smolnar82 commented on code in PR #1325:
URL: https://github.com/apache/knox/pull/1325#discussion_r3748436525
##########
.github/workflows/build/gateway.sh:
##########
@@ -34,7 +34,9 @@ keytool -genkeypair -alias ldaps -keyalg RSA -keysize 2048 \
# 2) Store the keystore password under the alias the LDAP SSL config resolves.
/knox-runtime/bin/knoxcli.sh create-alias "$KEYSTORE_PASSWORD_ALIAS" --value
"$KEYSTORE_PASSWORD"
-# 3) Trust that certificate in the JVM default truststore (cacerts) so the
JNDI-based
+# 3) Provision the gateway-level JWK required for server-managed Knox token
state
+# (renew / revoke / enable / disable and JWTProvider enforcement).
+/knox-runtime/bin/knoxcli.sh generate-jwk --jwkAlg HS256 --saveAlias
knox.token.hash.key
Review Comment:
The comment change here is misleading. Yuo removed the original
> Trust that certificate in the JVM default truststore (cacerts) so the
JNDI-based
Shiro LDAP realm accepts it. This is additive - it does not remove the
default CAs.
before the `keytool` command.
I thinks it should look like this:
> \# 3) Provision the gateway-level JWK required for server-managed Knox
token state (renew / revoke / enable / disable and JWTProvider enforcement).
/knox-runtime/bin/knoxcli.sh generate-jwk --jwkAlg HS256 --saveAlias
knox.token.hash.key
> \# 4) Trust that certificate in the JVM default truststore (cacerts) so
the JNDI-based
Shiro LDAP realm accepts it. This is additive - it does not remove the
default CAs.
keytool -exportcert -alias ldaps -rfc \
-keystore "$KEYSTORE" -storepass "$KEYSTORE_PASSWORD" -file
/tmp/ldaps-cert.pem
##########
.github/workflows/tests/test_knoxtoken_jwt.py:
##########
@@ -0,0 +1,292 @@
+# Licensed to the Apache Software Foundation (ASF) under one or more
+# contributor license agreements. See the NOTICE file distributed with
+# this work for additional information regarding copyright ownership.
+# The ASF licenses this file to you under the Apache License, Version 2.0
+# (the "License"); you may not use this file except in compliance with
+# the License. You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+"""End-to-end tests for KNOXTOKEN issuance, lifecycle, and JWTProvider
federation.
+
+These exercise the ``knoxtoken`` topology (JWTProvider federation) together
+with the KNOXTOKEN service exposed by the ``knoxldap`` topology:
+
+1. A JWT is minted from the KNOXTOKEN service using Basic auth (knoxldap).
+2. The resulting bearer token is presented to the JWTProvider-protected
+ ``knoxtoken`` topology, which must accept it and assert the caller's
+ identity.
+3. Lifecycle operations (renew / revoke / enable / disable) require
+ ``knox.token.exp.server-managed=true`` on both the issuing service and
+ the JWTProvider so that revocation and disablement are enforced at
+ federation time — not just acknowledged by the management API.
+
+No other suite issues Knox tokens or authenticates via JWTProvider, so this
+file does not overlap with the Basic-auth / preauth coverage elsewhere.
+"""
+
+import unittest
+
+from requests.auth import HTTPBasicAuth
+
+from common_utils import gateway_base_url, knox_delete, knox_get, knox_put
+
+
+class TestKnoxTokenJwt(unittest.TestCase):
+ """Mint a Knox JWT and use it against a JWTProvider-federated topology."""
+
+ def setUp(self):
+ self.base_url = gateway_base_url()
+ # KNOXTOKEN service lives in the knoxldap topology (Basic auth in
front).
+ self.token_url = self.base_url +
"gateway/knoxldap/knoxtoken/api/v1/token"
+ # Non-deprecated lifecycle paths (PUT renew / DELETE revoke).
+ self.token_v2_url = self.base_url +
"gateway/knoxldap/knoxtoken/api/v2/token"
+ # JWTProvider-protected auth service in the knoxtoken topology.
+ self.federated_pre_url = self.base_url +
"gateway/knoxtoken/auth/api/v1/pre"
+
+ self.guest_auth = HTTPBasicAuth("guest", "guest-password")
+ self.admin_auth = HTTPBasicAuth("admin", "admin-password")
+
+ def _issue_token(self, auth):
+ """Return the parsed JSON body of a freshly issued Knox token."""
+ response = knox_get(self.token_url, auth=auth)
+ self.assertEqual(
+ response.status_code,
+ 200,
+ msg=f"Token issuance failed: {response.status_code}
{response.text}",
+ )
+ payload = response.json()
+ self.assertIn("access_token", payload)
+ self.assertIn("token_id", payload)
+ return payload
+
+ def _federate(self, access_token):
+ """Present a bearer token to the JWTProvider-protected topology."""
+ return knox_get(
+ self.federated_pre_url,
+ headers={"Authorization": f"Bearer {access_token}"},
+ )
+
+ def _assert_federates(self, access_token, expected_username):
+ response = self._federate(access_token)
+ self.assertEqual(
+ response.status_code,
+ 200,
+ msg=f"JWT was not accepted: {response.status_code}
{response.text}",
+ )
+ self.assertEqual(
+ response.headers.get("x-knox-actor-username"),
+ expected_username,
+ )
+
+ def assert_federation_rejected(self, access_token):
Review Comment:
Every other helper in the class uses a `_` prefix (`_issue_token`,
`_federate`, `_assert_federates`). `assert_federation_rejected` is the only
exception; it'll also show up in test discovery frameworks as a test method
(they scan for names starting with `assert`). Please rename to
`_assert_federation_rejected`.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
