Sandor Molnar created KNOX-3541:
-----------------------------------
Summary: Embedded LDAP server: base-object search on proxied user
DNs fails, and the in-memory bind user is first authenticated against the
backend
Key: KNOX-3541
URL: https://issues.apache.org/jira/browse/KNOX-3541
Project: Apache Knox
Issue Type: Bug
Components: LDAP
Affects Versions: 3.0.0
Reporter: Sandor Molnar
Assignee: Sandor Molnar
Fix For: 3.1.0
Two issues in {{UserSearchInterceptor}} of Knox's embedded LDAP server (proxy
backend):
h3. 1. Base-object search on a proxied entry fails
{{search()}} calls {{next(ctx)}} on the local partition first. A _base-object
search_ on a user DN that only exists in the proxied backend, e.g.
{code:java}
ldapsearch -H ldap://localhost:10389 -D
uid=proxy-user,ou=people,dc=proxy,dc=com -w ... -s base -b
uid=alice,ou=people,dc=proxy,dc=com
{code}
fails with result 80, {{{}LdapNoSuchObjectException: ERR_648 Invalid search
base{}}}. The backend is never consulted. A _subtree search_ under
{{ou=people,dc=proxy,dc=com}} for the same user succeeds. Clients that read a
user entry directly by DN (a common LDAP pattern) cannot use the embedded
server.
*Expected:* when the local partition reports no-such-object for a search base
the backend supports ({{{}LdapProxyBackend.isSupportedSearchBase{}}}), continue
with the backend search.
h3. 2. The in-memory bind user is first tried against the backend
{{bind()}} always tries the backend first, even for the configured in-memory
bind user ({{{}gateway.ldap.bind.user{}}} /
{{{}gateway_ldap_bind_password{}}}). Every such bind does a failed remote bind
and logs a WARN (sometimes also a {{{}WriteToClosedSessionException{}}}) before
the in-memory authenticator succeeds. This adds latency and log noise, and it
sends the gateway bind credential to the backend directory.
*Expected:* when the bind DN equals the configured in-memory bind user,
authenticate it locally and skip the backend.
Related: KNOX-3533 (pass requested attributes to the backend search). With item
1 fixed, the KnoxIDF LDAP user-parameter provider would also work against the
embedded server with a plain {{{}userDnTemplate{}}}, without {{userSearchBase}}
(see KNOX-3540).
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
