hsheinblatt opened a new pull request, #1339: URL: https://github.com/apache/knox/pull/1339
KNOX-3408 - Allow no actor token in JWTFederationFilter.handleTokenExchange ## What changes were proposed in this pull request? RFC 8693 requires that the actor token be optional for token exchange. Change the handleTokenExchange method to allow a missing actor token. When actor_token is absent, the Subject has the subject from the subject token as PrimaryPrincipal with no TokenExchangePrincipal. Note that headless delegation using ImpersonatedPrincipal is currently not represented in this path. ## How was this patch tested? A unit test for the new path is added. Regression tests for subject handling in JWTFederationFilter.handleTokenExchange and TokenExchangePrincipal handling in AbstractIdentityAssertionFilter.continueChainAsPrincipal handling were also added and run before the feature change to show no regression. ## Integration Tests N/A -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
