hsheinblatt opened a new pull request, #1361:
URL: https://github.com/apache/knox/pull/1361
KNOX-3426 - Add DelegationPolicyService schema, interface, and JDBC
implementation
## What changes were proposed in this pull request?
This pull request adds the persistence layer for RFC 8693 delegation
policies in Knox IDF.
Delegation policies control which actors (external token issuers and service
accounts) are
authorized to perform cross-subject token exchange on behalf of specific
users or groups
and for specific resources and scopes.
A five-table schema is added to store policies: a core DELEGATION_REGISTRY
table keyed on
(actor_authority, actor_id) with an allow_headless_exchange flag and an
optional per-policy
token TTL; four child tables for per-user, per-group, per-resource, and
per-resource-scope
entries. Scopes are defined per resource rather than as a flat list, so a
policy can allow
different scopes for different target resources. A resource with no scope
entries means all
scopes are allowed for that resource.
The DelegationPolicyService gateway service interface is added to
gateway-spi, where it is
visible to the filter layer (gateway-provider-security-jwt) that will
enforce policies during
token exchange. The interface includes CRUD operations for policy lifecycle
management and an
evaluate() method that accepts a PolicyCheckRequest and returns a
PolicyDecision.
PolicyCheckRequest and PolicyDecision are also added to gateway-spi as the
inputs and outputs
of evaluate(). DelegationPolicy, the POJO representing a stored policy, is
also in gateway-spi
since it is returned by the CRUD methods on the same interface.
JdbcDelegationPolicyService, EmptyDelegationPolicyService,
DelegationPolicyServiceFactory,
and the DDL scripts for standard, Derby, and Oracle dialects are added to
gateway-server,
following the same structure used for JdbcTrustedOidcIssuerService. The
factory activates
the JDBC implementation when a KNOXIDF or KNOXIDF_ADMIN topology is
deployed, and falls back
to the empty stub otherwise.
The evaluate() implementation checks policies by field: user, groups,
headless exchange
flag, subject user list, resource, and per-resource scope. A resource with
no defined scopes is
treated as allowing any scope. canActFor.groups support is not yet
implemented; if a policy has
a non-empty groups list and the subject is not in the users list, evaluate()
returns a server
error rather than silently skipping the group check.
## How was this patch tested?
Schema tests verify that all three dialect DDL scripts create the five
tables cleanly on a
Derby in-memory database and that NOT NULL, DEFAULT, UNIQUE, and foreign key
constraints are
enforced. Default values (status='active', allow_headless_exchange=false,
token_ttl_sec=null)
are verified by inserting a row without those fields. Constraint violations
for missing required
fields and duplicate (actor_authority, actor_id) are confirmed.
CRUD lifecycle tests cover register, get, update (full overwrite), and
delete. Update is verified
to replace child rows completely: registering with two users and updating
with three different
users results in exactly three users, not five. Round-trip tests verify that
resourcePolicy
entries, including resources with empty scope sets (all-scopes-allowed), are
preserved across
register and get, with boundary cases for zero resources, one resource, and
multiple resources,
and for resources with no scopes, one scope, and multiple scopes.
evaluate() tests cover the authorized path (actor registered, subject in
users list, resource in
policy, scope in resource scopes), the all-scopes-allowed path (resource
present but no scope
rows), and all denial paths: actor not registered, subject not in users list
(with empty groups
list), both users and groups lists empty (deny - no open delegation),
resource not in policy,
scope not in resource scopes, and headless exchange denied by policy flag.
The not-yet-implemented
server error path is verified when a non-empty groups list is present and
the user check fails.
If no TTL is specified, the default is used, and if specified, the policy
value is used.
Factory tests confirm that the JDBC implementation is returned when KNOXIDF
or KNOXIDF_ADMIN is
deployed and that the empty stub is returned otherwise.
## Integration Tests
No integration tests are added in this pull request. They will be added once
the full delegation
enforcement flow is wired in a later task.
### Opt-in test suites (PR labels)
N/A
## UI changes
N/A
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
