[jira] [Work logged] (KNOX-3424) Dynamic audience handling in the KNOXTOKEN service

[ASF GitHub Bot (Jira)]

     [ 
https://issues.apache.org/jira/browse/KNOX-3424?focusedWorklogId=1037714&page=com.atlassian.jira.plugin.system.issuetabpanels:worklog-tabpanel#worklog-1037714
 ]

ASF GitHub Bot logged work on KNOX-3424:
----------------------------------------

                Author: ASF GitHub Bot
            Created on: 25/Aug/26 08:21
            Start Date: 25/Aug/26 08:21
    Worklog Time Spent: 10m 
      Work Description: hanicz opened a new pull request, #1356:
URL: https://github.com/apache/knox/pull/1356

   [KNOX-3424](https://issues.apache.org/jira/browse/KNOX-3424) - Dynamic 
audience handling in the KNOXTOKEN service
   
   ## What changes were proposed in this pull request?
   
   Callers can now request a token's aud claim per request via an audience 
query parameter, validated against the existing `knox.token.audiences` 
whitelist to prevent audience/token spoofing.
   
   Behavior
   - No `audience` param → unchanged; the statically configured 
`knox.token.audiences` are used.
   - `audience` param + no whitelist configured → `400` (secure by default — 
nothing to validate against).
   - `audience` param + all values in the whitelist → only the requested 
audience(s) land in `aud`.
   - `audience` param + any value not whitelisted → `400`.
   - Multiple audiences allowed (comma-separated and/or repeated params); exact 
match only, whitespace trimmed.
   
   ## How was this patch tested?
   
   Unit tests, local tests
   
   ```
   curl -sku guest:guest-password -X GET \
     
"https://localhost:8443/gateway/tokenissuer/knoxtoken/api/v2/token?lifespan=P0DT1H0M&audience=test1";
   {
     "error": "No audiences are configured; cannot honor a requested audience.",
     "code": 100
   }
   ```
   
   ```
   curl -sku guest:guest-password -X GET \
     
"https://localhost:8443/gateway/tokenissuer/knoxtoken/api/v2/token?lifespan=P0DT1H0M";
 \
   | jq -r '.access_token' \
   | cut -d. -f2 \
   | { read p; pad=$(( (4 - ${#p} % 4) % 4 )); printf '%s%s' "$p" "$(printf 
'%*s' "$pad" '' | tr ' ' '=')" | tr '_-' '/+' | base64 -d; } \
   | jq '{aud}'
   {
     "aud": null
   }
   
   ```
   
   ```
   <param>
       <name>knox.token.audiences</name>
       <value>test1,test2</value>
   </param>
   ```
   
   ```
   curl -sku guest:guest-password -X GET \
     
"https://localhost:8443/gateway/tokenissuer/knoxtoken/api/v2/token?lifespan=P0DT1H0M";
 \
   | jq -r '.access_token' \
   | cut -d. -f2 \
   | { read p; pad=$(( (4 - ${#p} % 4) % 4 )); printf '%s%s' "$p" "$(printf 
'%*s' "$pad" '' | tr ' ' '=')" | tr '_-' '/+' | base64 -d; } \
   | jq '{aud}'
   {
     "aud": [
       "test1",
       "test2"
     ]
   }
   ```
   
   ```
   curl -sku guest:guest-password -X GET \
     
"https://localhost:8443/gateway/tokenissuer/knoxtoken/api/v2/token?lifespan=P0DT1H0M&audience=test1,test2";
 \
   | jq -r '.access_token' \
   | cut -d. -f2 \
   | { read p; pad=$(( (4 - ${#p} % 4) % 4 )); printf '%s%s' "$p" "$(printf 
'%*s' "$pad" '' | tr ' ' '=')" | tr '_-' '/+' | base64 -d; } \
   | jq '{aud}'
   {
     "aud": [
       "test1",
       "test2"
     ]
   }
   
   ```
   
   ```
   curl -sku guest:guest-password -X GET \
     
"https://localhost:8443/gateway/tokenissuer/knoxtoken/api/v2/token?lifespan=P0DT1H0M&audience=test1";
 \
   | jq -r '.access_token' \
   | cut -d. -f2 \
   | { read p; pad=$(( (4 - ${#p} % 4) % 4 )); printf '%s%s' "$p" "$(printf 
'%*s' "$pad" '' | tr ' ' '=')" | tr '_-' '/+' | base64 -d; } \
   | jq '{aud}'
   {
     "aud": "test1"
   }
   ```
   
   ```
   curl -sku guest:guest-password -X GET \
     
"https://localhost:8443/gateway/tokenissuer/knoxtoken/api/v2/token?lifespan=P0DT1H0M&audience=test1,bad";
   {
     "error": "The requested audience 'bad' is not allowed.",
     "code": 100
   }
   ```
   
   ```
   curl -sku guest:guest-password -X GET \
     
"https://localhost:8443/gateway/tokenissuer/knoxtoken/api/v2/token?lifespan=P0DT1H0M&audience=bad";
   {
     "error": "The requested audience 'bad' is not allowed.",
     "code": 100
   }
   ```
   
   ## Integration Tests
   N/A
   
   ## UI changes
   N/A
   




Issue Time Tracking
-------------------

            Worklog Id:     (was: 1037714)
    Remaining Estimate: 0h
            Time Spent: 10m

> Dynamic audience handling in the KNOXTOKEN service
> --------------------------------------------------
>
>                 Key: KNOX-3424
>                 URL: https://issues.apache.org/jira/browse/KNOX-3424
>             Project: Apache Knox
>          Issue Type: Improvement
>          Components: Server
>    Affects Versions: 3.0.0
>            Reporter: Tamás Hanicz
>            Assignee: Tamás Hanicz
>            Priority: Major
>          Time Spent: 10m
>  Remaining Estimate: 0h
>




--
This message was sent by Atlassian Jira
(v8.20.10#820010)