[
https://issues.apache.org/jira/browse/KNOX-3553?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18139546#comment-18139546
]
ASF subversion and git services commented on KNOX-3553:
-------------------------------------------------------
Commit ad2d4b4fc7e23960b93d4f29e6f294b47153718f in knox's branch
refs/heads/master from Sandor Molnar
[ https://gitbox.apache.org/repos/asf?p=knox.git;h=ad2d4b4fc ]
KNOX-3553: Set ROLES_LOOKUP_EXECUTED only when the LDAP roles lookup
interceptor processed the user entry (#1493)
> HadoopGroupProvider marks the roles lookup as executed even when the embedded
> LDAP search finds no user entry
> -------------------------------------------------------------------------------------------------------------
>
> Key: KNOX-3553
> URL: https://issues.apache.org/jira/browse/KNOX-3553
> Project: Apache Knox
> Issue Type: Bug
> Components: Authorization, LDAP, Server
> Affects Versions: 3.0.0
> Reporter: Sandor Molnar
> Assignee: Sandor Molnar
> Priority: Blocker
> Fix For: 3.1.0
>
> Time Spent: 0.5h
> Remaining Estimate: 0h
>
> When {{HadoopGroupProvider}} uses the embedded LDAP service
> ({{use.ldap.service=true}}) and the {{LDAPRolesLookupInterceptor}} is
> configured, {{HadoopGroupProviderFilter#hadoopGroups}} always sets the
> {{ROLES_LOOKUP_EXECUTED}} request attribute:
> {code:java}
> if (request != null && ldapService.hasRolesLookupInterceptor()) {
> request.setAttribute(ROLES_LOOKUP_EXECUTED, Boolean.TRUE.toString());
> }
> {code}
> The interceptor only does a roles lookup for each user entry the search
> returns. A principal that isn't in LDAP (e.g. a Kubernetes service account
> authenticated by {{JWTProvider}}) gets 0 entries back, so no lookup runs. The
> flag still says it did, so {{AbstractAuthResource#lookupRoles}} skips its own
> lookup. The roles configured for that principal are then missing from
> {{X-Knox-Actor-Groups}}.
> *Steps to reproduce:*
> # Set up a topology with {{JWTProvider}} (federation),
> {{HadoopGroupProvider}} ({{LdapGroupsMapping}}, {{use.ldap.service=true}})
> and {{KNOX-AUTH-SERVICE}}, with the roles lookup interceptor enabled on the
> embedded LDAP.
> # Assign a role to a k8s service account in the roles service.
> # Call {{/auth/api/v1/pre}} with that service account's JWT.
> *Actual:* The LDAP log shows "Found 0 entries" and {{X-Knox-Actor-Groups}}
> has no role.
> *Expected:* {{X-Knox-Actor-Groups}} contains the configured role.
> *Proposed fix:* Set {{ROLES_LOOKUP_EXECUTED}} only when the user's entry was
> actually found and processed by the interceptor. Otherwise the auth service
> falls back to its own roles lookup.
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
