This is an automated email from the ASF dual-hosted git repository.
smolnar82 pushed a change to branch knox_idf
in repository https://gitbox.apache.org/repos/asf/knox.git
omit e9c2ab00b KNOX-3408 - Allow no actor token in
JWTFederationFilter.handleTokenExchange (#1339)
omit 77c775b39 KNOX-3368 - Switch KNOXIDF_ADMIN to single-role pattern with
PathAclsAuthz (#1337)
omit 7b9730b18 KNOX-3396: Return 4xx for type-mismatched register bodies
and issuer-limit-reached instead of 500 (#1328)
omit 1d56df151 KNOX-3390: Corrected JUnit test coverage for max issuers
(#1326)
omit 3c30bfbb5 KNOX-3368 - Trusted OIDC Issuer admin API for Knox IDF
(#1327)
omit c0eb9b583 KNOX-3390: Moved gateway-level config to GatewayConfig and
implemented the missing methods (#1322)
omit dfdd98f0d KNOX-3390 - Address comments in PR 1315 (#1320)
omit 0ac3eca9f KNOX-3355 - Add OIDCDiscoveryHelper,
JdbcTrustedOidcIssuerService, and TrustedOidcIssuerServiceFactory (#1315)
omit 11acc7e60 KNOX-3355 - Add TrustedOidcIssuerService schema and
interface (#1311)
omit ca62c98fc KnoxIDF - Fixed pylint and test issues in Docker-based tests
omit be0c4edca Knox as OIDC Provider (#1215)
add aea0def98 KNOX-3333 - Update Letsencrypt staging certs (#1244)
add 2beb45b33 KNOX-3041: Eliminate load-balancing race condition in HA
dispatch (#1317)
add 6bdf64cdf Bump org.postgresql:postgresql from 42.7.11 to 42.7.12
(#1323)
add 204d97bf3 KNOX-3397: Add preauth.auth.header.actor.groups to set actor
groups header name explicitly (#1329)
add e63e2b0ba KNOX-3398: Enable Iceberg REST catalog SSL only when
ENCRYPT_ALL_PORTS is set (#1330)
add 66575ba66 KNOX-3399 - Make RFC 8693 token exchange work for
form-encoded requests and align it with the spec (#1334)
add da08af1f0 KNOX-3403: RFC 8693 token exchange: use the impersonated
subject as the token sub on non-server-managed topologies (#1336)
add e713c58e6 KNOX-3386: LDAP Proxy pages backends (#1331)
add eb14d8b5d KNOX-3407: Support for WebSocket mTLS (#1338)
new 90e1e7e8a Knox as OIDC Provider (#1215)
new b8d9ceaea KnoxIDF - Fixed pylint and test issues in Docker-based tests
new 084f7287e KNOX-3355 - Add TrustedOidcIssuerService schema and
interface (#1311)
new b697d7afc KNOX-3355 - Add OIDCDiscoveryHelper,
JdbcTrustedOidcIssuerService, and TrustedOidcIssuerServiceFactory (#1315)
new 3bc9e46c2 KNOX-3390 - Address comments in PR 1315 (#1320)
new 232e9b1a7 KNOX-3390: Moved gateway-level config to GatewayConfig and
implemented the missing methods (#1322)
new 612810fe1 KNOX-3368 - Trusted OIDC Issuer admin API for Knox IDF
(#1327)
new a425278dd KNOX-3390: Corrected JUnit test coverage for max issuers
(#1326)
new 2e5a04dec KNOX-3396: Return 4xx for type-mismatched register bodies
and issuer-limit-reached instead of 500 (#1328)
new 2d3e5acef KNOX-3368 - Switch KNOXIDF_ADMIN to single-role pattern with
PathAclsAuthz (#1337)
new 5066017a8 KNOX-3408 - Allow no actor token in
JWTFederationFilter.handleTokenExchange (#1339)
This update added new revisions after undoing existing revisions.
That is to say, some revisions that were in the old version of the
branch are not in the new version. This situation occurs
when a user --force pushes a change and generates a repository
containing something like this:
* -- * -- B -- O -- O -- O (e9c2ab00b)
\
N -- N -- N refs/heads/knox_idf (5066017a8)
You should already have received notification emails for all of the O
revisions, and so the following emails describe only the N revisions
from the common base, B.
Any revisions marked "omit" are not gone; other references still
refer to them. Any revisions marked "discard" are gone forever.
The 11 revisions listed above as "new" are entirely new to this
repository and will be described in separate emails. The revisions
listed as "add" were already present in the repository and have only
been added to this reference.
Summary of changes:
.github/workflows/build/gateway-site.xml | 13 +
.../compose/single-eku-no-mtls/gateway-site.xml | 13 +
.../workflows/compose/single-eku/gateway-site.xml | 13 +
.../hive/IcebergRestServiceModelGenerator.java | 16 +-
.../model/AbstractServiceModelGeneratorTest.java | 6 +-
.../hive/IcebergRestServiceModelGeneratorTest.java | 26 +-
.../src/main/resources/docker/Dockerfile | 3 +-
.../main/resources/docker/gateway-entrypoint.sh | 51 ++-
.../knox/gateway/ha/dispatch/CommonHaDispatch.java | 145 ++++++--
.../ha/dispatch/ConfigurableHADispatch.java | 5 +-
.../knox/gateway/ha/dispatch/SSEHaDispatch.java | 11 -
.../knox/gateway/ha/provider/HaProvider.java | 11 +
.../knox/gateway/ha/provider/URLManager.java | 2 +
.../ha/provider/impl/BaseZookeeperURLManager.java | 13 +
.../ha/provider/impl/DefaultHaProvider.java | 22 ++
.../ha/provider/impl/DefaultURLManager.java | 10 +
.../ha/dispatch/ConfigurableHADispatchTest.java | 385 +++++++++++++++++++++
.../gateway/ha/dispatch/SSEHaDispatchTest.java | 37 +-
.../federation/jwt/filter/JWTFederationFilter.java | 168 ++-------
.../jwt/filter/TokenExchangeHandler.java | 208 +++++++++++
.../federation/OAuthFlowsFederationFilterTest.java | 14 -
...WTFederationFilterTokenExchangeRoutingTest.java | 145 ++++++++
.../jwt/filter/TokenExchangeHandlerTest.java | 234 +++++++++++++
.../gateway/config/impl/GatewayConfigImpl.java | 27 +-
.../services/ldap/KnoxLDAPServerManager.java | 18 +-
.../knox/gateway/services/ldap/LdapMessages.java | 20 +-
.../services/ldap/backend/LdapProxyBackend.java | 160 ++++++---
.../websockets/GatewayWebsocketHandler.java | 43 ++-
.../gateway/websockets/ProxyWebSocketAdapter.java | 39 ++-
.../gateway/websockets/WebsocketLogMessages.java | 5 +
.../src/main/resources/conf/gateway-site.xml | 12 +
.../services/ldap/KnoxLDAPServerManagerTest.java | 21 ++
.../gateway/services/ldap/KnoxLDAPServiceTest.java | 2 +
.../ldap/backend/LdapProxyBackendSslTest.java | 4 +-
.../ldap/backend/LdapProxyBackendTest.java | 170 ++++++++-
.../websockets/GatewayWebsocketHandlerTest.java | 99 ++++++
.../websockets/ProxyWebSocketAdapterTest.java | 78 +++++
.../test/resources/ldap-proxy-backend-test.ldif | 19 +
.../gateway/service/auth/AbstractAuthResource.java | 17 +-
.../gateway/service/auth/PreAuthResourceTest.java | 27 ++
.../gateway/service/knoxtoken/TokenResource.java | 25 +-
.../knoxtoken/TokenServiceResourceTest.java | 51 +++
.../org/apache/knox/gateway/GatewayTestConfig.java | 10 +
.../apache/knox/gateway/config/GatewayConfig.java | 12 +
.../org/apache/knox/gateway/sse/SSEDispatch.java | 5 -
knox-site/docs/service_ldap_server.md | 6 +
pom.xml | 2 +-
47 files changed, 2073 insertions(+), 350 deletions(-)
create mode 100644
gateway-provider-security-jwt/src/main/java/org/apache/knox/gateway/provider/federation/jwt/filter/TokenExchangeHandler.java
create mode 100644
gateway-provider-security-jwt/src/test/java/org/apache/knox/gateway/provider/federation/jwt/filter/JWTFederationFilterTokenExchangeRoutingTest.java
create mode 100644
gateway-provider-security-jwt/src/test/java/org/apache/knox/gateway/provider/federation/jwt/filter/TokenExchangeHandlerTest.java
create mode 100644
gateway-server/src/test/java/org/apache/knox/gateway/websockets/ProxyWebSocketAdapterTest.java
