[
https://issues.apache.org/jira/browse/KNOX-3395?focusedWorklogId=1034724&page=com.atlassian.jira.plugin.system.issuetabpanels:worklog-tabpanel#worklog-1034724
]
ASF GitHub Bot logged work on KNOX-3395:
----------------------------------------
Author: ASF GitHub Bot
Created on: 10/Aug/26 10:03
Start Date: 10/Aug/26 10:03
Worklog Time Spent: 10m
Work Description: smolnar82 commented on code in PR #1325:
URL: https://github.com/apache/knox/pull/1325#discussion_r3748436525
##########
.github/workflows/build/gateway.sh:
##########
@@ -34,7 +34,9 @@ keytool -genkeypair -alias ldaps -keyalg RSA -keysize 2048 \
# 2) Store the keystore password under the alias the LDAP SSL config resolves.
/knox-runtime/bin/knoxcli.sh create-alias "$KEYSTORE_PASSWORD_ALIAS" --value
"$KEYSTORE_PASSWORD"
-# 3) Trust that certificate in the JVM default truststore (cacerts) so the
JNDI-based
+# 3) Provision the gateway-level JWK required for server-managed Knox token
state
+# (renew / revoke / enable / disable and JWTProvider enforcement).
+/knox-runtime/bin/knoxcli.sh generate-jwk --jwkAlg HS256 --saveAlias
knox.token.hash.key
Review Comment:
The comment change here is misleading. You removed the original
> Trust that certificate in the JVM default truststore (cacerts) so the
JNDI-based
Shiro LDAP realm accepts it. This is additive - it does not remove the
default CAs.
before the `keytool` command.
I thinks it should look like this:
> \# 3) Provision the gateway-level JWK required for server-managed Knox
token state (renew / revoke / enable / disable and JWTProvider enforcement).
/knox-runtime/bin/knoxcli.sh generate-jwk --jwkAlg HS256 --saveAlias
knox.token.hash.key
> \# 4) Trust that certificate in the JVM default truststore (cacerts) so
the JNDI-based
Shiro LDAP realm accepts it. This is additive - it does not remove the
default CAs.
keytool -exportcert -alias ldaps -rfc \
-keystore "$KEYSTORE" -storepass "$KEYSTORE_PASSWORD" -file
/tmp/ldaps-cert.pem
Issue Time Tracking
-------------------
Worklog Id: (was: 1034724)
Time Spent: 1h 20m (was: 1h 10m)
> Add KNOXTOKEN issuance and JWTProvider federation integration tests
> -------------------------------------------------------------------
>
> Key: KNOX-3395
> URL: https://issues.apache.org/jira/browse/KNOX-3395
> Project: Apache Knox
> Issue Type: Task
> Reporter: Raghav Maheshwari
> Priority: Major
> Time Spent: 1h 20m
> Remaining Estimate: 0h
>
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
