Sandor Molnar created KNOX-3399:
-----------------------------------
Summary: RFC 8693 token exchange (handleTokenExchange) unreachable
for x-www-form-urlencoded POSTs
Key: KNOX-3399
URL: https://issues.apache.org/jira/browse/KNOX-3399
Project: Apache Knox
Issue Type: Bug
Components: Server
Affects Versions: 3.0.0
Reporter: Sandor Molnar
Assignee: Sandor Molnar
Fix For: 3.0.0
{{JWTFederationFilter.doFilter}} reads {{grant_type}} via {{getParameter}} on
the wrapped request. Form-encoded requests are wrapped in
{{UrlEncodedFormRequest}}, whose {{getParameter}} returns query-string values
only and ignores the body (by design). So for a standard RFC 8693 POST (grant +
tokens in the body), {{grant_type}} reads back {{null}}, the
{{handleTokenExchange}} branch is skipped, and the request falls through to the
single-token path - which validates only {{subject_token}} and silently ignores
{{actor_token}}.
*Impact:* the two-token OBO flow never runs over the normal content type. A
POST with *no* {{actor_token}} still returns 200:
{code}
$ curl -k -X POST
"https://localhost:8443/gateway/tokenexchange/knoxtoken/api/v2/token"; -H
"Content-Type: application/x-www-form-urlencoded" -d
"grant_type=urn:ietf:params:oauth:grant-type:token-exchange&subject_token=$SUBJECT_TOKEN"
{"access_token":"eyJqa3UiOi...","token_id":"e313ffbc-b27e-468e-a684-192b8939ca87","managed":"true","endpoint_public_cert":"MIIDZDE...ETTA="
{code}
*Evidence (remote debugger, on v3.0.0 branch):*
{{httpRequest.getParameter("grant_type") → null}} whereas
{{ServletRequestUtils.unwrapHttpServletRequest(request).getParameter("grant_type")
→ the expected URN}}.
*Fix direction:* in {{doFilter}}, read {{grant_type}} from the unwrapped
request (guard on absent Authorization header so proxied bodies aren't
consumed); read subject_token/actor_token from the unwrapped request in
{{handleTokenExchange}}; keep passing the wrapped request downstream. Add a
regression test in {{OAuthFlowsFederationFilterTest}} posting grant + both
tokens in the body (wrapped in {{UrlEncodedFormRequest}}).
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
