[
https://issues.apache.org/jira/browse/KNOX-3308?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Larry McCay updated KNOX-3308:
------------------------------
Description:
The Token Exchange flow param name is inconsistent with the core OAuth
specification and requires both a full urn as the name and a hyphen rather than
an underscrore: urn:ietf:params:oauth:grant-type:token-exchange
JWTFederationFilter is currently coded to expect a shortname with underscore
'token_exchange'.
In addition, UrlEncodedFormRequest wrapper has a brittle getParameter
implementation that hard codes the names of params that we know indicate that
the processing of the request body will be handled by us and there is not
danger in consuming the response out from under another handler.
Since this is in a generic path, I want to move the knowledge of that out to
the code that is handling the request processing rather than trying to keep
this list in sync with the consuming code. I'll add a ServletRequestUtils to
unwrap the servlet request so that we can get to the params ourselves within
those specific code blocks and otherwise the wrapper will no longer treat any
param names specially. This will also require the move of ServletRequestUtils
to the gateway-spi module.
> Token Exchange Flow using wrong param name
> ------------------------------------------
>
> Key: KNOX-3308
> URL: https://issues.apache.org/jira/browse/KNOX-3308
> Project: Apache Knox
> Issue Type: Bug
> Components: Server
> Affects Versions: 3.0.0
> Reporter: Philip Zampino
> Assignee: Larry McCay
> Priority: Major
> Fix For: 3.0.0
>
>
> The Token Exchange flow param name is inconsistent with the core OAuth
> specification and requires both a full urn as the name and a hyphen rather
> than an underscrore: urn:ietf:params:oauth:grant-type:token-exchange
> JWTFederationFilter is currently coded to expect a shortname with underscore
> 'token_exchange'.
> In addition, UrlEncodedFormRequest wrapper has a brittle getParameter
> implementation that hard codes the names of params that we know indicate that
> the processing of the request body will be handled by us and there is not
> danger in consuming the response out from under another handler.
> Since this is in a generic path, I want to move the knowledge of that out to
> the code that is handling the request processing rather than trying to keep
> this list in sync with the consuming code. I'll add a ServletRequestUtils to
> unwrap the servlet request so that we can get to the params ourselves within
> those specific code blocks and otherwise the wrapper will no longer treat any
> param names specially. This will also require the move of ServletRequestUtils
> to the gateway-spi module.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
