[
https://issues.apache.org/jira/browse/KNOX-3458?focusedWorklogId=1041662&page=com.atlassian.jira.plugin.system.issuetabpanels:worklog-tabpanel#worklog-1041662
]
ASF GitHub Bot logged work on KNOX-3458:
----------------------------------------
Author: ASF GitHub Bot
Created on: 15/Sep/26 12:46
Start Date: 15/Sep/26 12:46
Worklog Time Spent: 10m
Work Description: smolnar82 opened a new pull request, #1400:
URL: https://github.com/apache/knox/pull/1400
[KNOX-3458](https://issues.apache.org/jira/browse/KNOX-3458) - Enforce a
maximum actor-chain depth
## What changes were proposed in this pull request?
The RFC 8693 `act` claim chain was walked and rebuilt with no depth bound
anywhere:
`TokenUtils.extractActorChain()`, `addActorToChain()`, and
`buildNestedActClaim()` all
iterate unbounded, and `ActorChainPrincipalImpl` does no validation. A
deeply nested
`act` claim could therefore grow without limit across successive delegation
exchanges.
This PR adds a configurable upper bound on the actor chain depth and
enforces it at the
last point before a token is minted:
- **New topology provider param `delegation.max.actor.chain.depth`**
(default `10`), read in `TokenResource.init()`. Invalid or non-positive values
log a warning and fall back to the default.
- **Enforcement in `TokenResource.handleDelegatedAuthentication()`**,
immediately after `TokenUtils.addActorToChain(...)` — the last chance before
minting. If the resulting chain would exceed the configured maximum, the
exchange is rejected with HTTP 400 and a new
`ErrorCode.ACTOR_CHAIN_DEPTH_EXCEEDED(120)`, via the new
`ActorChainDepthExceededException`. Only chain *growth* is bounded; an exchange
that merely preserves an existing chain is not affected.
- **Audit**: `TokenExchangeHandler.auditMessage()` previously listed
`act_chain_depth` as a deliberately-omitted field. It is now emitted, recording
the *incoming* delegation depth (`0` for headless exchanges, which drop the
incoming chain). Enforcement itself stays downstream in `TokenResource`; the
audited value gives visibility into how deep chains are getting.
- Two new log messages (`actorChainDepthExceeded`, `rejectedTokenExchange`).
## How was this patch tested?
Automated unit tests (all passing):
- `TokenServiceResourceTest` — 4 new tests:
- chain at exactly the max depth is allowed (resulting depth 10, default
max 10 → 200);
- chain that would exceed the max is rejected (resulting depth 11 → 400,
body contains
the "would exceed the configured maximum" message and code `120`);
- a configured non-default max (`3`) is enforced;
- an invalid config value falls back to the default of 10 rather than
becoming unlimited.
- `TokenExchangeHandlerTest` — 1 new test asserting `act_chain_depth=2` is
audited for a
2-deep incoming chain, plus an assertion that `act_chain_depth=0` is
audited when the
subject token has no `act` claim.
Both affected modules (`gateway-service-knoxtoken`,
`gateway-provider-security-jwt`)
compile cleanly and their targeted test classes pass.
## Integration Tests
N/A
Issue Time Tracking
-------------------
Worklog Id: (was: 1041662)
Remaining Estimate: 0h
Time Spent: 10m
> Enforce a maximum actor-chain (act claim) depth in token exchange
> -----------------------------------------------------------------
>
> Key: KNOX-3458
> URL: https://issues.apache.org/jira/browse/KNOX-3458
> Project: Apache Knox
> Issue Type: Sub-task
> Components: Server
> Affects Versions: 3.1.0
> Reporter: Sandor Molnar
> Assignee: Sandor Molnar
> Priority: Major
> Fix For: 3.1.0
>
> Time Spent: 10m
> Remaining Estimate: 0h
>
> The RFC 8693 act claim chain is walked and rebuilt with no depth bound
> anywhere: {{TokenUtils.extractActorChain()}}, {{addActorToChain()}}, and
> {{buildNestedActClaim()}} all iterate unbounded, and
> {{ActorChainPrincipalImpl}} does no validation. A deeply nested act claim can
> grow without limit across successive delegation exchanges.
> Scope: Add a configurable maximum chain depth (e.g.
> {{delegation.max.actor.chain.depth}}) and enforce it at the point the chain
> is about to grow - TokenResource.handleDelegatedAuthentication() /
> TokenUtils.addActorToChain() (last chance before minting), rejecting the
> exchange when the resulting depth would exceed the bound. Default to 10.
> Note: {{TokenExchangeHandler.auditMessage()}} already lists
> {{act_chain_depth}} as a deliberately-omitted field. Audit it once enforced.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
