case-insensitively, but the value comes back in its
> canonical case (e.g. {{Admin}}). Whatever case the client searched with
> ({{admin}}, {{ADMIN}}), the roles-lookup service receives {{Admin}}.
> If the roles backend stores and matches user IDs case-sensitively and has
> role memberships keyed on a different case (e.g. the login name as typed),
> the lookup finds nothing and the user gets no roles.
> *Proposal*: add a new gateway configuration property:
> {code}
> gateway.ldap.roles.lookup.lowercase.user.id = false (default)
> {code}
> When {{true}}, the interceptor lowercases the user ID before calling
> {{LDAPRolesLookupService.lookupRoles()}}. Combined with
> {{expression.principal.mapping = (lowercase username)}} in the
> {{identity-assertion}} provider, the asserted principal and the roles-lookup
> key are then always the same case. The default (false) keeps the current
> behavior.
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
