hanicz commented on PR #1354: URL: https://github.com/apache/knox/pull/1354#issuecomment-5422397265
> Thanks Tamás. LGTM. I think a couple of the error types might be incorrect, and there may be a missing test -- see comments -- but looks to make it spec compliant. I made some changes to address your comments. `TokenExchangeHandler`: I switched `unsupported_token_type` to `invalid_request`. Catch block emits `invalid_request` as well now. `TokenExchangeHandlerTest`: Added the missing test for the catch block. As per [RFC 8693 §2.2.2](https://datatracker.ietf.org/doc/html/rfc8693#section-2.2.2): If the request itself is not valid or if either the subject_token or actor_token are invalid for any reason, or are unacceptable based on policy, the authorization server MUST construct an error response, as specified in [Section 5.2](https://www.rfc-editor.org/rfc/rfc6749#section-5.2) of [[RFC6749](https://datatracker.ietf.org/doc/html/rfc6749)]. The value of the error parameter MUST be the invalid_request error code. Due to the above `JWTFederationFilter` will send `invalid_request` for nbf/audience expiry/signature/parse. `invalid_grant` remains in KnoxIDF `authorization`/`refresh_token` grant paths -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
