[
https://issues.apache.org/jira/browse/KNOX-3432?focusedWorklogId=1039470&page=com.atlassian.jira.plugin.system.issuetabpanels:worklog-tabpanel#worklog-1039470
]
ASF GitHub Bot logged work on KNOX-3432:
----------------------------------------
Author: ASF GitHub Bot
Created on: 03/Sep/26 15:15
Start Date: 03/Sep/26 15:15
Worklog Time Spent: 10m
Work Description: smolnar82 opened a new pull request, #1376:
URL: https://github.com/apache/knox/pull/1376
[KNOX-3432](https://issues.apache.org/jira/browse/KNOX-3432) - Advertise RFC
8693 token-exchange grant type in KnoxIDF discovery metadata
## What changes were proposed in this pull request?
KnoxIDF supports OAuth 2.0 Token Exchange (RFC 8693), but its OIDC discovery
document (`.well-known/openid-configuration`) only listed `authorization_code`
and `refresh_token` in `grant_types_supported`. Per RFC 8414 §2 that field must
list every grant type the server supports, so a spec-compliant reader would
wrongly conclude token exchange is unavailable.
- Added `TOKEN_EXCHANGE_GRANT_TYPE =
"urn:ietf:params:oauth:grant-type:token-exchange"` to `KnoxIDFConstants` (RFC
8693 §2.1, IANA-registered). Intentionally duplicated from
`JWTFederationFilter.TOKEN_EXCHANGE` rather than shared; it's a fixed standard
identifier, and duplicating avoids a module dependency on the JWT federation
provider.
- `DiscoveryResource` now includes this value in `grant_types_supported`.
## How was this patch tested?
- Extended `DiscoveryResourceMetadataTest` to assert the discovery document
advertises all three grant types, including the token-exchange URN.
- `mvn -pl gateway-service-knoxidf test
-Dtest=DiscoveryResourceMetadataTest`: passes.
Issue Time Tracking
-------------------
Worklog Id: (was: 1039470)
Remaining Estimate: 0h
Time Spent: 10m
> In knoxidf, advertise token exchange in grant_types_supported
> -------------------------------------------------------------
>
> Key: KNOX-3432
> URL: https://issues.apache.org/jira/browse/KNOX-3432
> Project: Apache Knox
> Issue Type: Task
> Reporter: Harrison Sheinblatt
> Assignee: Sandor Molnar
> Priority: Major
> Time Spent: 10m
> Remaining Estimate: 0h
>
> RFC 8693 defines the grant type for token exchange,
> urn:ietf:params:oauth:grant-type:token-exchange, in section 2.1. RFC 8414
> defines the grant_types_supported fields in the metadata in section 2.
> Knoxidf currently sets this value in
> gateway-service-knoxidf/src/main/java/org/apache/knox/gateway/service/knoxidf/DiscoveryResource.java
> as
> ```
> config.put("grant_types_supported", new String[]\{KnoxIDFConstants.AUTH_CODE,
> KnoxIDFConstants.REFRESH_TOKEN});
> ```
> It does not list token exchange, and hence a reader of the metadata would
> believe that knoxidf does not support it, based on the spec.
> Given knoxidf does support it, the token exchange type should be added there.
> The value to add is "urn:ietf:params:oauth:grant-type:token-exchange".
> RFC 6749 §4.5 (Extension Grants) explains that extension grants need the full
> name, not the short name. RFC 8693 §2.1 defines the constant to use. It's
> registered in IANA OAuth Parameters registry. RFC 8414 §2 says the field is
> "a list of the OAuth 2.0 grant type values that this authorization server
> supports" — i.e., the same values used in the grant_type request parameter.
> The value is already in a constant in JWTFederationFilter. We must decide to
> duplicate it in KnoxIDFConstants for use here or reuse the constant. It's
> probably best to duplicate it – it's a standard so won't likely change.
>
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
