[
https://issues.apache.org/jira/browse/KNOX-3016?focusedWorklogId=909019&page=com.atlassian.jira.plugin.system.issuetabpanels:worklog-tabpanel#worklog-909019
]
ASF GitHub Bot logged work on KNOX-3016:
----------------------------------------
Author: ASF GitHub Bot
Created on: 08/Mar/24 22:04
Start Date: 08/Mar/24 22:04
Worklog Time Spent: 10m
Work Description: lmccay opened a new pull request, #876:
URL: https://github.com/apache/knox/pull/876
(It is very **important** that you created an Apache Knox JIRA for this
change and that the PR title/commit message includes the Apache Knox JIRA ID!)
## What changes were proposed in this pull request?
Adding support for integrations to Knox proxied services and APIs via OAuth
style cllient credentials flow. This allows an integration that is provided a
CLIENT_ID and CLIENT_SECRET to authenticate to Knox and directly access proxied
services with those or exchange those credentials for short lived JWT based
access, id and refresh tokens.
This change introduces only the acceptance of the Knox TokenID and Passcode
tokens as CLIENT_ID and CLIENT_SECRET in a standard OAuth 2.0 client
credentials flow request body. This body will contain the following params:
1. grant_type and it will be "client_credentials"
2. client_id which will be the KnoxToken tokenId or KnoxID
3. client_secret which will be the passcode token for which we store the hash
Authentication using this flow will result in the effective user being what
is provided as the CLIENT_ID.
## How was this patch tested?
Ran existing tests and added new unit tests
Please review [Knox Contributing
Process](https://cwiki.apache.org/confluence/display/KNOX/Contribution+Process#ContributionProcess-GithubWorkflow)
before opening a pull request.
Issue Time Tracking
-------------------
Worklog Id: (was: 909019)
Remaining Estimate: 0h
Time Spent: 10m
> Add Support for Client Credentials Flow with KnoxTokens
> -------------------------------------------------------
>
> Key: KNOX-3016
> URL: https://issues.apache.org/jira/browse/KNOX-3016
> Project: Apache Knox
> Issue Type: Bug
> Components: JWT
> Reporter: Larry McCay
> Assignee: Larry McCay
> Priority: Major
> Fix For: 2.1.0
>
> Time Spent: 10m
> Remaining Estimate: 0h
>
> Adding support for integrations to Knox proxied services and APIs via OAuth
> style cllient credentials flow. This allows an integration that is provided a
> CLIENT_ID and CLIENT_SECRET to authenticate to Knox and directly access
> proxied services with those or exchange those credentials for short lived JWT
> based access, id and refresh tokens.
> This change introduces only the acceptance of the Knox TokenID and Passcode
> tokens as CLIENT_ID and CLIENT_SECRET in a standard OAuth 2.0 client
> credentials flow request body. This body will contain the following params:
> 1. grant_type and it will be "client_credentials"
> 2. client_id which will be the KnoxToken tokenId or KnoxID
> 3. client_secret which will be the passcode token for which we store the hash
> Authentication using this flow will result in the effective user being what
> is provided as the CLIENT_ID.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
