[
https://issues.apache.org/jira/browse/KNOX-3541?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18138377#comment-18138377
]
ASF subversion and git services commented on KNOX-3541:
-------------------------------------------------------
Commit 3c7756c174176a26a1a782b121f71c815d7ee05b in knox's branch
refs/heads/master from Sandor Molnar
[ https://gitbox.apache.org/repos/asf?p=knox.git;h=3c7756c17 ]
KNOX-3541: Embedded LDAP: answer base-object searches on proxied DNs from the
backend, bind the in-memory bind user locally (#1482)
> Embedded LDAP server: base-object search on proxied user DNs fails, and the
> in-memory bind user is first authenticated against the backend
> ------------------------------------------------------------------------------------------------------------------------------------------
>
> Key: KNOX-3541
> URL: https://issues.apache.org/jira/browse/KNOX-3541
> Project: Apache Knox
> Issue Type: Bug
> Components: LDAP
> Affects Versions: 3.0.0
> Reporter: Sandor Molnar
> Assignee: Sandor Molnar
> Priority: Major
> Fix For: 3.1.0
>
> Time Spent: 40m
> Remaining Estimate: 0h
>
> Two issues in {{UserSearchInterceptor}} of Knox's embedded LDAP server (proxy
> backend):
> h3. 1. Base-object search on a proxied entry fails
> {{search()}} calls {{next(ctx)}} on the local partition first. A _base-object
> search_ on a user DN that only exists in the proxied backend, e.g.
> {code:java}
> ldapsearch -H ldap://localhost:10389 -D
> uid=proxy-user,ou=people,dc=proxy,dc=com -w ... -s base -b
> uid=alice,ou=people,dc=proxy,dc=com
> {code}
> fails with result 80, {{{}LdapNoSuchObjectException: ERR_648 Invalid search
> base{}}}. The backend is never consulted. A _subtree search_ under
> {{ou=people,dc=proxy,dc=com}} for the same user succeeds. Clients that read a
> user entry directly by DN (a common LDAP pattern) cannot use the embedded
> server.
> *Expected:* when the local partition reports no-such-object for a search base
> the backend supports ({{{}LdapProxyBackend.isSupportedSearchBase{}}}),
> continue with the backend search.
> h3. 2. The in-memory bind user is first tried against the backend
> {{bind()}} always tries the backend first, even for the configured in-memory
> bind user ({{{}gateway.ldap.bind.user{}}} /
> {{{}gateway_ldap_bind_password{}}}). Every such bind does a failed remote
> bind and logs a WARN (sometimes also a {{{}WriteToClosedSessionException{}}})
> before the in-memory authenticator succeeds. This adds latency and log noise,
> and it sends the gateway bind credential to the backend directory.
> *Expected:* when the bind DN equals the configured in-memory bind user,
> authenticate it locally and skip the backend.
> Related: KNOX-3533 (pass requested attributes to the backend search). With
> item 1 fixed, the KnoxIDF LDAP user-parameter provider would also work
> against the embedded server with a plain {{{}userDnTemplate{}}}, without
> {{userSearchBase}} (see KNOX-3540).
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
