[
https://issues.apache.org/jira/browse/KNOX-2399?focusedWorklogId=458594&page=com.atlassian.jira.plugin.system.issuetabpanels:worklog-tabpanel#worklog-458594
]
ASF GitHub Bot logged work on KNOX-2399:
----------------------------------------
Author: ASF GitHub Bot
Created on: 14/Jul/20 12:47
Start Date: 14/Jul/20 12:47
Worklog Time Spent: 10m
Work Description: smolnar82 opened a new pull request #361:
URL: https://github.com/apache/knox/pull/361
## What changes were proposed in this pull request?
The main purpose of this PR is to add a new token state service
implementation the uses Zookeeper as token storage.
Also, the following enhancements were made:
- introduced a service cache in
`org.apache.knox.gateway.services.factory.AbstractServiceFactory` to avoid
creating/initiating the same service by type/implementation more than once
- `ZookeeperRemoteAliasService` can be built w/o local alias service
## How was this patch tested?
Updated/ran JUnit tests and executed the following manual test steps:
1. Enabled token state service in sandbox:
```
<param>
<name>knox.token.exp.server-managed</name>
<value>true</value>
</param>
```
2. Configured Knox to use the new ZK Token State Service in
`gateway-site.xml`:
```
<property>
<name>gateway.service.tokenstate.impl</name>
<value>org.apache.knox.gateway.services.token.impl.ZookeeperTokenStateService</value>
</property>
<property>
<name>gateway.service.tokenstate.useLocalAliasService</name>
<value>[true|false]</value>
</property>
<property>
<name>gateway.remote.config.registry.zookeeper-client</name>
<value>type=ZooKeeper;address=$ZK_HOST:2181</value>
<description>ZooKeeper configuration registry client
details.</description>
</property>
<property>
<name>gateway.remote.config.monitor.client</name>
<value>zookeeper-client</value>
<description>Remote configuration monitor client name.</description>
</property>
```
3. Started Knox
4. Acquired a Knox delegation token:
```
$ curl -ivku guest:guest-password
https://localhost:8443/gateway/sandbox/knoxtoken/api/v1/token
...
* Connection #0 to host localhost left intact
{"access_token":"eyJhbGciOiJSUzI1NiJ9.eyJzdWIiOiJndWVzdCIsImF1...,"target_url":"https://localhost:8443/gateway/tokenbased",...,"token_type":"Bearer","expires_in":1594764588683}
gateway.log:
2020-07-14 14:09:48,681 INFO service.knoxtoken
(TokenResource.java:init(169)) - Server management of token state is enabled
for the "sandbox" topology.
2020-07-14 14:09:48,682 WARN service.knoxtoken
(TokenResource.java:init(199)) - There are no token renewers white-listed in
the "sandbox" topology.
2020-07-14 14:09:48,690 INFO service.knoxtoken
(TokenResource.java:getAuthenticationToken(400)) - Knox Token service (sandbox)
issued token eyJhbG...WYtr9Q (483b5976-f5ca-4761-b2d3-65041aa40d09)
```
5. Confirmed that the token became persisted in Zookeeper:
```
$ zookeeper-client -server $ZK_HOST:2181
Connecting to $ZK_HOST:2181
Welcome to ZooKeeper!
JLine support is enabled
WATCHER::
WatchedEvent state:SyncConnected type:None path:null
[zk: $ZK_HOST:2181(CONNECTED) 0] ls /knox/security/topology/__gateway
[483b5976-f5ca-4761-b2d3-65041aa40d09,
483b5976-f5ca-4761-b2d3-65041aa40d09--max]
```
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
[email protected]
Issue Time Tracking
-------------------
Worklog Id: (was: 458594)
Remaining Estimate: 0h
Time Spent: 10m
> Implement ZK token state service
> --------------------------------
>
> Key: KNOX-2399
> URL: https://issues.apache.org/jira/browse/KNOX-2399
> Project: Apache Knox
> Issue Type: Task
> Affects Versions: 1.4.0
> Reporter: Sandor Molnar
> Assignee: Sandor Molnar
> Priority: Major
> Fix For: 1.5.0
>
> Time Spent: 10m
> Remaining Estimate: 0h
>
> Implement a new {{TokenStateService}} implementation which stores/fetches
> token related metadata in Zookeeper. The new service should be configurable
> to directly go to Zookeeper or use some local cache (e.g. a local alias
> service).
--
This message was sent by Atlassian Jira
(v8.3.4#803005)
