Ldap role mapping deadlock fix

[traceon]

I hereby agree to the terms of the CLA available at: https://yandex.ru/legal/cla/?lang=en

Changelog category:

• Bug Fix

Changelog entry:

• Fixed the deadlock that can happen during LDAP role (re)mapping, when LDAP group is mapped to a nonexistent local role

Detailed description:

• Caused by recursive execution paths that enter MemoryAccessStorage methods.
• Closes LDAP: changing groups for user makes Clickhouse fail to log in #22221

[traceon]

@vzakaznikov Should we add a test for this case?

1. the ldap server is configured as a user directory in clickhouse
2. typical role mapping is configured there, with a clickhouse_ prefix
3. user1 user exists only in ldap
4. role1 role exists in clickhouse
5. unknown role does not exist in clickhouse
6. user1 is a member of clickhouse_role1 group in ldap initially
7. user1 logs in successfully (show grants shows only role1), then logs out
8. user1 also becomes a member of clickhouse_unknown group in ldap (clickhouse server process is not restarted during this)
9. user1 should be able to log in successfully again (with show grants still showing only role1)

[alexey-milovidov]

@Mergifyio update

[mergify]

Command update: success

Branch has been successfully updated

[vzakaznikov]

@vzakaznikov Should we add a test for this case?

1. the ldap server is configured as a user directory in clickhouse
2. typical role mapping is configured there, with a clickhouse_ prefix
3. user1 user exists only in ldap
4. role1 role exists in clickhouse
5. unknown role does not exist in clickhouse
6. user1 is a member of clickhouse_role1 group in ldap initially
7. user1 logs in successfully (show grants shows only role1), then logs out
8. user1 also becomes a member of clickhouse_unknown group in ldap (clickhouse server process is not restarted during this)
9. user1 should be able to log in successfully again (with show grants still showing only role1)

Yes, I can add an explicit test case for this. Also, we need to compare this scenario to xfailed test cases we already have. Right now LDAP tests are disabled in CI/CD, therefore you need to run them manually to check if there are no regressions.

[alexey-milovidov]

@Mergifyio update

[mergify]

Command update: success

Branch has been successfully updated

[vzakaznikov]

@traceon, see 33f270c for the new test.