mirror of
https://github.com/honeymoose/OpenSearch.git
synced 2025-03-09 14:34:43 +00:00
The `DistinguishedNamePredicate`, used for matching users to role mapping expressions, should handle users with null DNs. But it fails to do so (and this is a NPE bug), if the role mapping expression contains a lucene regexp or a wildcard. The fix simplifies `DistinguishedNamePredicate` to not handle null DNs at all, and instead use the `ExpressionModel#NULL_PREDICATE` for the DN field, just like any other missing user field.