Harrison Sheinblatt created KNOX-3432:
-----------------------------------------
Summary: In knoxidf, advertise token exchange in
grant_types_supported
Key: KNOX-3432
URL: https://issues.apache.org/jira/browse/KNOX-3432
Project: Apache Knox
Issue Type: Task
Reporter: Harrison Sheinblatt
RFC 8693 defines the grant type for token exchange,
urn:ietf:params:oauth:grant-type:token-exchange, in section 2.1. RFC 8414
defines the grant_types_supported fields in the metadata in section 2.
Knoxidf currently sets this value in
gateway-service-knoxidf/src/main/java/org/apache/knox/gateway/service/knoxidf/DiscoveryResource.java
as
```
config.put("grant_types_supported", new String[]\{KnoxIDFConstants.AUTH_CODE,
KnoxIDFConstants.REFRESH_TOKEN});
```
It does not list token exchange, and hence a reader of the metadata would
believe that knoxidf does not support it, based on the spec.
Given knoxidf does support it, the token exchange type should be added there.
The value to add is "urn:ietf:params:oauth:grant-type:token-exchange".
RFC 6749 §4.5 (Extension Grants) explains that extension grants need the full
name, not the short name. RFC 8693 §2.1 defines the constant to use. It's
registered in IANA OAuth Parameters registry. RFC 8414 §2 says the field is "a
list of the OAuth 2.0 grant type values that this authorization server
supports" — i.e., the same values used in the grant_type request parameter.
The value is already in a constant in JWTFederationFilter. We must decide to
duplicate it in KnoxIDFConstants for use here or reuse the constant. It's
probably best to duplicate it – it's a standard so won't likely change.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
