Sandor Molnar created KNOX-3554:
-----------------------------------
Summary: HadoopGroupProvider: skip the group lookup for principals
known not to exist in LDAP
Key: KNOX-3554
URL: https://issues.apache.org/jira/browse/KNOX-3554
Project: Apache Knox
Issue Type: Improvement
Components: HadoopGroupProvider
Affects Versions: 3.0.0
Reporter: Sandor Molnar
Assignee: Sandor Molnar
Fix For: 3.1.0
Some authenticated principals are known in advance not to exist in LDAP (e.g.
Kubernetes service accounts or other workload identities arriving as JWTs).
{{HadoopGroupProvider}} still runs a group lookup for them. With
{{use.ldap.service=true}} that means an embedded KnoxLDAP search plus a round
trip to the backend LDAP, which always returns nothing.
Add a new optional {{HadoopGroupProvider}} parameter,
{{group.lookup.skip.principal.pattern}} (a regex, full match against the mapped
principal name). Principals matching it get no groups and no LDAP call, on both
the Knox LDAP service and the Hadoop {{LdapGroupsMapping}} paths. Like any
other provider parameter, it can be set centrally in gateway-site via
{{CENTRAL_GROUP_CONFIG_PREFIX}}, e.g.
{{gateway.group.config.group.lookup.skip.principal.pattern}}.
{{ROLES_LOOKUP_EXECUTED}} is not set for skipped principals, so downstream
consumers (e.g. {{KNOX-AUTH-SERVICE}}) still do their own roles lookup.
Example:
{code:xml}
<param>
<name>group.lookup.skip.principal.pattern</name>
<value>system:serviceaccount:.*</value>
</param>
{code}
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
