[
https://issues.apache.org/jira/browse/KNOX-3459?focusedWorklogId=1041839&page=com.atlassian.jira.plugin.system.issuetabpanels:worklog-tabpanel#worklog-1041839
]
ASF GitHub Bot logged work on KNOX-3459:
----------------------------------------
Author: ASF GitHub Bot
Created on: 16/Sep/26 00:46
Start Date: 16/Sep/26 00:46
Worklog Time Spent: 10m
Work Description: hsheinblatt commented on code in PR #1401:
URL: https://github.com/apache/knox/pull/1401#discussion_r4021516328
##########
gateway-service-knoxtoken/src/main/java/org/apache/knox/gateway/service/knoxtoken/TokenResource.java:
##########
@@ -1346,6 +1346,16 @@ void addClientDataToMap(String[] tokenClientData,
}
protected long getExpiry() {
+ // An upstream component (the RFC 8693 token-exchange path) may have
resolved an authoritative TTL
+ // from trusted, operator-configured delegation policy. When present it is
the expiry basis
+ // directly: it deliberately bypasses the topology knox.token.ttl upper
bound and the client-supplied
+ // lifespan clamp below, since the policy value is server-side state (a
peer of the topology config),
+ // not untrusted client input, and its purpose is longer-lived tokens for
headless/batch delegations.
+ final Object requestedTtlSec =
request.getAttribute(CommonTokenConstants.REQUESTED_TTL_REQUEST_ATTR);
Review Comment:
Maybe worth referring to the authoring bounds:
knox.delegation.max.token.ttl.sec defaults to 86400 sec (24 hours) and
knox.delegation.min.token.ttl.sec defaults to 60 sec.
Issue Time Tracking
-------------------
Worklog Id: (was: 1041839)
Time Spent: 40m (was: 0.5h)
> Honor delegation policy tokenTtlSec override when minting exchanged tokens
> --------------------------------------------------------------------------
>
> Key: KNOX-3459
> URL: https://issues.apache.org/jira/browse/KNOX-3459
> Project: Apache Knox
> Issue Type: Sub-task
> Components: Server
> Affects Versions: 3.1.0
> Reporter: Sandor Molnar
> Assignee: Sandor Molnar
> Priority: Major
> Fix For: 3.1.0
>
> Time Spent: 40m
> Remaining Estimate: 0h
>
> {{PolicyDecision.getEffectiveTtlSec() }}is already computed by
> J{{{}dbcDelegationPolicyService.evaluate(){}}} (from
> {{DelegationPolicy.getTokenTtlSec(),}} falling back to the configured
> default), but it is silently discarded: TokenExchangeHandler reads only
> {{{}getDenyReason(){}}}. The per-policy TTL therefore has no effect on the
> minted token's lifetime.
> {*}Scope{*}: plumb the effective TTL to KNOXTOKEN, mirroring the existing
> audience passthrough: add a request-attribute constant to
> {{CommonTokenConstants}} (e.g. {{{}REQUESTED_TTL_REQUEST_ATTR{}}}), set it in
> {{TokenExchangeHandler}} from {{{}policyDecision.getEffectiveTtlSec(){}}},
> and consume it in T{{{}okenResource.getExpiry(){}}} (which today only honors
> the lifespan param and the topology {{knox.token.ttl }}cap).
> The policy TTL is authoritative: for exchange-originated mints it becomes the
> expiry basis directly and must bypass the topology {{knox.token.ttl}}
> upper-bound / lifespan clamp in {{{}getExpiry(){}}}, rather than flow through
> it.
> Rationale: {{DelegationPolicy.tokenTtlSec}} is trusted, operator-configured
> server-side state (a peer of the topology config, not untrusted client input
> like lifespan), and its main use case - longer-lived tokens for
> headless/batch delegations - is impossible if capped by the topology default
> (which would also make it redundant with the existing lifespan shorten-only
> behavior). The effective TTL fallback is already resolved upstream
> ({{{}evaluate(){}}} sets {{effectiveTtlSec}} to {{policy.getTokenTtlSec()}}
> or {{{}config.getDelegationServiceTokenTtlSec(){}}}), so {{TokenResource}}
> simply honors the value it receives.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
