[
https://issues.apache.org/jira/browse/KNOX-3405?focusedWorklogId=1034996&page=com.atlassian.jira.plugin.system.issuetabpanels:worklog-tabpanel#worklog-1034996
]
ASF GitHub Bot logged work on KNOX-3405:
----------------------------------------
Author: ASF GitHub Bot
Created on: 11/Aug/26 06:44
Start Date: 11/Aug/26 06:44
Worklog Time Spent: 10m
Work Description: hsheinblatt opened a new pull request, #1342:
URL: https://github.com/apache/knox/pull/1342
KNOX-3405 - Extend JWTFederationFilter for dynamic JWKS and iss attribute on
token-exchange
## What changes were proposed in this pull request?
JWTFederationFilter and the base AbstractJWTFilter are modified to use
dynamically
discovered JWKS for validating token signatures for RFC 8693 token exchange.
AbstractJWTFilter.validateToken first checks if the issuer is an expected
issuer.
That is, defined in the static topology constant list of allowed issuers.
This is
the pre-existing path. If the token issuer is in the expected issuer list,
then the
logic is unchanged, the token validate proceeds as it had.
If the token issuer is not part of the expected list, then it is checked
against the
TrustedOIDCIssuer registry, if it's enabled. If it matches, then the JWKS
dynamically
discovered for that issuer is used to validate the token signature. The rest
of the token
validation is the same as for the existing case. That is, the other fields
like expiry and nbf
remain validated in the path with the same logic.
JWTFederationFilter was also modified to store the validated token's iss
claim as a request
attribute for downstream handlers.
Some RFC 8693 token exchange related constants were moved from
TokenExchangeHandler
to JWTFederationFilter so that the tests outside the package, namely
JWTFederationFilterTokenExchangeTest, can read the values.
## How was this patch tested?
Unit tests were added for the JWKS dynamic discovery for trusted OIDC
issuers paths.
These include success paths where the token signature is validated using the
dynamically
discovered JWKS and a similar test with both actor and subject tokens where
one is from
an issuer in the configured list and the other is discovered dynamically.
Negative tests
for invalid tokens are added to show that signature validation must pass,
and the same
checks conducted for the static issuer path is enforced in the dynamic
issuer path as well,
such as expiry and nbf. Tests are added for paths where the token issuer is
not in the
static list, but also not valid for dynamic discovery. These include an
unregistered issuer--
one not registered as a trusted OIDC issuer--, when the TrustedOIDCIssuer
service is not configured, and when the request is not a token exchange
request. Unit
tests were also added to show that token validation for an issuer that is
statically defined
will not fail over to a dynamically registered issuer path, the existing
logic is used when
the issuer is a statically defined issuer regardless of whether or not it's
also a dynamically
trusted issuer, a sanity that the new dynamic path is not called in a
successful
validation using the existing statically defined issuer path, and the logic
for a non-token
exchange request does not use the new path.
A unit test was added for the iss request claim added.
## Integration Tests
No integration tests were added. They will be once the full flow is
implemented.
## UI changes
N/A
Issue Time Tracking
-------------------
Worklog Id: (was: 1034996)
Time Spent: 0.5h (was: 20m)
> Extend JWTFederationFilter for dynamic JWKS and iss attribute on
> token-exchange
> -------------------------------------------------------------------------------
>
> Key: KNOX-3405
> URL: https://issues.apache.org/jira/browse/KNOX-3405
> Project: Apache Knox
> Issue Type: Task
> Components: JWT
> Reporter: Harrison Sheinblatt
> Assignee: Harrison Sheinblatt
> Priority: Major
> Time Spent: 0.5h
> Remaining Estimate: 0h
>
> Extend JWTFederationFilter in two ways: (1) store the validated token's iss
> claim as a request attribute for downstream handlers; and (2) for
> grant_type=token-exchange, when the static jwt.expected.issuer check fails,
> consult TrustedOidcIssuerService — calling resolveJwksUri() for dynamic-JWKS
> issuers, which in turn uses the OIDC discovery document cache.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
