smolnar82 opened a new pull request, #1400: URL: https://github.com/apache/knox/pull/1400
[KNOX-3458](https://issues.apache.org/jira/browse/KNOX-3458) - Enforce a maximum actor-chain depth ## What changes were proposed in this pull request? The RFC 8693 `act` claim chain was walked and rebuilt with no depth bound anywhere: `TokenUtils.extractActorChain()`, `addActorToChain()`, and `buildNestedActClaim()` all iterate unbounded, and `ActorChainPrincipalImpl` does no validation. A deeply nested `act` claim could therefore grow without limit across successive delegation exchanges. This PR adds a configurable upper bound on the actor chain depth and enforces it at the last point before a token is minted: - **New topology provider param `delegation.max.actor.chain.depth`** (default `10`), read in `TokenResource.init()`. Invalid or non-positive values log a warning and fall back to the default. - **Enforcement in `TokenResource.handleDelegatedAuthentication()`**, immediately after `TokenUtils.addActorToChain(...)` — the last chance before minting. If the resulting chain would exceed the configured maximum, the exchange is rejected with HTTP 400 and a new `ErrorCode.ACTOR_CHAIN_DEPTH_EXCEEDED(120)`, via the new `ActorChainDepthExceededException`. Only chain *growth* is bounded; an exchange that merely preserves an existing chain is not affected. - **Audit**: `TokenExchangeHandler.auditMessage()` previously listed `act_chain_depth` as a deliberately-omitted field. It is now emitted, recording the *incoming* delegation depth (`0` for headless exchanges, which drop the incoming chain). Enforcement itself stays downstream in `TokenResource`; the audited value gives visibility into how deep chains are getting. - Two new log messages (`actorChainDepthExceeded`, `rejectedTokenExchange`). ## How was this patch tested? Automated unit tests (all passing): - `TokenServiceResourceTest` — 4 new tests: - chain at exactly the max depth is allowed (resulting depth 10, default max 10 → 200); - chain that would exceed the max is rejected (resulting depth 11 → 400, body contains the "would exceed the configured maximum" message and code `120`); - a configured non-default max (`3`) is enforced; - an invalid config value falls back to the default of 10 rather than becoming unlimited. - `TokenExchangeHandlerTest` — 1 new test asserting `act_chain_depth=2` is audited for a 2-deep incoming chain, plus an assertion that `act_chain_depth=0` is audited when the subject token has no `act` claim. Both affected modules (`gateway-service-knoxtoken`, `gateway-provider-security-jwt`) compile cleanly and their targeted test classes pass. ## Integration Tests N/A -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
