[
https://issues.apache.org/jira/browse/KNOX-3438?focusedWorklogId=1039925&page=com.atlassian.jira.plugin.system.issuetabpanels:worklog-tabpanel#worklog-1039925
]
ASF GitHub Bot logged work on KNOX-3438:
----------------------------------------
Author: ASF GitHub Bot
Created on: 07/Sep/26 10:17
Start Date: 07/Sep/26 10:17
Worklog Time Spent: 10m
Work Description: smolnar82 opened a new pull request, #1381:
URL: https://github.com/apache/knox/pull/1381
[KNOX-3438](https://issues.apache.org/jira/browse/KNOX-3438) - Address
review comments from delegation policy admin API
Follow-up #1379 (merged), addressing the review comments raised there in a
separate PR.
## What changes were proposed in this pull request?
- TTL bounds config: moved min/max token-TTL bounds from `GatewayConfig` to
topology `<param>` init-params on `DelegationPolicyResource` (defaults as code
constants), and fail fast in init() on a `non-numeric/non-positive` value or
`min > max` - matching the `TokenResource/KNOXTOKEN `convention.
- Bounds-check the fallback default: `init()` now validates the service's
gateway-wide default TTL (`DelegationPolicyService#getConfiguredTokenTtlSec`)
against `[min, max]` and fails fast, so policies stored without an explicit
`tokenTtlSec` can't yield an effective TTL outside the range the API enforces
for explicit values.
- Consistent timestamp clock source: `DelegationPolicyDatabase` now stamps
`updated_at` from the app clock (bound param) on update, matching how `INSERT`
writes `created_at`/`updated_at`, instead of a DB-side `CURRENT_TIMESTAMP` that
could read on a different clock/zone.
- Audit read endpoints: `list` and `getOne` now emit audit records under
`Action.ACCESS` (reads of who-can-impersonate-whom are sensitive), alongside
the existing mutating-endpoint audits.
## How was this patch tested?
- Existing + new unit tests: `DelegationPolicyResourceTest`,
`JdbcDelegationPolicyServiceTest`, `DelegationPolicySchemaTest`,
`DelegationPolicyServiceFactoryTest`; all passing.
- New tests: fail-fast on out-of-range configured default; read-endpoint
audit assertions (`Action.ACCESS`, `policy_listed/policy_read`); TTL bounds
read from init-params + fail-fast cases.
- `mvn checkstyle:check` (validate phase) clean on all touched modules.
## Integration Tests
No integration-test changes, these are behavior fixes to an existing
feature, fully covered by module unit tests.
Issue Time Tracking
-------------------
Worklog Id: (was: 1039925)
Time Spent: 50m (was: 40m)
> Delegation policy admin API for Knox IDF
> ----------------------------------------
>
> Key: KNOX-3438
> URL: https://issues.apache.org/jira/browse/KNOX-3438
> Project: Apache Knox
> Issue Type: Task
> Components: JWT
> Reporter: Harrison Sheinblatt
> Priority: Major
> Time Spent: 50m
> Remaining Estimate: 0h
>
> Implement the Admin API for managing delegation policies for knoxidf
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
