[
https://issues.apache.org/jira/browse/KNOX-3424?focusedWorklogId=1039348&page=com.atlassian.jira.plugin.system.issuetabpanels:worklog-tabpanel#worklog-1039348
]
ASF GitHub Bot logged work on KNOX-3424:
----------------------------------------
Author: ASF GitHub Bot
Created on: 03/Sep/26 05:03
Start Date: 03/Sep/26 05:03
Worklog Time Spent: 10m
Work Description: smolnar82 commented on code in PR #1373:
URL: https://github.com/apache/knox/pull/1373#discussion_r3921217352
##########
gateway-service-knoxtoken/src/main/java/org/apache/knox/gateway/service/knoxtoken/TokenResource.java:
##########
@@ -1163,26 +1168,65 @@ public ResponseMap(String accessToken, String tokenId,
Map<String, Object> map,
}
}
- private List<String> parseRequestedAudiences() {
+ private List<String> parseRequestedResources() throws
RequestedAudienceValidationException {
+ // An RFC 8693 token-exchange request carries the requested
resource/audience in the form body,
+ // which the JWTProvider's TokenExchangeHandler has already parsed and
validated and stashed as a
+ // request attribute. When present, those body-supplied values take
precedence over the resource
+ // query parameter.
+ @SuppressWarnings("unchecked")
+ final List<String> fromExchange =
+ (List<String>)
request.getAttribute(CommonTokenConstants.REQUESTED_AUDIENCES_REQUEST_ATTR);
+ if (fromExchange != null) {
+ return fromExchange;
+ }
Review Comment:
The leak is really the _naming_, not the _mechanism_. I'll rename the
attribute to a generic `knox.token.requested.audiences` and reword the
docs/comment so TokenResource only knows "an upstream filter may have
pre-resolved the requested audiences; use them over the query param" — no RFC
8693 / exchange references. The exchange specifics stay entirely in
TokenExchangeHandler.
What do you think?
Issue Time Tracking
-------------------
Worklog Id: (was: 1039348)
Time Spent: 2h (was: 1h 50m)
> Dynamic audience handling in the KNOXTOKEN service
> --------------------------------------------------
>
> Key: KNOX-3424
> URL: https://issues.apache.org/jira/browse/KNOX-3424
> Project: Apache Knox
> Issue Type: Improvement
> Components: Server
> Affects Versions: 3.1.0
> Reporter: Tamás Hanicz
> Assignee: Tamás Hanicz
> Priority: Major
> Fix For: 3.1.0
>
> Time Spent: 2h
> Remaining Estimate: 0h
>
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
