[
https://issues.apache.org/jira/browse/KNOX-3541?focusedWorklogId=1052233&page=com.atlassian.jira.plugin.system.issuetabpanels:worklog-tabpanel#worklog-1052233
]
ASF GitHub Bot logged work on KNOX-3541:
----------------------------------------
Author: ASF GitHub Bot
Created on: 03/Nov/26 18:53
Start Date: 03/Nov/26 18:53
Worklog Time Spent: 10m
Work Description: smolnar82 opened a new pull request, #1482:
URL: https://github.com/apache/knox/pull/1482
[KNOX-3541](https://issues.apache.org/jira/browse/KNOX-3541) - Embedded
LDAP: answer base-object searches on proxied DNs from the backend, bind the
in-memory bind user locally
## What changes were proposed in this pull request?
This fixes two issues in `UserSearchInterceptor`, the interceptor that
proxies users from a backend into Knox's embedded LDAP server.
**1. Base-object search on a proxied user DN failed with ERR_648**
`search()` searches the local partition first. A user such as
`uid=alice,ou=people,<baseDn>` exists only in the backend. So a base-object (or
one-level) search rooted at that DN failed in the local partition with
`LdapNoSuchObjectException: ERR_648 Invalid search base`, and the backend was
never consulted:
ldapsearch -H ldap://localhost:10389 -D <bind user> -w ... -s base -b
uid=alice,ou=people,dc=proxy,dc=com
# result: 32 No such object / ERR_648 Invalid search base
Now, when the local partition reports no-such-object for a search base that
the backend supports (`LdapBackend.isSupportedSearchBase`), the interceptor
continues with the backend search, using the client's original scope. Other
search bases (`ou=system`, schema, root DSE, ...) still fail as before.
**2. The in-memory bind user was first authenticated against the backend**
`bind()` tried the backend first for every DN outside `ou=system`. That
included the in-memory bind user configured with `gateway.ldap.bind.user` /
`gateway_ldap_bind_password`, which usually sits under `ou=people,<baseDn>`.
Every such bind did a failed remote bind and logged a WARN before the in-memory
authenticator accepted it. It also sent the gateway bind credential to the
backend directory.
Now `KnoxLDAPServerManager` passes the bind DN to every
`UserSearchInterceptor` when a bind is required. A bind with that DN skips the
backend and is authenticated locally. Binds of all other users are unchanged.
Two DEBUG messages were added: one for a bind handled locally, one for a
search answered by the backend because the base doesn't exist locally.
Notes:
- With the fallback, a base-object search for a DN that exists in neither
the partition nor the backend returns success with 0 entries instead of
`noSuchObject`. This matches how `lookup()` already behaves.
- `FileBackend.search` still ignores the scope and matches on the filter
only. `LdapProxyBackend` passes the scope to the remote directory.
Related: KNOX-3540 (KnoxIDF `LdapUserParamsProvider`). With this change,
KnoxIDF can also read users from the embedded server with a plain
`userDnTemplate` (a base-object read), without setting `userSearchBase`.
## How was this patch tested?
New unit tests in `UserSearchInterceptorTest`:
- binding as the configured bind user skips the backend (the DN match
ignores case)
- other users still authenticate against the backend when a bind user is set
- a search whose base isn't found locally is answered by the backend
- a not-found base outside the backend's namespace still throws
`LdapNoSuchObjectException`
New tests in `KnoxLDAPServerManagerTest` that start a real embedded server:
- the bind DN is passed to the backend interceptor, and a network bind as
that user succeeds
- no bind DN is passed when no bind is required
- a network base-object search on `uid=alice,ou=people,dc=test,dc=com`
returns the user from the backend
The new tests fail without the fix (5 of 7) and pass with it.
`mvn -pl gateway-server -am verify` over the `services.ldap` tests: 337
tests pass; checkstyle, PMD, SpotBugs and forbiddenapis are clean.
Issue Time Tracking
-------------------
Worklog Id: (was: 1052233)
Remaining Estimate: 0h
Time Spent: 10m
> Embedded LDAP server: base-object search on proxied user DNs fails, and the
> in-memory bind user is first authenticated against the backend
> ------------------------------------------------------------------------------------------------------------------------------------------
>
> Key: KNOX-3541
> URL: https://issues.apache.org/jira/browse/KNOX-3541
> Project: Apache Knox
> Issue Type: Bug
> Components: LDAP
> Affects Versions: 3.0.0
> Reporter: Sandor Molnar
> Assignee: Sandor Molnar
> Priority: Major
> Fix For: 3.1.0
>
> Time Spent: 10m
> Remaining Estimate: 0h
>
> Two issues in {{UserSearchInterceptor}} of Knox's embedded LDAP server (proxy
> backend):
> h3. 1. Base-object search on a proxied entry fails
> {{search()}} calls {{next(ctx)}} on the local partition first. A _base-object
> search_ on a user DN that only exists in the proxied backend, e.g.
> {code:java}
> ldapsearch -H ldap://localhost:10389 -D
> uid=proxy-user,ou=people,dc=proxy,dc=com -w ... -s base -b
> uid=alice,ou=people,dc=proxy,dc=com
> {code}
> fails with result 80, {{{}LdapNoSuchObjectException: ERR_648 Invalid search
> base{}}}. The backend is never consulted. A _subtree search_ under
> {{ou=people,dc=proxy,dc=com}} for the same user succeeds. Clients that read a
> user entry directly by DN (a common LDAP pattern) cannot use the embedded
> server.
> *Expected:* when the local partition reports no-such-object for a search base
> the backend supports ({{{}LdapProxyBackend.isSupportedSearchBase{}}}),
> continue with the backend search.
> h3. 2. The in-memory bind user is first tried against the backend
> {{bind()}} always tries the backend first, even for the configured in-memory
> bind user ({{{}gateway.ldap.bind.user{}}} /
> {{{}gateway_ldap_bind_password{}}}). Every such bind does a failed remote
> bind and logs a WARN (sometimes also a {{{}WriteToClosedSessionException{}}})
> before the in-memory authenticator succeeds. This adds latency and log noise,
> and it sends the gateway bind credential to the backend directory.
> *Expected:* when the bind DN equals the configured in-memory bind user,
> authenticate it locally and skip the backend.
> Related: KNOX-3533 (pass requested attributes to the backend search). With
> item 1 fixed, the KnoxIDF LDAP user-parameter provider would also work
> against the embedded server with a plain {{{}userDnTemplate{}}}, without
> {{userSearchBase}} (see KNOX-3540).
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
