[
https://issues.apache.org/jira/browse/KNOX-3424?focusedWorklogId=1039184&page=com.atlassian.jira.plugin.system.issuetabpanels:worklog-tabpanel#worklog-1039184
]
ASF GitHub Bot logged work on KNOX-3424:
----------------------------------------
Author: ASF GitHub Bot
Created on: 02/Sep/26 09:52
Start Date: 02/Sep/26 09:52
Worklog Time Spent: 10m
Work Description: smolnar82 opened a new pull request, #1373:
URL: https://github.com/apache/knox/pull/1373
[KNOX-3424](https://issues.apache.org/jira/browse/KNOX-3424) - Complete RFC
8707/8693 dynamic `resource`/`audience` handling in KNOXTOKEN and token exchange
## What changes were proposed in this pull request?
Follow-up to #1356, finishing the dynamic-audience work so Knox implements
both RFC 8707 (Resource Indicators) and RFC 8693 (Token Exchange) end to end.
Three self-contained commits:
1. **Replace the `audience` query param with a URL-validated `resource`
param.**
The KNOXTOKEN service now reads the per-request target via `resource`
instead of `audience`. Each value must be an absolute URI without a fragment
(RFC 8707 §2 / RFC 3986 §4.3); a value that is not a valid absolute URI, or
that carries a fragment, is rejected with `400 Bad Request` /
`INVALID_RESOURCE`. Repeated and comma-separated values are supported;
whitespace is trimmed. The pluggable audience validators (`static` /
`whitelist` / `passthrough`) are unchanged in behavior.
2. **Wire the RFC 8693 `resource`/`audience` body parameters into token
exchange.**
The JWTProvider's `TokenExchangeHandler` now parses the optional
`resource`/`audience` body params from the exchange request and conveys them to
the downstream KNOXTOKEN service via a new shared request attribute
(`CommonTokenConstants.REQUESTED_AUDIENCES_REQUEST_ATTR`), so they land in the
minted token's `aud` claim. `resource` values are URI-validated (malformed →
`invalid_target`); `audience` values are logical service names taken verbatim.
When present, the body values take precedence over the `resource` query
parameter.
2. **JSON-escape the caller-supplied `resource` value in the token error
body.**
The token-issuance error echoed the caller-supplied value back in a
hand-concatenated JSON body, so a value containing a `"` could break out of the
JSON string. The `{"error": ..., "code": ...}` body is now rendered through
`JsonUtils` (the same escaping the KNOX-3423/#1354 filter-layer error path
uses), keeping the existing `{error, code}` / `ErrorCode` shape.
Documentation in `knox-site/docs/config_knox_token.md` is updated to
describe the `resource` parameter, the absolute-URI requirement, and the RFC
8707 mapping into the `aud` claim.
## How was this patch tested?
Automated unit tests (all green, offline Maven build):
- `TokenExchangeHandlerTest` — 21 tests, including 8 new ones covering
`resource`/`audience` body-param parsing, comma-splitting, invalid-URI and
fragment rejection as `invalid_target`, empty-value rejection, and the no-param
case leaving the request attribute unset.
- `TokenServiceResourceTest` — 101 tests, including new coverage for the
`resource` query param, invalid-URI/fragment rejection, exchange-attribute
precedence over the query param, and a regression test asserting a `resource`
value containing double quotes yields a well-formed, parseable JSON error body
with the value round-tripped intact.
- `JWTFederationFilterTokenExchangeTest` — 56 tests, re-run to confirm no
regression on the broader exchange path.
Checkstyle passes with 0 violations across `gateway-spi`,
`gateway-provider-security-jwt`, and `gateway-service-knoxtoken`.
## Integration Tests
No new integration test was added: the change is an extension of the
existing token-exchange / dynamic-audience paths, which are covered
comprehensively at the unit level, and the KnoxIDF federation broker flow
(`test_knoxidf.py` / `test_knoxidf_federation.py`) already exercises the
token-exchange handler this PR modifies. Because commit 2 touches the
JWTProvider federation broker path, adding the **`test-federation`** label here
before pushing, so the Keycloak-backed E2E federation suite runs against these
changes.
Issue Time Tracking
-------------------
Worklog Id: (was: 1039184)
Time Spent: 1h 20m (was: 1h 10m)
> Dynamic audience handling in the KNOXTOKEN service
> --------------------------------------------------
>
> Key: KNOX-3424
> URL: https://issues.apache.org/jira/browse/KNOX-3424
> Project: Apache Knox
> Issue Type: Improvement
> Components: Server
> Affects Versions: 3.1.0
> Reporter: Tamás Hanicz
> Assignee: Tamás Hanicz
> Priority: Major
> Fix For: 3.1.0
>
> Time Spent: 1h 20m
> Remaining Estimate: 0h
>
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
