[ https://issues.apache.org/jira/browse/KYLIN-3197?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=16360264#comment-16360264 ]
Peng Xing edited comment on KYLIN-3197 at 2/12/18 7:39 AM: ----------------------------------------------------------- Hi [~Aron.tao], Thanks for you reply, I found that when judge whether username and password are valid, ldap is not case insensitive. but when userDn is "uid={color:red}wkh{color},ou=People,ou=defaultCluster,dc=zdh,dc=com" and username is "{color:red}WKH{color}", then the follow function will return empty Set. {code:java} Set<GrantedAuthority> authorities = super.getGroupMembershipRoles(userDn, username); {code} My kylin ldap config is as follows. {code:java} ## Spring security profile, options: testing, ldap, saml ## with "testing" profile, user can use pre-defined name/pwd like KYLIN/ADMIN to login kylin.security.profile=ldap # ## Admin roles in LDAP, for ldap and saml kylin.security.acl.admin-role=wkhGroup # ## LDAP authentication configuration kylin.security.ldap.connection-server=ldap://******:389 kylin.security.ldap.connection-username=cn=******,dc=zzz,dc=com kylin.security.ldap.connection-password=****** # ## LDAP user account directory; kylin.security.ldap.user-search-base=ou=People,ou=defaultCluster,dc=zdh,dc=com kylin.security.ldap.user-search-pattern=(uid={0}) kylin.security.ldap.user-group-search-base=ou=Group,ou=defaultCluster,dc=zdh,dc=com kylin.security.ldap.user-group-search-filter=(|(member={0})(memberUid={1})) {code} was (Author: xingpeng1): Hi [~Aron.tao], Thanks for you reply, I found that when judge whether username and password are valid, ldap is not case insensitive. but when userDn is "uid={color:red}wkh{color},ou=People,ou=defaultCluster,dc=zdh,dc=com" and username is "{color:red}WKH{color}", then the follow function will return empty Set. {code:java} Set<GrantedAuthority> authorities = super.getGroupMembershipRoles(userDn, username); {code} My kylin ldap config is as follows. {code:java} ## Spring security profile, options: testing, ldap, saml ## with "testing" profile, user can use pre-defined name/pwd like KYLIN/ADMIN to login kylin.security.profile=ldap # ## Admin roles in LDAP, for ldap and saml kylin.security.acl.admin-role=wkhGroup # ## LDAP authentication configuration kylin.security.ldap.connection-server=ldap://******:389 kylin.security.ldap.connection-username=cn=******,dc=zzz,dc=com kylin.security.ldap.connection-password=****** # ## LDAP user account directory; kylin.security.ldap.user-search-base=ou=People,ou=defaultCluster,dc=zzz,dc=com kylin.security.ldap.user-search-pattern=(uid={0}) kylin.security.ldap.user-group-search-base=ou=Group,ou=defaultCluster,dc=zzz,dc=com kylin.security.ldap.user-group-search-filter=(|(member={0})(memberUid={1})) {code} > When ldap is opened, I use an ignored case user to login, the page does not > respond. > ------------------------------------------------------------------------------------ > > Key: KYLIN-3197 > URL: https://issues.apache.org/jira/browse/KYLIN-3197 > Project: Kylin > Issue Type: Bug > Components: Security > Affects Versions: v2.3.0 > Reporter: Peng Xing > Assignee: Peng Xing > Priority: Major > Labels: patch > Fix For: Future > > Attachments: > 0001-KYLIN-3197-When-ldap-is-opened-I-use-an-ignored-case.patch, > image-2018-01-25-17-22-39-970.png, image-2018-02-06-14-09-32-591.png, > image-2018-02-08-15-32-25-030.png, image-2018-02-08-15-33-07-277.png, > image-2018-02-08-15-33-54-480.png, image-2018-02-08-15-35-03-902.png, > image-2018-02-12-12-15-00-574.png, image-2018-02-12-12-15-28-826.png, > image-2018-02-12-12-15-39-132.png, image-2018-02-12-12-25-15-793.png > > > When ldap is opened, I config the kylin.properties, and give wkhGroup the > admin permission. > {code:java} > ## Admin roles in LDAP, for ldap and saml > kylin.security.acl.admin-role=wkhGroup > {code} > then I create a new user named 'wkh' whose group is 'wkhGroup', then I use > '{color:#ff0000}wkh{color}' to login in, which is normal. > But when I use '{color:#ff0000}WKH{color}' to login in, the page does not > respond. > I analyze the backgroud code, and find the function of > 'org.apache.kylin.rest.security.LDAPAuthoritiesPopulator.getGroupMembershipRoles(String, > String)' has problem. > When userDn is > "uid={color:#ff0000}wkh{color},ou=People,ou=defaultCluster,dc=zdh,dc=com" and > username is "{color:#ff0000}WKH{color}", then authorities will be empty Set > by the follow code: > {code:java} > Set<GrantedAuthority> authorities = super.getGroupMembershipRoles(userDn, > username); > {code} > So I have added 'getAdditionalRoles' function to get the authorities again. > I have test the patch, please review, thanks! -- This message was sent by Atlassian JIRA (v7.6.3#76005)