[
https://issues.apache.org/jira/browse/KNOX-3410?focusedWorklogId=1035085&page=com.atlassian.jira.plugin.system.issuetabpanels:worklog-tabpanel#worklog-1035085
]
ASF GitHub Bot logged work on KNOX-3410:
----------------------------------------
Author: ASF GitHub Bot
Created on: 11/Aug/26 11:17
Start Date: 11/Aug/26 11:17
Worklog Time Spent: 10m
Work Description: smolnar82 commented on code in PR #1343:
URL: https://github.com/apache/knox/pull/1343#discussion_r3757428815
##########
gateway-service-knoxtoken/src/main/java/org/apache/knox/gateway/service/knoxtoken/TokenResource.java:
##########
@@ -785,13 +785,19 @@ private Response setTokenEnabledFlags(String tokenIds,
boolean enabled) {
private Response setTokenEnabledFlag(String tokenId, boolean enable, boolean
batch) {
String error = "";
ErrorCode errorCode = ErrorCode.UNKNOWN;
+ Response.Status errorStatus = Response.Status.BAD_REQUEST;
Review Comment:
I'd call it `responseStatus` (as it could be `OK`, which isn't an error).
##########
gateway-service-knoxtoken/src/main/java/org/apache/knox/gateway/service/knoxtoken/TokenResource.java:
##########
@@ -785,13 +785,19 @@ private Response setTokenEnabledFlags(String tokenIds,
boolean enabled) {
private Response setTokenEnabledFlag(String tokenId, boolean enable, boolean
batch) {
String error = "";
ErrorCode errorCode = ErrorCode.UNKNOWN;
+ Response.Status errorStatus = Response.Status.BAD_REQUEST;
if (tokenStateService == null) {
error = "Unable to " + (enable ? "enable" : "disable") + " tokens
because token management is not configured";
errorCode = ErrorCode.CONFIGURATION_ERROR;
} else {
try {
final TokenMetadata tokenMetadata =
tokenStateService.getTokenMetadata(tokenId);
- if (!batch && enable && tokenMetadata.isEnabled()) {
+ final String caller = SubjectUtils.getCurrentEffectivePrincipalName();
+ if (!(triesToRevokeOwnToken(tokenId, caller) ||
tokenRenewalOrRevocationAuthorized(caller))) {
Review Comment:
We may want to rename `tokenRenewalOrRevocationAuthorized` to something that
reflects these use cases too. Maybe `tokenStateChangeAuthorized`?
##########
gateway-service-knoxtoken/src/main/java/org/apache/knox/gateway/service/knoxtoken/TokenResource.java:
##########
@@ -785,13 +785,19 @@ private Response setTokenEnabledFlags(String tokenIds,
boolean enabled) {
private Response setTokenEnabledFlag(String tokenId, boolean enable, boolean
batch) {
String error = "";
ErrorCode errorCode = ErrorCode.UNKNOWN;
+ Response.Status errorStatus = Response.Status.BAD_REQUEST;
if (tokenStateService == null) {
error = "Unable to " + (enable ? "enable" : "disable") + " tokens
because token management is not configured";
errorCode = ErrorCode.CONFIGURATION_ERROR;
} else {
try {
final TokenMetadata tokenMetadata =
tokenStateService.getTokenMetadata(tokenId);
- if (!batch && enable && tokenMetadata.isEnabled()) {
+ final String caller = SubjectUtils.getCurrentEffectivePrincipalName();
+ if (!(triesToRevokeOwnToken(tokenId, caller) ||
tokenRenewalOrRevocationAuthorized(caller))) {
Review Comment:
The same goes for `triesToRevokeOwnToken`. It's no longer about revocation.
Issue Time Tracking
-------------------
Worklog Id: (was: 1035085)
Time Spent: 0.5h (was: 20m)
> KnoxToken enable/disable endpoints perform no caller authorization
> ------------------------------------------------------------------
>
> Key: KNOX-3410
> URL: https://issues.apache.org/jira/browse/KNOX-3410
> Project: Apache Knox
> Issue Type: Bug
> Components: Server
> Affects Versions: 2.1.0, 3.0.0
> Reporter: Tamás Hanicz
> Assignee: Tamás Hanicz
> Priority: Blocker
> Time Spent: 0.5h
> Remaining Estimate: 0h
>
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
