smolnar82 opened a new pull request, #1336: URL: https://github.com/apache/knox/pull/1336
[KNOX-3403](https://issues.apache.org/jira/browse/KNOX-3403) - Token exchange issues the wrong `sub` on non-server-managed topologies ## What changes were proposed in this pull request? When a token was issued under impersonation via an RFC 8693 token exchange (`subject_token` + `actor_token`) on a topology that is **not** server-managed, the issued JWT's `sub` was set to the **actor** (the primary principal / authenticated caller) instead of the **subject** (the impersonated end user) - so the token represented the acting party rather than the user, defeating the on-behalf-of semantics. (The `act` claim was already correct; only `sub` was wrong.) **Root cause:** `TokenResource.buildUserContext(...)` only replaced the default username (the primary principal, from `request.getUserPrincipal()`) with the impersonated principal inside an `if (tokenStateService != null)` block - i.e. only when the topology is server-managed. That gate predates token exchange and was intended only to guard *metadata* storage (`userName`/`createdBy` persisted to the token state service), not to control the issued token's `sub`. This PR moves the impersonation -> `userName` resolution out of that gate, so the issued token's `sub` is the effective (impersonated) identity whenever `SubjectUtils.isImpersonating(subject)` is true, independent of server-managed state. `createdBy` continues to be persisted only for managed tokens (`persistTokenDetails` already guards on `tokenStateService != null`, so computing it otherwise is harmless). The stale comment was updated. **Scope:** only the non-server-managed impersonation path changes. Traditional `doAs` was already correct (the identity-assertion request wrapper exposes the impersonated user via `getUserPrincipal()`), server-managed topologies are unchanged, and non-impersonating requests are unchanged. ## How was this patch tested? * Reproduced end-to-end on a live gateway: an RFC 8693 exchange on a non-server-managed topology returned `sub = <actor>` (wrong); the same exchange on a server-managed topology returned the correct `sub`, isolating the cause to this gate. * Added unit tests in `TokenServiceResourceTest`: * `testImpersonatedTokenSubjectOnNonServerManagedTopology`: non-server-managed + impersonation (actor `admin`, subject `bob`) asserts `sub == bob` and `act == { sub: admin }`. * `testNonImpersonatedTokenSubjectOnNonServerManagedTopology`: non-server-managed, no impersonation asserts `sub == <primary>` and no `act` claim (no regression). * Confirmed both new tests **fail without the fix** (`expected:<bob> but was:<alice>`) and pass with it; full `TokenServiceResourceTest` passes (73 tests) with 0 Checkstyle violations. ## Integration Tests N/A ## UI changes N/A -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
