lmccay opened a new pull request, #1262: URL: https://github.com/apache/knox/pull/1262
[KNOX-1234](https://issues.apache.org/jira/browse/KNOX-3347) - Introduce TokenExchangePrincipal for extending Act claim for token_exchange ## What changes were proposed in this pull request? Currently, the ActorChainPrincipal includes whatever act chain was in the Subject token from the token_exchange. The presence of the ImpersonatedPrincipal is currently only added by the identity assertion provider based on a doAs and proxyuser based impersonation. This is required for the new actor to be added to the nested 'act' claim. Let's add the use of the TokenExchangePrincipal by the identity assertion logic that sets the ImpersonatedPrincipal in addition to the doAs pattern. We also have to keep the existing principal mapping logic intact so that the token exchange reflects the mapped principal as appropriate even when not the principal requested in the token_exchange request. Also, be sure that the actor token is being properly validated. ## How was this patch tested? Existing tests run and new tests added. Manually tested as well. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
