Sandor Molnar created KNOX-3460:
-----------------------------------
Summary: Audit all token-exchange flows including minted token
fields
Key: KNOX-3460
URL: https://issues.apache.org/jira/browse/KNOX-3460
Project: Apache Knox
Issue Type: Sub-task
Components: Server
Affects Versions: 3.1.0
Reporter: Sandor Molnar
Assignee: Sandor Molnar
Fix For: 3.1.0
Only the delegation policy decision is audited today (TokenExchangeHandler
success/failure inside the delegation branch). The same-subject exchange path
emits no TOKEN_EXCHANGE audit record at all (only the generic AUTHENTICATION
audit from the shared {{{}continueWithEstablishedSecurityContext{}}}).
Minted-token fields — jti, expiry, issued_subject — are unauditable from the
filter because they only exist after TokenResource mints the token, and
TokenResource has no auditing whatsoever today.
*Scope:*
# Audit all three exchange paths in the handler with the fields known pre-mint
(incl. same-subject).
# Add a TOKEN_EXCHANGE mint-time audit in TokenResource.getJWT() for
exchange-originated mints, emitting jti/expiry/issued_subject
*Explicitly out of scope:* auditing ordinary (non-exchange) token issuance.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
