[
https://issues.apache.org/jira/browse/KNOX-2631?focusedWorklogId=818510&page=com.atlassian.jira.plugin.system.issuetabpanels:worklog-tabpanel#worklog-818510
]
ASF GitHub Bot logged work on KNOX-2631:
----------------------------------------
Author: ASF GitHub Bot
Created on: 19/Oct/22 14:59
Start Date: 19/Oct/22 14:59
Worklog Time Spent: 10m
Work Description: moresandeep commented on code in PR #639:
URL: https://github.com/apache/knox/pull/639#discussion_r999585337
##########
gateway-server/src/main/java/org/apache/knox/gateway/websockets/JWTValidator.java:
##########
@@ -0,0 +1,193 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.knox.gateway.websockets;
+
+import com.nimbusds.jose.JWSHeader;
+import org.apache.knox.gateway.i18n.messages.MessagesFactory;
+import org.apache.knox.gateway.provider.federation.jwt.JWTMessages;
+import
org.apache.knox.gateway.provider.federation.jwt.filter.SignatureVerificationCache;
+import org.apache.knox.gateway.services.security.token.JWTokenAuthority;
+import org.apache.knox.gateway.services.security.token.TokenMetadata;
+import org.apache.knox.gateway.services.security.token.TokenServiceException;
+import org.apache.knox.gateway.services.security.token.TokenStateService;
+import org.apache.knox.gateway.services.security.token.TokenUtils;
+import org.apache.knox.gateway.services.security.token.UnknownTokenException;
+import org.apache.knox.gateway.services.security.token.impl.JWT;
+import org.apache.knox.gateway.util.Tokens;
+
+import java.security.interfaces.RSAPublicKey;
+import java.text.ParseException;
+import java.util.Date;
+
+public class JWTValidator {
Review Comment:
I tried refactoring but it turns out this touches a lot of sensitive
components. I have created [KNOX-2826
](https://issues.apache.org/jira/browse/KNOX-2826) to track this change.
Issue Time Tracking
-------------------
Worklog Id: (was: 818510)
Time Spent: 7.5h (was: 7h 20m)
> KnoxSSO for Secure Shell Access
> -------------------------------
>
> Key: KNOX-2631
> URL: https://issues.apache.org/jira/browse/KNOX-2631
> Project: Apache Knox
> Issue Type: New Feature
> Components: Homepage, KnoxSSO
> Affects Versions: 1.5.0
> Reporter: Lu Liu
> Assignee: Lu Liu
> Priority: Minor
> Fix For: 2.0.0
>
> Time Spent: 7.5h
> Remaining Estimate: 0h
>
> While Apache Knox aids in helping to lessen the need to gain physical access
> to deployment machines, there are still numerous compelling reasons for users
> to require such access:
> 1. Debugging, log access, etc
> 2. CLI use and automation
> 3. beeline and other clients that are deployed to gateway machines
> Gaining access to a shell for these purposes currently requires the user to
> have
> an ssh client installed and valid credentials that can be used for ssh, such
> as:
> username and password or SSH keys. Separate management of credentials for this
> access introduces some additional complexities which may even violate
> enterprise
> infosec policies and require the secure distribution and management of keys.
> The intent of this proposed improvement is to add a browser based terminal
> application
> that will provide secure access to a shell on the Knox machine. Just as any
> resource
> exposed by or hosted by Knox, you would be able to protect access to this
> terminal
> with any of the available security providers. We would also like to make this
> available out of the box as available from the Knox Homepage. This would make
> the
> terminal/shell available via KnoxSSO thus providing shell access with your
> existing
> enterprise credential authenticated SSO session.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
