[
https://issues.apache.org/jira/browse/KNOX-3554?focusedWorklogId=1052977&page=com.atlassian.jira.plugin.system.issuetabpanels:worklog-tabpanel#worklog-1052977
]
ASF GitHub Bot logged work on KNOX-3554:
----------------------------------------
Author: ASF GitHub Bot
Created on: 06/Nov/26 11:11
Start Date: 06/Nov/26 11:11
Worklog Time Spent: 10m
Work Description: github-actions[bot] commented on PR #1494:
URL: https://github.com/apache/knox/pull/1494#issuecomment-6683480461
## Test Results
5 files 5 suites 1m 33s ⏱️
198 tests 196 ✅ 2 💤 0 ❌
239 runs 237 ✅ 2 💤 0 ❌
Results for commit 939e0f8e.
[test-results]:data:application/gzip;base64,H4sIAOi17WoC/03Myw6DIBCF4VcxrLtAqeD0ZRocZhJSLw3CyvTdi0bR5f+d5KyC/UCLeFXtoxJL8rGES8FGP085QeXOS9y2Grqz3ktC3Elf9PHfTE0Btn7IIAtQCHM4JKRp+2wUHHFeNsoUuR73vh3uff/DeRx9zCFAAUnuCOHJFpU0yNq52qDVhtmS7nvVWiLx+wN0QR/UBAEAAA==
Issue Time Tracking
-------------------
Worklog Id: (was: 1052977)
Time Spent: 20m (was: 10m)
> HadoopGroupProvider: skip the group lookup for principals known not to exist
> in LDAP
> ------------------------------------------------------------------------------------
>
> Key: KNOX-3554
> URL: https://issues.apache.org/jira/browse/KNOX-3554
> Project: Apache Knox
> Issue Type: Improvement
> Components: HadoopGroupProvider
> Affects Versions: 3.0.0
> Reporter: Sandor Molnar
> Assignee: Sandor Molnar
> Priority: Major
> Fix For: 3.1.0
>
> Time Spent: 20m
> Remaining Estimate: 0h
>
> Some authenticated principals are known in advance not to exist in LDAP (e.g.
> Kubernetes service accounts or other workload identities arriving as JWTs).
> {{HadoopGroupProvider}} still runs a group lookup for them. With
> {{use.ldap.service=true}} that means an embedded KnoxLDAP search plus a round
> trip to the backend LDAP, which always returns nothing.
> Add a new optional {{HadoopGroupProvider}} parameter,
> {{group.lookup.skip.principal.pattern}} (a regex, full match against the
> mapped principal name). Principals matching it get no groups and no LDAP
> call, on both the Knox LDAP service and the Hadoop {{LdapGroupsMapping}}
> paths. Like any other provider parameter, it can be set centrally in
> gateway-site via {{CENTRAL_GROUP_CONFIG_PREFIX}}, e.g.
> {{gateway.group.config.group.lookup.skip.principal.pattern}}.
> {{ROLES_LOOKUP_EXECUTED}} is not set for skipped principals, so downstream
> consumers (e.g. {{KNOX-AUTH-SERVICE}}) still do their own roles lookup.
> Example:
> {code:xml}
> <param>
> <name>group.lookup.skip.principal.pattern</name>
> <value>system:serviceaccount:.*</value>
> </param>
> {code}
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
