diff --git a/src/main/java/org/opensearch/security/auth/ldap/backend/LDAPAuthorizationBackend.java b/src/main/java/org/opensearch/security/auth/ldap/backend/LDAPAuthorizationBackend.java index 7a672d5fdb..0dbf183fa4 100755 --- a/src/main/java/org/opensearch/security/auth/ldap/backend/LDAPAuthorizationBackend.java +++ b/src/main/java/org/opensearch/security/auth/ldap/backend/LDAPAuthorizationBackend.java @@ -832,6 +832,10 @@ public User addRoles(User user, AuthenticationContext context) throws OpenSearch userRoleAttributeValue = Utils.getSingleStringValue(userRoleAttribute); } + if (connection == null) { + connection = getConnection(settings, configPath); + } + if (rolesearchEnabled) { String escapedDn = dn; @@ -839,10 +843,6 @@ public User addRoles(User user, AuthenticationContext context) throws OpenSearch log.debug("DBGTRACE (8): escapedDn" + escapedDn); } - if (connection == null) { - connection = getConnection(settings, configPath); - } - for (Map.Entry roleSearchSettingsEntry : roleBaseSettings) { Settings roleSearchSettings = roleSearchSettingsEntry.getValue(); @@ -902,10 +902,6 @@ public User addRoles(User user, AuthenticationContext context) throws OpenSearch continue; } - if (connection == null) { - connection = getConnection(settings, configPath); - } - final Set nestedRoles = resolveNestedRoles( roleLdapName, connection, diff --git a/src/test/java/org/opensearch/security/auth/ldap/LdapBackendTestNewStyleConfig.java b/src/test/java/org/opensearch/security/auth/ldap/LdapBackendTestNewStyleConfig.java index 5fb7b945e5..7fc2c59f98 100644 --- a/src/test/java/org/opensearch/security/auth/ldap/LdapBackendTestNewStyleConfig.java +++ b/src/test/java/org/opensearch/security/auth/ldap/LdapBackendTestNewStyleConfig.java @@ -725,6 +725,29 @@ public void testLdapAuthorizationNestedAttrNoRoleSearch() throws Exception { MatcherAssert.assertThat(user.getRoles(), hasItem("rolemo4")); } + @Test + public void testLdapAuthorizationRolesearchDisabledWithLdapAuthContext() throws Exception { + final Settings settings = Settings.builder() + .putList(ConfigConstants.LDAP_HOSTS, "localhost:" + ldapPort) + .put("users.u1.search", "(uid={0})") + .put("users.u1.base", "ou=people,o=TEST") + .put("roles.g1.base", "ou=groups,o=TEST") + .put(ConfigConstants.LDAP_AUTHZ_ROLENAME, "cn") + .put(ConfigConstants.LDAP_AUTHZ_ROLESEARCH_ENABLED, false) + .put(ConfigConstants.LDAP_AUTHZ_USERROLENAME, "description") + .build(); + + AuthenticationContext context = ctx("spock", "spocksecret"); + User user = new LDAPAuthenticationBackend(settings, null).authenticate(context); + user = new LDAPAuthorizationBackend(settings, null).addRoles(user, context); + + Assert.assertNotNull(user); + assertThat(user.getName(), is("cn=Captain Spock,ou=people,o=TEST")); + assertThat(user.getRoles().size(), is(2)); + Assert.assertTrue(user.getRoles().contains("dummyempty")); + Assert.assertTrue(user.getRoles().contains("rolemo4")); + } + @Test public void testCustomAttributes() throws Exception {