Skip to content

KNOX-3485: Roles lookup replaces group entries with role entries #1428

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
handavid wants to merge 1 commit into
base: master
Choose a base branch
from
Open

KNOX-3485: Roles lookup replaces group entries with role entries #1428

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
38 changes: 38 additions & 0 deletions .github/workflows/compose/docker-compose.role-lookup.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,38 @@
# Licensed to the Apache Software Foundation (ASF) under one or more
# contributor license agreements. See the NOTICE file distributed with this
# work for additional information regarding copyright ownership. The ASF
# licenses this file to you under the Apache License, Version 2.0 (the
# "License"); you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
# <p>
# http://www.apache.org/licenses/LICENSE-2.0
# <p>
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

# Opt-in override that reconfigures the base compose stack to use role-lookup
# and runs ONLY the role-lookup E2E tests. It is intentionally not part
# of the default test run (which ignores test*_with_role_lookup.py).
#
# Usage:
# cd .github/workflows/compose
# IMAGE_TAG=knoxidf docker compose \
# -f docker-compose.yml -f docker-compose.role-lookup.yml \
# up --build --abort-on-container-exit --exit-code-from tests
services:
knox:
volumes:
- ./role-lookup/gateway-site.xml:/knox-runtime/conf/gateway-site.xml:ro
- ./role-lookup/roles.json:/knox-runtime/data/roles.json:ro

tests:
command: >
bash -c "pip install -r requirements.txt
&& pylint test*_with_role_lookup.py
&& echo 'Waiting for knox...'
&& sleep 30
&& pytest test*_with_role_lookup.py --junitxml=test-results.role-lookup.xml"

2 changes: 1 addition & 1 deletion .github/workflows/compose/docker-compose.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -156,7 +156,7 @@ services:
&& pylint *.py
&& echo 'Waiting for knox...'
&& sleep 30
&& pytest --ignore=test_single_eku_mtls.py --ignore=test_single_eku_no_mtls.py --ignore=test_knoxidf_federation.py --ignore=test_knox_hashicorp_vault_alias.py --junitxml=test-results.xml"
&& pytest --ignore=test_single_eku_mtls.py --ignore=test_single_eku_no_mtls.py --ignore=test_knoxidf_federation.py --ignore=test_knox_hashicorp_vault_alias.py --ignore-glob=test*_with_role_lookup.py --junitxml=test-results.xml"
depends_on:
- knox

Expand Down
248 changes: 248 additions & 0 deletions .github/workflows/compose/role-lookup/gateway-site.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,248 @@
<?xml version="1.0" encoding="UTF-8"?>
<!--
Licensed to the Apache Software Foundation (ASF) under one
or more contributor license agreements. See the NOTICE file
distributed with this work for additional information
regarding copyright ownership. The ASF licenses this file
to you under the Apache License, Version 2.0 (the
"License"); you may not use this file except in compliance
with the License. You may obtain a copy of the License at

http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
-->
<configuration>

<property>
<name>gateway.service.alias.impl</name>
<value>org.apache.knox.gateway.services.security.impl.DefaultAliasService</value>
</property>
<property>
<name>gateway.port</name>
<value>8443</value>
<description>The HTTP port for the Gateway.</description>
</property>

<property>
<name>gateway.path</name>
<value>gateway</value>
<description>The default context path for the gateway.</description>
</property>

<property>
<name>gateway.gateway.conf.dir</name>
<value>deployments</value>
<description>The directory within GATEWAY_HOME that contains gateway topology files and deployments.</description>
</property>

<!-- @since 0.10 Websocket configs -->
<property>
<name>gateway.websocket.feature.enabled</name>
<value>true</value>
<description>Enable/Disable websocket feature.</description>
</property>

<property>
<name>gateway.scope.cookies.feature.enabled</name>
<value>false</value>
<description>Enable/Disable cookie scoping feature.</description>
</property>

<!-- @since 2.0.0 WebShell configs -->
<!-- must have websocket enabled to use webshell -->
<property>
<name>gateway.webshell.feature.enabled</name>
<value>true</value>
<description>Enable/Disable webshell feature.</description>
</property>
<property>
<name>gateway.webshell.max.concurrent.sessions</name>
<value>20</value>
<description>Maximum number of total concurrent webshell sessions</description>
</property>
<property>
<name>gateway.webshell.read.buffer.size</name>
<value>1024</value>
<description>Web Shell buffer size for reading</description>
</property>

<!-- @since 2.0.0 websocket JWT validation configs -->
<property>
<name>gateway.websocket.JWT.validation.feature.enabled</name>
<value>true</value>
<description>Enable/Disable websocket JWT validation at websocket layer.</description>
</property>

<!-- @since 1.5.0 homepage logout -->
<property>
<name>knox.homepage.logout.enabled</name>
<value>true</value>
<description>Enable/disable logout from the Knox Homepage.</description>
</property>

<!-- @since 1.6.0 token management related properties -->
<property>
<name>gateway.knox.token.eviction.grace.period</name>
<value>0</value>
<description>A duration (in seconds) beyond a token’s expiration to wait before evicting its state. This configuration only applies when server-managed token state is enabled either in gateway-site or at the topology level.</description>
</property>

<!-- Knox Admin related config -->
<property>
<name>gateway.knox.admin.groups</name>
<value>admin</value>
</property>

<!-- DEMO LDAP config for Hadoop Group Provider -->
<property>
<name>gateway.group.config.hadoop.security.group.mapping</name>
<value>org.apache.hadoop.security.LdapGroupsMapping</value>
</property>
<property>
<name>gateway.group.config.use.ldap.service</name>
<value>true</value>
</property>
<property>
<name>gateway.dispatch.whitelist.services</name>
<value>DATANODE,HBASEUI,HDFSUI,JOBHISTORYUI,NODEUI,YARNUI,knoxauth</value>
<description>The comma-delimited list of service roles for which the gateway.dispatch.whitelist should be applied.</description>
</property>
<property>
<name>gateway.dispatch.whitelist</name>
<value>^https?:\/\/(www\.local\.com|localhost|127\.0\.0\.1|0:0:0:0:0:0:0:1|::1):[0-9].*$</value>
<description>The whitelist to be applied for dispatches associated with the service roles specified by gateway.dispatch.whitelist.services.
If the value is DEFAULT, a domain-based whitelist will be derived from the Knox host.</description>
</property>
<property>
<name>gateway.xforwarded.header.context.append.servicename</name>
<value>LIVYSERVER</value>
<description>Add service name to x-forward-context header for the list of services defined above.</description>
</property>
<property>
<name>gateway.strict.transport.enabled</name>
<value>true</value>
</property>
<property>
<name>gateway.strict.transport.option</name>
<value>max-age=300; includeSubDomains</value>
</property>

<!-- KnoxLDAP Service Configuration -->
<property>
<name>gateway.ldap.enabled</name>
<value>true</value>
</property>
<property>
<name>gateway.ldap.port</name>
<value>33390</value>
</property>
<property>
<name>gateway.ldap.base.dn</name>
<value>dc=proxy,dc=org</value>
</property>
<property>
<name>gateway.ldap.bind.user</name>
<value>uid=bind,ou=people,dc=proxy,dc=org</value>
</property>
<property>
<name>gateway.ldap.max.size.limit</name>
<value>1000</value>
</property>
<property>
<name>gateway.ldap.max.time.limit</name>
<value>60000</value>
</property>
<property>
<name>gateway.ldap.recursive.group.resolution</name>
<value>true</value>
</property>
<property>
<name>gateway.ldap.interceptor.names</name>
<value>demoldap,roleslookup</value>
</property>
<!-- Expose the embedded Knox LDAP service over LDAPS using the dev keystore that
gateway.sh provisions; its password is resolved from the credential store. -->
<property>
<name>gateway.ldap.ssl.enabled</name>
<value>true</value>
</property>
<property>
<name>gateway.ldap.ssl.keystore.path</name>
<value>/knox-runtime/conf/ldaps-keystore.p12</value>
</property>
<property>
<name>gateway.ldap.ssl.keystore.password.alias</name>
<value>gateway_ldap_ssl_keystore_password</value>
</property>

<!-- LDAP Backend specific configuration (proxying to demo ldap) -->
<property>
<name>gateway.ldap.interceptor.demoldap.interceptorType</name>
<value>backend</value>
</property>
<property>
<name>gateway.ldap.interceptor.demoldap.backendType</name>
<value>ldap</value>
</property>
<property>
<name>gateway.ldap.interceptor.demoldap.url</name>
<value>ldaps://ldap:33389</value>
</property>
<!-- The demo LDAP presents a self-signed dev certificate; trust it rather than
wiring a truststore for this dev/CI fixture. -->
<property>
<name>gateway.ldap.interceptor.demoldap.trustAllCertificates</name>
<value>true</value>
</property>
<property>
<name>gateway.ldap.interceptor.demoldap.remoteBaseDn</name>
<value>dc=hadoop,dc=apache,dc=org</value>
</property>
<property>
<name>gateway.ldap.interceptor.demoldap.systemUsername</name>
<value>uid=guest,ou=people,dc=hadoop,dc=apache,dc=org</value>
</property>
<property>
<name>gateway.ldap.interceptor.demoldap.systemPassword</name>
<value>guest-password</value>
</property>
<property>
<name>gateway.ldap.interceptor.demoldap.userSearchBase</name>
<value>ou=people,dc=hadoop,dc=apache,dc=org</value>
</property>
<property>
<name>gateway.ldap.interceptor.demoldap.groupSearchBase</name>
<value>ou=groups,dc=hadoop,dc=apache,dc=org</value>
</property>
<property>
<name>gateway.ldap.interceptor.demoldap.groupMemberAttribute</name>
<value>member</value>
</property>
<!-- Set an unnaturally low page size to ensure that paging is used in tests -->
<property>
<name>gateway.ldap.interceptor.demoldap.pageSize</name>
<value>3</value>
</property>

<!-- Roles Lookup Interceptor configuration -->
<property>
<name>gateway.ldap.interceptor.roleslookup.interceptorType</name>
<value>rolesLookup</value>
</property>

<!-- Roles Lookup Configuration -->
<property>
<name>gateway.ldap.roles.lookup.strategy</name>
<value>file</value>
</property>
<property>
<name>gateway.ldap.roles.lookup.file.path</name>
<value>/knox-runtime/data/roles.json</value>
</property>

</configuration>
72 changes: 72 additions & 0 deletions .github/workflows/compose/role-lookup/roles.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,72 @@
[
{
"id": "admin",
"type": "user",
"roles": [
{
"scope": "platform",
"name": "admin"
}
]
},
{
"id": "admin",
"type": "group",
"roles": [
{
"scope": "platform",
"name": "admin"
}
]
},
{
"id": "analyst",
"type": "group",
"roles": [
{
"scope": "platform",
"name": "analyst"
}
]
},
{
"id": "scientist",
"type": "group",
"roles": [
{
"scope": "platform",
"name": "scientist"
}
]
},
{
"id": "level1",
"type": "group",
"roles": [
{
"scope": "platform",
"name": "level1"
}
]
},
{
"id": "level2",
"type": "group",
"roles": [
{
"scope": "platform",
"name": "level2"
}
]
},
{
"id": "level3",
"type": "group",
"roles": [
{
"scope": "platform",
"name": "level3"
}
]
}
]
3 changes: 3 additions & 0 deletions .github/workflows/tests/test_knox_auth_service_and_ldap.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -54,6 +54,7 @@ def test_auth_service_guest(self):
# Check for Actor Group header - should be empty for guest
prefix = 'x-knox-actor-groups'
all_groups = collect_actor_group_values(response, prefix=prefix)
print(f"Found groups: {all_groups}")
self.assertEqual(
len(all_groups),
0,
Expand Down Expand Up @@ -83,6 +84,7 @@ def test_auth_service_admin_groups(self):
# We mapped admin to 'longGroupName1,longGroupName2,longGroupName3,longGroupName4'
prefix = 'x-knox-actor-groups'
all_groups = collect_actor_group_values(response, prefix=prefix)
print(f"Found groups: {all_groups}")
self.assertTrue(len(all_groups) > 0, f"No headers found starting with {prefix}")
for header_name in response.headers:
if header_name.lower().startswith(prefix.lower()):
Expand Down Expand Up @@ -120,6 +122,7 @@ def test_auth_service_recursive_user_groups(self):
# Check for Actor Group headers
prefix = 'x-knox-actor-groups'
all_groups = collect_actor_group_values(response, prefix=prefix)
print(f"Found groups: {all_groups}")

expected_groups = ['level1', 'level2', 'level3']
self.assertEqual(len(all_groups), len(expected_groups))
Expand Down
Loading
Loading