[
https://issues.apache.org/jira/browse/KNOX-3546?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Work on KNOX-3546 started by David Han.
---------------------------------------
> LDAP proxy roles lookup: role listing from an ancestor of ou=groups is never
> detected because ApacheDS adds (objectClass=referral) to the search filter
> --------------------------------------------------------------------------------------------------------------------------------------------------------
>
> Key: KNOX-3546
> URL: https://issues.apache.org/jira/browse/KNOX-3546
> Project: Apache Knox
> Issue Type: Bug
> Components: LDAP
> Affects Versions: 3.0.0
> Reporter: Sandor Molnar
> Assignee: David Han
> Priority: Major
> Fix For: 3.1.0
>
>
> A group search from an ancestor of {{ou=groups,<proxy base dn>}} (for example
> the proxy root {{{}dc=proxy,dc=com{}}}) with a group objectClass filter
> should be answered with the roles from the role lookup service
> ({{{}listRoles(){}}}). It isn't. The backend groups are translated to roles
> instead, so roles that are assigned only to users are missing from the result.
> *Reproduce* (using the E2E {{{}roles.json{}}}, where {{platform:deployer}} is
> assigned only to the user {{{}recursiveuser{}}}):
> {code:java}
> ldapsearch -x -H ldap://localhost:3890 -b 'dc=proxy,dc=com'
> '(objectClass=groupOfNames)' cn
> {code}
> Expected: every role, including {{{}platform:deployer{}}}. Actual: only the
> roles mapped from backend groups.
> *Root cause:* ApacheDS {{SearchRequestHandler.modifyFilter}} rewrites the
> client's filter to {{{}(|<filter>(objectClass=referral)){}}}, so that
> referral entries are returned too. It skips the rewrite only when the filter
> is {{(objectClass=*)}} or the request carries the ManageDsaIT control
> ({{{}2.16.840.1.113730.3.4.2{}}}). The interceptors therefore get
> {{{}(|(objectClass=groupOfNames)(objectClass=referral)){}}}.
> For a search from an ancestor of {{{}ou=groups{}}},
> {{LDAPRolesLookupInterceptor.isAllGroupsFilterForAncestor}} requires every OR
> branch to be a group objectClass filter. {{objectClass=referral}} isn't one,
> so the search is never detected as a role listing, and {{handleSearch}}
> translates the backend groups instead.
> Searches based at {{ou=groups}} aren't affected. There the OR rule only needs
> one matching branch.
> The bug has been there since KNOX-3487. The unit tests didn't catch it
> because they hand the interceptor the unwrapped filter. The E2E test didn't
> catch it because every role in {{roles.json}} was assigned to a group, so
> translating the groups gave the same set of roles.
> *Workaround:* search from {{{}ou=groups,<proxy base dn>{}}}, or send the
> ManageDsaIT control.
> *Proposed fix:*
> * In {{{}isAllGroupsSearch{}}}, remove the {{(objectClass=referral)}} branch
> that ApacheDS added before checking the filter.
> * Add unit tests that use the rewritten filter: group filters from the root
> are detected as listings, and non-group filters still aren't.
> * Remove the {{@unittest.skip}} from
> {{test_list_all_roles_from_proxy_root_with_group_filter}} in
> {{.github/workflows/tests/test_knox_ldap_proxy_search_with_role_lookup.py}}
> (skipped in KNOX-3539).
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
