[
https://issues.apache.org/jira/browse/KNOX-3399?focusedWorklogId=1033062&page=com.atlassian.jira.plugin.system.issuetabpanels:worklog-tabpanel#worklog-1033062
]
ASF GitHub Bot logged work on KNOX-3399:
----------------------------------------
Author: ASF GitHub Bot
Created on: 30/Jul/26 14:34
Start Date: 30/Jul/26 14:34
Worklog Time Spent: 10m
Work Description: smolnar82 merged PR #1334:
URL: https://github.com/apache/knox/pull/1334
Issue Time Tracking
-------------------
Worklog Id: (was: 1033062)
Time Spent: 0.5h (was: 20m)
> RFC 8693 token exchange (handleTokenExchange) unreachable for
> x-www-form-urlencoded POSTs
> -----------------------------------------------------------------------------------------
>
> Key: KNOX-3399
> URL: https://issues.apache.org/jira/browse/KNOX-3399
> Project: Apache Knox
> Issue Type: Bug
> Components: Server
> Affects Versions: 3.0.0
> Reporter: Sandor Molnar
> Assignee: Sandor Molnar
> Priority: Major
> Fix For: 3.0.0
>
> Time Spent: 0.5h
> Remaining Estimate: 0h
>
> {{JWTFederationFilter.doFilter}} reads {{grant_type}} via {{getParameter}} on
> the wrapped request. Form-encoded requests are wrapped in
> {{UrlEncodedFormRequest}}, whose {{getParameter}} returns query-string values
> only and ignores the body (by design). So for a standard RFC 8693 POST (grant
> + tokens in the body), {{grant_type}} reads back {{null}}, the
> {{handleTokenExchange}} branch is skipped, and the request falls through to
> the single-token path - which validates only {{subject_token}} and silently
> ignores {{actor_token}}.
> *Impact:* the two-token OBO flow never runs over the normal content type. A
> POST with *no* {{actor_token}} still returns 200:
> {code}
> $ curl -k -X POST
> "https://localhost:8443/gateway/tokenexchange/knoxtoken/api/v2/token"; -H
> "Content-Type: application/x-www-form-urlencoded" -d
> "grant_type=urn:ietf:params:oauth:grant-type:token-exchange&subject_token=$SUBJECT_TOKEN"
> {"access_token":"eyJqa3UiOi...","token_id":"e313ffbc-b27e-468e-a684-192b8939ca87","managed":"true","endpoint_public_cert":"MIIDZDE...ETTA="
> {code}
> *Evidence (remote debugger, on v3.0.0 branch):*
> {{httpRequest.getParameter("grant_type") → null}} whereas
> {{ServletRequestUtils.unwrapHttpServletRequest(request).getParameter("grant_type")
> → the expected URN}}.
> *Fix direction:* in {{doFilter}}, read {{grant_type}} from the unwrapped
> request (guard on absent Authorization header so proxied bodies aren't
> consumed); read subject_token/actor_token from the unwrapped request in
> {{handleTokenExchange}}; keep passing the wrapped request downstream. Add a
> regression test in {{OAuthFlowsFederationFilterTest}} posting grant + both
> tokens in the body (wrapped in {{UrlEncodedFormRequest}}).
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
