[
https://issues.apache.org/jira/browse/KNOX-3432?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Sandor Molnar reassigned KNOX-3432:
-----------------------------------
Assignee: Sandor Molnar
> In knoxidf, advertise token exchange in grant_types_supported
> -------------------------------------------------------------
>
> Key: KNOX-3432
> URL: https://issues.apache.org/jira/browse/KNOX-3432
> Project: Apache Knox
> Issue Type: Task
> Reporter: Harrison Sheinblatt
> Assignee: Sandor Molnar
> Priority: Major
>
> RFC 8693 defines the grant type for token exchange,
> urn:ietf:params:oauth:grant-type:token-exchange, in section 2.1. RFC 8414
> defines the grant_types_supported fields in the metadata in section 2.
> Knoxidf currently sets this value in
> gateway-service-knoxidf/src/main/java/org/apache/knox/gateway/service/knoxidf/DiscoveryResource.java
> as
> ```
> config.put("grant_types_supported", new String[]\{KnoxIDFConstants.AUTH_CODE,
> KnoxIDFConstants.REFRESH_TOKEN});
> ```
> It does not list token exchange, and hence a reader of the metadata would
> believe that knoxidf does not support it, based on the spec.
> Given knoxidf does support it, the token exchange type should be added there.
> The value to add is "urn:ietf:params:oauth:grant-type:token-exchange".
> RFC 6749 §4.5 (Extension Grants) explains that extension grants need the full
> name, not the short name. RFC 8693 §2.1 defines the constant to use. It's
> registered in IANA OAuth Parameters registry. RFC 8414 §2 says the field is
> "a list of the OAuth 2.0 grant type values that this authorization server
> supports" — i.e., the same values used in the grant_type request parameter.
> The value is already in a constant in JWTFederationFilter. We must decide to
> duplicate it in KnoxIDFConstants for use here or reuse the constant. It's
> probably best to duplicate it – it's a standard so won't likely change.
>
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
