[
https://issues.apache.org/jira/browse/KNOX-3546?focusedWorklogId=1054051&page=com.atlassian.jira.plugin.system.issuetabpanels:worklog-tabpanel#worklog-1054051
]
ASF GitHub Bot logged work on KNOX-3546:
----------------------------------------
Author: ASF GitHub Bot
Created on: 11/Nov/26 12:41
Start Date: 11/Nov/26 12:41
Worklog Time Spent: 10m
Work Description: github-actions[bot] commented on PR #1503:
URL: https://github.com/apache/knox/pull/1503#issuecomment-6796095959
## Test Results
5 files 5 suites 1m 25s ⏱️
212 tests 211 ✅ 1 💤 0 ❌
253 runs 252 ✅ 1 💤 0 ❌
Results for commit 8126bc1c.
[test-results]:data:application/gzip;base64,H4sIAHpi9GoC/02MSw6DIBQAr2JYd9FHBbSXaeTzkpeqNAgr07sXiQWXM5PMzpBmt7FnJ24d2xLFCjaFKZJfMw4H5xKPxoH/6bUlY4qCpt70yaoJnGjO4l6FC8GH04S0lqd4nFCXglfTjoUvw8LXn/HLQjEDG4BLbcBodM4KUFIAcsBRWdmPQvWYG2iD7PsDy/W2TQQBAAA=
Issue Time Tracking
-------------------
Worklog Id: (was: 1054051)
Time Spent: 40m (was: 0.5h)
> LDAP proxy roles lookup: role listing from an ancestor of ou=groups is never
> detected because ApacheDS adds (objectClass=referral) to the search filter
> --------------------------------------------------------------------------------------------------------------------------------------------------------
>
> Key: KNOX-3546
> URL: https://issues.apache.org/jira/browse/KNOX-3546
> Project: Apache Knox
> Issue Type: Bug
> Components: LDAP
> Affects Versions: 3.0.0
> Reporter: Sandor Molnar
> Assignee: David Han
> Priority: Major
> Fix For: 3.1.0
>
> Time Spent: 40m
> Remaining Estimate: 0h
>
> A group search from an ancestor of {{ou=groups,<proxy base dn>}} (for example
> the proxy root {{{}dc=proxy,dc=com{}}}) with a group objectClass filter
> should be answered with the roles from the role lookup service
> ({{{}listRoles(){}}}). It isn't. The backend groups are translated to roles
> instead, so roles that are assigned only to users are missing from the result.
> *Reproduce* (using the E2E {{{}roles.json{}}}, where {{platform:deployer}} is
> assigned only to the user {{{}recursiveuser{}}}):
> {code:java}
> ldapsearch -x -H ldap://localhost:3890 -b 'dc=proxy,dc=com'
> '(objectClass=groupOfNames)' cn
> {code}
> Expected: every role, including {{{}platform:deployer{}}}. Actual: only the
> roles mapped from backend groups.
> *Root cause:* ApacheDS {{SearchRequestHandler.modifyFilter}} rewrites the
> client's filter to {{{}(|<filter>(objectClass=referral)){}}}, so that
> referral entries are returned too. It skips the rewrite only when the filter
> is {{(objectClass=*)}} or the request carries the ManageDsaIT control
> ({{{}2.16.840.1.113730.3.4.2{}}}). The interceptors therefore get
> {{{}(|(objectClass=groupOfNames)(objectClass=referral)){}}}.
> For a search from an ancestor of {{{}ou=groups{}}},
> {{LDAPRolesLookupInterceptor.isAllGroupsFilterForAncestor}} requires every OR
> branch to be a group objectClass filter. {{objectClass=referral}} isn't one,
> so the search is never detected as a role listing, and {{handleSearch}}
> translates the backend groups instead.
> Searches based at {{ou=groups}} aren't affected. There the OR rule only needs
> one matching branch.
> The bug has been there since KNOX-3487. The unit tests didn't catch it
> because they hand the interceptor the unwrapped filter. The E2E test didn't
> catch it because every role in {{roles.json}} was assigned to a group, so
> translating the groups gave the same set of roles.
> *Workaround:* search from {{{}ou=groups,<proxy base dn>{}}}, or send the
> ManageDsaIT control.
> *Proposed fix:*
> * In {{{}isAllGroupsSearch{}}}, remove the {{(objectClass=referral)}} branch
> that ApacheDS added before checking the filter.
> * Add unit tests that use the rewritten filter: group filters from the root
> are detected as listings, and non-group filters still aren't.
> * Remove the {{@unittest.skip}} from
> {{test_list_all_roles_from_proxy_root_with_group_filter}} in
> {{.github/workflows/tests/test_knox_ldap_proxy_search_with_role_lookup.py}}
> (skipped in KNOX-3539).
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
