KNOX-3318: document LDAP service#1227
Open
smolnar82 wants to merge 1 commit into
Open
Conversation
Test Results21 tests 21 ✅ 1s ⏱️ Results for commit c99066a. |
Contributor
Author
|
Cc. @handavid |
handavid
reviewed
May 18, 2026
| Key features include: | ||
| - **Pluggable Backends**: Support for different data sources (JSON files, remote LDAP/AD). | ||
| - **Embedded Server**: No need for an external LDAP server for simple use cases or testing. | ||
| - **Active Directory Integration**: Optimized for proxying to AD with support for `sAMAccountName` and `memberOf`. |
Contributor
There was a problem hiding this comment.
memberOf handling isn't specific to AD.
| - **Pluggable Backends**: Support for different data sources (JSON files, remote LDAP/AD). | ||
| - **Embedded Server**: No need for an external LDAP server for simple use cases or testing. | ||
| - **Active Directory Integration**: Optimized for proxying to AD with support for `sAMAccountName` and `memberOf`. | ||
| - **Dynamic Schema**: Automatically handles common LDAP/AD attributes even if they aren't part of the base ApacheDS schema. |
Contributor
There was a problem hiding this comment.
we don't have any special handling yet for attributes that aren't part of the base schema other than sAMAccountName and memberOf
| 1. **KnoxLDAPServerManager**: Manages the lifecycle of the ApacheDS instance. | ||
| 2. **GroupLookupInterceptor**: A custom ApacheDS interceptor that captures search requests. If an entry is not found in the local ApacheDS partitions, it delegates the lookup to the configured backend. | ||
| 3. **LdapBackend**: A pluggable interface for fetching user and group data. | ||
| 4. **SchemaManagerFactory**: Programmatically extends the ApacheDS schema to include AD-specific attributes like `memberOf` and `sAMAccountName`. |
Contributor
There was a problem hiding this comment.
memberOf isn't specific to AD.
| When a client performs an LDAP search: | ||
| 1. The request hits the embedded ApacheDS server. | ||
| 2. The `GroupLookupInterceptor` intercepts the search. | ||
| 3. The interceptor attempts to find the user/group locally. |
Contributor
There was a problem hiding this comment.
nit: wording is a bit confusing. The interceptor checks the results of the local search. The interceptor itself is not attempting to find the user/group locally.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
KNOX-3318 - Add Knox LDAP Server documentation to User Guide
What changes were proposed in this pull request?
This pull request adds comprehensive documentation for the Knox LDAP Server feature (introduced in KNOX-3247 and improved in KNOX-3277) to the official Knox User Guide.
Changes include:
How was this patch tested?
gateway.ldap.backend.proxy.*) with the implementation inGatewayConfigImpl.javaandLdapProxyBackend.javato ensure accuracy.Integration Tests
N/A - This is a documentation-only change. No functional code was modified.
UI changes
N/A