[
https://issues.apache.org/jira/browse/KNOX-3459?focusedWorklogId=1041684&page=com.atlassian.jira.plugin.system.issuetabpanels:worklog-tabpanel#worklog-1041684
]
ASF GitHub Bot logged work on KNOX-3459:
----------------------------------------
Author: ASF GitHub Bot
Created on: 15/Sep/26 13:36
Start Date: 15/Sep/26 13:36
Worklog Time Spent: 10m
Work Description: github-actions[bot] commented on PR #1401:
URL: https://github.com/apache/knox/pull/1401#issuecomment-5681100155
## Test Results
4 files 4 suites 1m 48s ⏱️
87 tests 87 ✅ 0 💤 0 ❌
105 runs 105 ✅ 0 💤 0 ❌
Results for commit e7dfd649.
[test-results]:data:application/gzip;base64,H4sIAOFJqWoC/12MSw7CIBQAr9KwdgEVCngZQ3mPhNiP4bNqvLtI2oouZyaZjTg/YSS3jl86ErNPJ0AOJvl1KcioKqKk9IlKHnCP2do/8/DPYugpnPHTj8AQ1rCbkJdY/2KH49ia77FyM6zc/uw6zz4VICjBwcA14FUp6EeJTNjeAGdiGIEKh9KA1kheb+ZT6KMDAQAA
Issue Time Tracking
-------------------
Worklog Id: (was: 1041684)
Time Spent: 0.5h (was: 20m)
> Honor delegation policy tokenTtlSec override when minting exchanged tokens
> --------------------------------------------------------------------------
>
> Key: KNOX-3459
> URL: https://issues.apache.org/jira/browse/KNOX-3459
> Project: Apache Knox
> Issue Type: Sub-task
> Components: Server
> Affects Versions: 3.1.0
> Reporter: Sandor Molnar
> Assignee: Sandor Molnar
> Priority: Major
> Fix For: 3.1.0
>
> Time Spent: 0.5h
> Remaining Estimate: 0h
>
> {{PolicyDecision.getEffectiveTtlSec() }}is already computed by
> J{{{}dbcDelegationPolicyService.evaluate(){}}} (from
> {{DelegationPolicy.getTokenTtlSec(),}} falling back to the configured
> default), but it is silently discarded: TokenExchangeHandler reads only
> {{{}getDenyReason(){}}}. The per-policy TTL therefore has no effect on the
> minted token's lifetime.
> {*}Scope{*}: plumb the effective TTL to KNOXTOKEN, mirroring the existing
> audience passthrough: add a request-attribute constant to
> {{CommonTokenConstants}} (e.g. {{{}REQUESTED_TTL_REQUEST_ATTR{}}}), set it in
> {{TokenExchangeHandler}} from {{{}policyDecision.getEffectiveTtlSec(){}}},
> and consume it in T{{{}okenResource.getExpiry(){}}} (which today only honors
> the lifespan param and the topology {{knox.token.ttl }}cap).
> The policy TTL is authoritative: for exchange-originated mints it becomes the
> expiry basis directly and must bypass the topology {{knox.token.ttl}}
> upper-bound / lifespan clamp in {{{}getExpiry(){}}}, rather than flow through
> it.
> Rationale: {{DelegationPolicy.tokenTtlSec}} is trusted, operator-configured
> server-side state (a peer of the topology config, not untrusted client input
> like lifespan), and its main use case - longer-lived tokens for
> headless/batch delegations - is impossible if capped by the topology default
> (which would also make it redundant with the existing lifespan shorten-only
> behavior). The effective TTL fallback is already resolved upstream
> ({{{}evaluate(){}}} sets {{effectiveTtlSec}} to {{policy.getTokenTtlSec()}}
> or {{{}config.getDelegationServiceTokenTtlSec(){}}}), so {{TokenResource}}
> simply honors the value it receives.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
