[
https://issues.apache.org/jira/browse/KNOX-3308?focusedWorklogId=1016943&page=com.atlassian.jira.plugin.system.issuetabpanels:worklog-tabpanel#worklog-1016943
]
ASF GitHub Bot logged work on KNOX-3308:
----------------------------------------
Author: ASF GitHub Bot
Created on: 23/Apr/26 00:08
Start Date: 23/Apr/26 00:08
Worklog Time Spent: 10m
Work Description: github-actions[bot] commented on PR #1211:
URL: https://github.com/apache/knox/pull/1211#issuecomment-4300749705
## Test Results
21 tests 21 ✅ 1s ⏱️
1 suites 0 💤
1 files 0 ❌
Results for commit 796b06ab.
[test-results]:data:application/gzip;base64,H4sIABJj6WkC/12MywqDMBBFf0Wy7iIaksH+TInjBIaqKXmsiv/eaCXV7u45F85bOJ4oinvT3hoRM6cKYw42sV8OLEfarq7CI2bEP/PkVzGyCmd5uggKwYfDhLzU4rYvwa/49XY+5XY+19DPM6cCAnozSGMHULI3iJpGDcohGElkulZpC9YRgVg/AbHbDv8AAAA=
Issue Time Tracking
-------------------
Worklog Id: (was: 1016943)
Time Spent: 20m (was: 10m)
> Token Exchange Flow using wrong param name
> ------------------------------------------
>
> Key: KNOX-3308
> URL: https://issues.apache.org/jira/browse/KNOX-3308
> Project: Apache Knox
> Issue Type: Bug
> Components: Server
> Affects Versions: 3.0.0
> Reporter: Philip Zampino
> Assignee: Larry McCay
> Priority: Major
> Fix For: 3.0.0
>
> Time Spent: 20m
> Remaining Estimate: 0h
>
> The Token Exchange flow param name is inconsistent with the core OAuth
> specification and requires both a full urn as the name and a hyphen rather
> than an underscrore: urn:ietf:params:oauth:grant-type:token-exchange
> JWTFederationFilter is currently coded to expect a shortname with underscore
> 'token_exchange'.
> In addition, UrlEncodedFormRequest wrapper has a brittle getParameter
> implementation that hard codes the names of params that we know indicate that
> the processing of the request body will be handled by us and there is not
> danger in consuming the response out from under another handler.
> Since this is in a generic path, I want to move the knowledge of that out to
> the code that is handling the request processing rather than trying to keep
> this list in sync with the consuming code. I'll add a ServletRequestUtils to
> unwrap the servlet request so that we can get to the params ourselves within
> those specific code blocks and otherwise the wrapper will no longer treat any
> param names specially. This will also require the move of ServletRequestUtils
> to the gateway-spi module.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
