hanicz opened a new pull request, #1356: URL: https://github.com/apache/knox/pull/1356
[KNOX-3424](https://issues.apache.org/jira/browse/KNOX-3424) - Dynamic audience handling in the KNOXTOKEN service ## What changes were proposed in this pull request? Callers can now request a token's aud claim per request via an audience query parameter, validated against the existing `knox.token.audiences` whitelist to prevent audience/token spoofing. Behavior - No `audience` param → unchanged; the statically configured `knox.token.audiences` are used. - `audience` param + no whitelist configured → `400` (secure by default — nothing to validate against). - `audience` param + all values in the whitelist → only the requested audience(s) land in `aud`. - `audience` param + any value not whitelisted → `400`. - Multiple audiences allowed (comma-separated and/or repeated params); exact match only, whitespace trimmed. ## How was this patch tested? Unit tests, local tests ``` curl -sku guest:guest-password -X GET \ "https://localhost:8443/gateway/tokenissuer/knoxtoken/api/v2/token?lifespan=P0DT1H0M&audience=test1"; { "error": "No audiences are configured; cannot honor a requested audience.", "code": 100 } ``` ``` curl -sku guest:guest-password -X GET \ "https://localhost:8443/gateway/tokenissuer/knoxtoken/api/v2/token?lifespan=P0DT1H0M"; \ | jq -r '.access_token' \ | cut -d. -f2 \ | { read p; pad=$(( (4 - ${#p} % 4) % 4 )); printf '%s%s' "$p" "$(printf '%*s' "$pad" '' | tr ' ' '=')" | tr '_-' '/+' | base64 -d; } \ | jq '{aud}' { "aud": null } ``` ``` <param> <name>knox.token.audiences</name> <value>test1,test2</value> </param> ``` ``` curl -sku guest:guest-password -X GET \ "https://localhost:8443/gateway/tokenissuer/knoxtoken/api/v2/token?lifespan=P0DT1H0M"; \ | jq -r '.access_token' \ | cut -d. -f2 \ | { read p; pad=$(( (4 - ${#p} % 4) % 4 )); printf '%s%s' "$p" "$(printf '%*s' "$pad" '' | tr ' ' '=')" | tr '_-' '/+' | base64 -d; } \ | jq '{aud}' { "aud": [ "test1", "test2" ] } ``` ``` curl -sku guest:guest-password -X GET \ "https://localhost:8443/gateway/tokenissuer/knoxtoken/api/v2/token?lifespan=P0DT1H0M&audience=test1,test2"; \ | jq -r '.access_token' \ | cut -d. -f2 \ | { read p; pad=$(( (4 - ${#p} % 4) % 4 )); printf '%s%s' "$p" "$(printf '%*s' "$pad" '' | tr ' ' '=')" | tr '_-' '/+' | base64 -d; } \ | jq '{aud}' { "aud": [ "test1", "test2" ] } ``` ``` curl -sku guest:guest-password -X GET \ "https://localhost:8443/gateway/tokenissuer/knoxtoken/api/v2/token?lifespan=P0DT1H0M&audience=test1"; \ | jq -r '.access_token' \ | cut -d. -f2 \ | { read p; pad=$(( (4 - ${#p} % 4) % 4 )); printf '%s%s' "$p" "$(printf '%*s' "$pad" '' | tr ' ' '=')" | tr '_-' '/+' | base64 -d; } \ | jq '{aud}' { "aud": "test1" } ``` ``` curl -sku guest:guest-password -X GET \ "https://localhost:8443/gateway/tokenissuer/knoxtoken/api/v2/token?lifespan=P0DT1H0M&audience=test1,bad"; { "error": "The requested audience 'bad' is not allowed.", "code": 100 } ``` ``` curl -sku guest:guest-password -X GET \ "https://localhost:8443/gateway/tokenissuer/knoxtoken/api/v2/token?lifespan=P0DT1H0M&audience=bad"; { "error": "The requested audience 'bad' is not allowed.", "code": 100 } ``` ## Integration Tests N/A ## UI changes N/A -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
