hsheinblatt commented on code in PR #1401:
URL: https://github.com/apache/knox/pull/1401#discussion_r4021516328
##########
gateway-service-knoxtoken/src/main/java/org/apache/knox/gateway/service/knoxtoken/TokenResource.java:
##########
@@ -1346,6 +1346,16 @@ void addClientDataToMap(String[] tokenClientData,
}
protected long getExpiry() {
+ // An upstream component (the RFC 8693 token-exchange path) may have
resolved an authoritative TTL
+ // from trusted, operator-configured delegation policy. When present it is
the expiry basis
+ // directly: it deliberately bypasses the topology knox.token.ttl upper
bound and the client-supplied
+ // lifespan clamp below, since the policy value is server-side state (a
peer of the topology config),
+ // not untrusted client input, and its purpose is longer-lived tokens for
headless/batch delegations.
+ final Object requestedTtlSec =
request.getAttribute(CommonTokenConstants.REQUESTED_TTL_REQUEST_ATTR);
Review Comment:
Maybe worth referring to the authoring bounds:
knox.delegation.max.token.ttl.sec defaults to 86400 sec (24 hours) and
knox.delegation.min.token.ttl.sec defaults to 60 sec.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
