This is an automated email from the ASF dual-hosted git repository.
smolnar82 pushed a change to branch knox_idf
in repository https://gitbox.apache.org/repos/asf/knox.git
discard 705d27e9f KNOX-3405 - Extend JWTFederationFilter for dynamic JWKS and
iss attribute on token-exchange (#1342)
omit 2ff4e39e2 KNOX-3408 - Move act-claim/ActorChainPrincipal coverage into
TokenExchangeHandlerTest; drop redundant
JWTFederationFilterHandleTokenExchangeTest
omit 58865312a KnoxIDF: remove unused import (caused by the previous master
rebase)
omit 5066017a8 KNOX-3408 - Allow no actor token in
JWTFederationFilter.handleTokenExchange (#1339)
omit 2d3e5acef KNOX-3368 - Switch KNOXIDF_ADMIN to single-role pattern with
PathAclsAuthz (#1337)
omit 2e5a04dec KNOX-3396: Return 4xx for type-mismatched register bodies
and issuer-limit-reached instead of 500 (#1328)
omit a425278dd KNOX-3390: Corrected JUnit test coverage for max issuers
(#1326)
omit 612810fe1 KNOX-3368 - Trusted OIDC Issuer admin API for Knox IDF
(#1327)
omit 232e9b1a7 KNOX-3390: Moved gateway-level config to GatewayConfig and
implemented the missing methods (#1322)
omit 3bc9e46c2 KNOX-3390 - Address comments in PR 1315 (#1320)
omit b697d7afc KNOX-3355 - Add OIDCDiscoveryHelper,
JdbcTrustedOidcIssuerService, and TrustedOidcIssuerServiceFactory (#1315)
omit 084f7287e KNOX-3355 - Add TrustedOidcIssuerService schema and
interface (#1311)
omit b8d9ceaea KnoxIDF - Fixed pylint and test issues in Docker-based tests
omit 90e1e7e8a Knox as OIDC Provider (#1215)
add e51163532 KNOX-3409: Validate knoxauth theme name to Harden Branding
Support (Reported by Quinn Nguyen) (#1341)
add f2126008a KNOX-3410: KnoxToken enable/disable endpoints perform no
caller autho… (#1343)
add 049dc0cb8 KNOX-3411: KnoxToken getUserTokens returns every user's
token metadat… (#1344)
add 5342483a2 KNOX-3413: KnoxToken passcode verification accepts a valid
passcode for a different token (#1345)
add c3dee5634 KNOX-3416: KnoxSSO redirects to untrusted site (#1346)
new 5da3d9be6 Knox as OIDC Provider (#1215)
new f980f6ac0 KnoxIDF - Fixed pylint and test issues in Docker-based tests
new e0aab56b5 KNOX-3355 - Add TrustedOidcIssuerService schema and
interface (#1311)
new b0f6e27b3 KNOX-3355 - Add OIDCDiscoveryHelper,
JdbcTrustedOidcIssuerService, and TrustedOidcIssuerServiceFactory (#1315)
new f7175b88d KNOX-3390 - Address comments in PR 1315 (#1320)
new 7afb4b483 KNOX-3390: Moved gateway-level config to GatewayConfig and
implemented the missing methods (#1322)
new 740c6960c KNOX-3368 - Trusted OIDC Issuer admin API for Knox IDF
(#1327)
new f920ec986 KNOX-3390: Corrected JUnit test coverage for max issuers
(#1326)
new de7c31270 KNOX-3396: Return 4xx for type-mismatched register bodies
and issuer-limit-reached instead of 500 (#1328)
new 85117644d KNOX-3368 - Switch KNOXIDF_ADMIN to single-role pattern with
PathAclsAuthz (#1337)
new b6f674d42 KNOX-3408 - Allow no actor token in
JWTFederationFilter.handleTokenExchange (#1339)
new c8ab014f0 KnoxIDF: remove unused import (caused by the previous master
rebase)
new baefcd58a KNOX-3408 - Move act-claim/ActorChainPrincipal coverage into
TokenExchangeHandlerTest; drop redundant
JWTFederationFilterHandleTokenExchangeTest
new cd163171a KNOX-3405 - Extend JWTFederationFilter for dynamic JWKS and
iss attribute on token-exchange (#1342)
new d9b1453d2 KNOX-3414: security hardening for the OIDC provider (Tier 1
+ Tier 2)
new dcd1e0177 KNOX-3414: harden secrets-at-rest, auth-code single-use, and
persistence (1.5, 2.4, 2.11)
new 7802c3c65 KNOX-3414: Tier 3 hardening + Tier 4 polish for the OIDC
provider
new c8af244e4 KNOX-3414: E2E tests now adjusted to cover the previous Tier
1/2/3 bug fixes and changes
new 9a1d04a2b KNOX-3414: add opt-in Keycloak federation E2E test and
activate federated-identity persistence
new 6c048894e KNOX-3414: authenticate the client on the refresh_token
grant (review finding H1)
new 571a9d97f KNOX-3414: bind federated id_token to the request via OIDC
nonce (review finding H2)
new 5926b85af KNOX-3414: atomically consume the refresh token before
rotation (review finding M1)
new 8f6860b03 KNOX-3414: reject federated id_token missing sub with 4xx,
not 500 (review finding M2)
new ce091a2fb KNOX-3414: normalize redirect_uri path before wildcard match
(review finding M3)
new 147310292 KNOX-3414: fail closed when a federated-OP client-secret
alias is unresolvable (review finding M4)
new 2abbf2a83 KNOX-3414: fix broken double-checked locking in
JdbcTrustedOidcIssuerService.init (review finding M5)
new 478c56181 KNOX-3414: /userinfo returns 401 invalid_token, not 500, for
a bad bearer token (review finding M6)
new 5827bb196 KNOX-3414: build a well-formed success redirect when
redirect_uri has a query (review finding M7)
new c74d837e0 KNOX-3414: advertise only S256 in discovery
code_challenge_methods_supported (review finding M8)
new 5e7d83f88 KNOX-3414: emit structured audit records across OAuth2/OIDC
endpoints (J2)
new a2c1470c8 KNOX-3414: publish multiple JWKs and select verification key
by kid
new 7341b1b89 KNOX-3414: complete OIDC discovery metadata for OAuth/MCP
client integration
new 34d403040 KNOX-3414: document the UUIDv5 namespace used for federated
subject derivation
new 0bcb52a38 KNOX-3414: add Identity Federation (OIDC Provider)
documentation book
new 8d6840b29 KNOX-3414: run KnoxIDF federation E2E tests optionally in PRs
new 331f3bbd2 KNOX-3414: fix embedded-Derby table-exists check and add
DerbyDB TrustedOidcIssuerService default
new e43cd2e52 KNOX-3414: support Authorization Code + PKCE for public
clients
This update added new revisions after undoing existing revisions.
That is to say, some revisions that were in the old version of the
branch are not in the new version. This situation occurs
when a user --force pushes a change and generates a repository
containing something like this:
* -- * -- B -- O -- O -- O (705d27e9f)
\
N -- N -- N refs/heads/knox_idf (e43cd2e52)
You should already have received notification emails for all of the O
revisions, and so the following emails describe only the N revisions
from the common base, B.
Any revisions marked "omit" are not gone; other references still
refer to them. Any revisions marked "discard" are gone forever.
The 37 revisions listed above as "new" are entirely new to this
repository and will be described in separate emails. The revisions
listed as "add" were already present in the repository and have only
been added to this reference.
Summary of changes:
.github/PULL_REQUEST_TEMPLATE.md | 10 +
.github/workflows/build/Dockerfile | 2 +
.../build/conf/topologies/knoxidf-ldap.xml | 15 +
.../build/conf/topologies/knoxidf-sso.xml | 120 +++++
.../build/conf/topologies/knoxidf-token.xml | 7 +
.../workflows/build}/conf/topologies/knoxsso.xml | 61 +--
.../compose/docker-compose.knoxidf-federation.yml | 73 +++
.github/workflows/compose/docker-compose.yml | 2 +-
.github/workflows/compose/keycloak/realm.json | 49 ++
.github/workflows/tests.yml | 56 +++
.github/workflows/tests/test_knoxidf.py | 75 ++-
.github/workflows/tests/test_knoxidf_federation.py | 234 +++++++++
.gitignore | 4 +
.../applications/knoxauth/app/js/knoxauth.js | 14 +-
.../resources/applications/knoxauth/app/login.html | 72 ++-
.../knoxauth/app/styles/themes/DEPLOYMENT.md | 18 +-
.../knoxauth/app/styles/themes/README.md | 15 +-
.../federation/jwt/filter/AbstractJWTFilter.java | 9 +-
.../federation/jwt/filter/JWTFederationFilter.java | 37 +-
.../provider/federation/AbstractJWTFilterTest.java | 3 +
.../federation/JWTFederationFilterTest.java | 2 +-
.../federation/OAuthFlowsFederationFilterTest.java | 83 +++-
...okenIDAsHTTPBasicCredsFederationFilterTest.java | 50 ++
.../knox/gateway/filter/RedirectToUrlFilter.java | 5 +-
.../org/apache/knox/gateway/GatewayMessages.java | 6 +
.../gateway/config/impl/GatewayConfigImpl.java | 19 +
.../apache/knox/gateway/database/JDBCUtils.java | 20 +-
.../apache/knox/gateway/database/KnoxDatabase.java | 7 +-
.../services/factory/AbstractServiceFactory.java | 79 +++
.../factory/FederatedIdentityServiceFactory.java | 91 ++--
.../factory/TrustedOidcIssuerServiceFactory.java | 86 ++--
.../DerbyDBFederatedIdentityService.java} | 40 +-
...ice.java => EmptyFederatedIdentityService.java} | 2 +-
.../federation/FederatedIdentityDatabase.java | 56 ++-
.../FederatedIdentityServiceMessages.java | 3 +
.../federation/JdbcFederatedIdentityService.java | 54 ++-
.../DerbyDBTrustedOidcIssuerService.java} | 41 +-
.../JdbcTrustedOidcIssuerService.java | 36 +-
.../token/impl/DefaultTokenAuthorityService.java | 54 ++-
.../token/impl/DefaultTokenStateService.java | 16 +
.../services/token/impl/JDBCTokenStateService.java | 19 +
...eateKnoxIDFFederatedIdentityAttributesTable.sql | 2 +-
...noxIDFFederatedIdentityAttributesTableDerby.sql | 6 +-
...oxIDFFederatedIdentityAttributesTableOracle.sql | 2 +-
.../createKnoxIDFFederatedIdentityTable.sql | 7 +-
.../createKnoxIDFFederatedIdentityTableDerby.sql | 15 +-
.../createKnoxIDFFederatedIdentityTableOracle.sql | 7 +-
.../gateway/config/impl/GatewayConfigImplTest.java | 28 ++
.../FederatedIdentityServiceFactoryTest.java | 211 ++++++++
.../TrustedOidcIssuerServiceFactoryTest.java | 188 ++++++++
.../DerbyDBFederatedIdentityServiceTest.java | 150 ++++++
.../DerbyDBTrustedOidcIssuerServiceTest.java | 131 +++++
.../JdbcTrustedOidcIssuerServiceTest.java | 56 +++
.../TrustedOidcIssuerServiceFactoryTest.java | 265 ----------
.../impl/DefaultTokenAuthorityServiceTest.java | 64 +++
.../token/impl/DefaultTokenStateServiceTest.java | 36 ++
.../service/knoxidf/AuthConsentServlet.java | 6 +-
.../gateway/service/knoxidf/AuthorizeResource.java | 428 +++++++++++++++--
.../gateway/service/knoxidf/DiscoveryResource.java | 31 +-
.../knox/gateway/service/knoxidf/JwksResource.java | 4 +-
.../knox/gateway/service/knoxidf/KnoxIDFAudit.java | 91 ++++
.../service/knoxidf/RegistrationResource.java | 140 +++++-
.../gateway/service/knoxidf/TokenResource.java | 322 ++++++++++---
.../gateway/service/knoxidf/UserInfoResource.java | 132 +++--
.../knoxidf/userparams/LdapUserParamsProvider.java | 17 +-
...uthorizeResourceClientSecretResolutionTest.java | 59 +++
.../AuthorizeResourceFederatedNonceTest.java | 75 +++
.../AuthorizeResourceFederatedSubjectTest.java | 68 +++
.../AuthorizeResourceRedirectUriMatchTest.java | 74 +++
.../AuthorizeResourceSuccessRedirectTest.java | 67 +++
.../service/knoxidf/ConsentMetadataKeyTest.java | 65 +++
.../knoxidf/DiscoveryResourceMetadataTest.java | 69 +++
.../knoxidf/DiscoveryResourcePkceMethodsTest.java | 52 ++
.../gateway/service/knoxidf/KnoxIDFAuditTest.java | 274 +++++++++++
.../knoxidf/KnoxIDFUtilsErrorStatusTest.java | 83 ++++
.../knoxidf/RegistrationRedirectUriPolicyTest.java | 119 +++++
.../RegistrationResourceAnonymousGuardTest.java | 78 +++
.../knoxidf/TokenResourceAuthCodeReplayTest.java | 153 ++++++
.../knoxidf/TokenResourceClientAuthTest.java | 116 +++++
.../TokenResourceRefreshTokenClientAuthTest.java | 146 ++++++
.../TokenResourceRefreshTokenRotationTest.java | 134 ++++++
.../knoxidf/UserInfoResourceInvalidTokenTest.java | 94 ++++
.../gateway/service/knoxsso/KnoxSSOMessages.java | 4 +
.../gateway/service/knoxsso/WebSSOResource.java | 35 +-
.../service/knoxsso/WebSSOResourceTest.java | 43 ++
.../gateway/service/knoxtoken/JWKSResource.java | 59 ++-
.../gateway/service/knoxtoken/TokenResource.java | 62 ++-
.../gateway/service/knoxtoken/TokenResourceV2.java | 2 +-
.../service/knoxtoken/TokenServiceMessages.java | 3 +
.../service/knoxtoken/JWKSResourceTest.java | 57 +++
.../knoxtoken/TokenServiceResourceTest.java | 270 ++++++++++-
.../apache/knox/gateway/config/GatewayConfig.java | 20 +
.../security/token/JWTokenAttributesBuilder.java | 5 +-
.../services/security/token/TokenStateService.java | 26 +
.../services/security/token/impl/JWTTokenTest.java | 28 ++
.../util/knoxidf/AuthorizeRequestMetadata.java | 7 +
.../gateway/util/knoxidf/FederatedNonceStore.java | 42 ++
.../util/knoxidf/FederatedOpConfiguration.java | 38 ++
.../gateway/util/knoxidf/KnoxIDFArtifactStore.java | 9 +
.../gateway/util/knoxidf/KnoxIDFConstants.java | 25 +-
.../knox/gateway/util/knoxidf/KnoxIDFUtils.java | 84 ++--
.../util/knoxidf/FederatedOpConfigurationTest.java | 99 ++++
.../util/knoxidf/KnoxIDFArtifactStoreTest.java | 63 +++
.../docs/assets/images/knoxidf/architecture.png | Bin 0 -> 319038 bytes
.../docs/assets/images/knoxidf/consent_page.png | Bin 0 -> 87171 bytes
.../assets/images/knoxidf/login_page_federated.png | Bin 0 -> 7329 bytes
.../assets/images/knoxidf/polaris_console_home.png | Bin 0 -> 753395 bytes
.../images/knoxidf/polaris_console_login.png | Bin 0 -> 174009 bytes
knox-site/docs/knoxidf/configuration.md | 174 +++++++
knox-site/docs/knoxidf/endpoints.md | 299 ++++++++++++
knox-site/docs/knoxidf/federation.md | 221 +++++++++
knox-site/docs/knoxidf/getting_started.md | 284 +++++++++++
knox-site/docs/knoxidf/index.md | 93 ++++
knox-site/docs/knoxidf/integrations/polaris.md | 533 +++++++++++++++++++++
.../docs/knoxidf/integrations/polaris_console.md | 471 ++++++++++++++++++
knox-site/docs/knoxidf/operations.md | 182 +++++++
knox-site/docs/knoxidf/security.md | 183 +++++++
knox-site/mkdocs.yml | 17 +-
118 files changed, 8306 insertions(+), 842 deletions(-)
create mode 100644 .github/workflows/build/conf/topologies/knoxidf-sso.xml
copy {gateway-release/home =>
.github/workflows/build}/conf/topologies/knoxsso.xml (67%)
create mode 100644
.github/workflows/compose/docker-compose.knoxidf-federation.yml
create mode 100644 .github/workflows/compose/keycloak/realm.json
create mode 100644 .github/workflows/tests/test_knoxidf_federation.py
copy
gateway-server/src/main/java/org/apache/knox/gateway/services/{token/impl/DerbyDBTokenStateService.java
=> knoxidf/federation/DerbyDBFederatedIdentityService.java} (75%)
rename
gateway-server/src/main/java/org/apache/knox/gateway/services/knoxidf/federation/{EmptyFederatedIdentitityService.java
=> EmptyFederatedIdentityService.java} (95%)
copy
gateway-server/src/main/java/org/apache/knox/gateway/services/{token/impl/DerbyDBTokenStateService.java
=> knoxidf/trustedoidcissuer/DerbyDBTrustedOidcIssuerService.java} (74%)
create mode 100644
gateway-server/src/test/java/org/apache/knox/gateway/services/factory/FederatedIdentityServiceFactoryTest.java
create mode 100644
gateway-server/src/test/java/org/apache/knox/gateway/services/factory/TrustedOidcIssuerServiceFactoryTest.java
create mode 100644
gateway-server/src/test/java/org/apache/knox/gateway/services/knoxidf/federation/DerbyDBFederatedIdentityServiceTest.java
create mode 100644
gateway-server/src/test/java/org/apache/knox/gateway/services/knoxidf/trustedoidcissuer/DerbyDBTrustedOidcIssuerServiceTest.java
delete mode 100644
gateway-server/src/test/java/org/apache/knox/gateway/services/knoxidf/trustedoidcissuer/TrustedOidcIssuerServiceFactoryTest.java
create mode 100644
gateway-service-knoxidf/src/main/java/org/apache/knox/gateway/service/knoxidf/KnoxIDFAudit.java
create mode 100644
gateway-service-knoxidf/src/test/java/org/apache/knox/gateway/service/knoxidf/AuthorizeResourceClientSecretResolutionTest.java
create mode 100644
gateway-service-knoxidf/src/test/java/org/apache/knox/gateway/service/knoxidf/AuthorizeResourceFederatedNonceTest.java
create mode 100644
gateway-service-knoxidf/src/test/java/org/apache/knox/gateway/service/knoxidf/AuthorizeResourceFederatedSubjectTest.java
create mode 100644
gateway-service-knoxidf/src/test/java/org/apache/knox/gateway/service/knoxidf/AuthorizeResourceRedirectUriMatchTest.java
create mode 100644
gateway-service-knoxidf/src/test/java/org/apache/knox/gateway/service/knoxidf/AuthorizeResourceSuccessRedirectTest.java
create mode 100644
gateway-service-knoxidf/src/test/java/org/apache/knox/gateway/service/knoxidf/ConsentMetadataKeyTest.java
create mode 100644
gateway-service-knoxidf/src/test/java/org/apache/knox/gateway/service/knoxidf/DiscoveryResourceMetadataTest.java
create mode 100644
gateway-service-knoxidf/src/test/java/org/apache/knox/gateway/service/knoxidf/DiscoveryResourcePkceMethodsTest.java
create mode 100644
gateway-service-knoxidf/src/test/java/org/apache/knox/gateway/service/knoxidf/KnoxIDFAuditTest.java
create mode 100644
gateway-service-knoxidf/src/test/java/org/apache/knox/gateway/service/knoxidf/KnoxIDFUtilsErrorStatusTest.java
create mode 100644
gateway-service-knoxidf/src/test/java/org/apache/knox/gateway/service/knoxidf/RegistrationRedirectUriPolicyTest.java
create mode 100644
gateway-service-knoxidf/src/test/java/org/apache/knox/gateway/service/knoxidf/RegistrationResourceAnonymousGuardTest.java
create mode 100644
gateway-service-knoxidf/src/test/java/org/apache/knox/gateway/service/knoxidf/TokenResourceAuthCodeReplayTest.java
create mode 100644
gateway-service-knoxidf/src/test/java/org/apache/knox/gateway/service/knoxidf/TokenResourceClientAuthTest.java
create mode 100644
gateway-service-knoxidf/src/test/java/org/apache/knox/gateway/service/knoxidf/TokenResourceRefreshTokenClientAuthTest.java
create mode 100644
gateway-service-knoxidf/src/test/java/org/apache/knox/gateway/service/knoxidf/TokenResourceRefreshTokenRotationTest.java
create mode 100644
gateway-service-knoxidf/src/test/java/org/apache/knox/gateway/service/knoxidf/UserInfoResourceInvalidTokenTest.java
create mode 100644
gateway-util-common/src/main/java/org/apache/knox/gateway/util/knoxidf/FederatedNonceStore.java
create mode 100644
gateway-util-common/src/test/java/org/apache/knox/gateway/util/knoxidf/FederatedOpConfigurationTest.java
create mode 100644
gateway-util-common/src/test/java/org/apache/knox/gateway/util/knoxidf/KnoxIDFArtifactStoreTest.java
create mode 100644 knox-site/docs/assets/images/knoxidf/architecture.png
create mode 100644 knox-site/docs/assets/images/knoxidf/consent_page.png
create mode 100644
knox-site/docs/assets/images/knoxidf/login_page_federated.png
create mode 100644
knox-site/docs/assets/images/knoxidf/polaris_console_home.png
create mode 100644
knox-site/docs/assets/images/knoxidf/polaris_console_login.png
create mode 100644 knox-site/docs/knoxidf/configuration.md
create mode 100644 knox-site/docs/knoxidf/endpoints.md
create mode 100644 knox-site/docs/knoxidf/federation.md
create mode 100644 knox-site/docs/knoxidf/getting_started.md
create mode 100644 knox-site/docs/knoxidf/index.md
create mode 100644 knox-site/docs/knoxidf/integrations/polaris.md
create mode 100644 knox-site/docs/knoxidf/integrations/polaris_console.md
create mode 100644 knox-site/docs/knoxidf/operations.md
create mode 100644 knox-site/docs/knoxidf/security.md
