hsheinblatt commented on code in PR #1400:
URL: https://github.com/apache/knox/pull/1400#discussion_r4021632965
##########
gateway-service-knoxtoken/src/main/java/org/apache/knox/gateway/service/knoxtoken/TokenResource.java:
##########
@@ -155,6 +155,8 @@ public class TokenResource {
private static final String KNOX_TOKEN_HARDCODED_CLAIM_MAPPINGS =
TOKEN_PARAM_PREFIX + "hardcoded.claim.mappings";
private static final String METADATA_QUERY_PARAM_PREFIX = "md_";
private static final String TOKEN_ENABLE_DELEGATED_AUTH = TOKEN_PARAM_PREFIX
+ "enable.delegated.auth";
+ static final String DELEGATION_MAX_ACTOR_CHAIN_DEPTH =
"delegation.max.actor.chain.depth";
+ static final int DELEGATION_MAX_ACTOR_CHAIN_DEPTH_DEFAULT = 10;
Review Comment:
See comment on jira for reasoning, but 10 is risky, I suggest 5 (allows for
most bespoke agentic flows), 3 (allows for standard agentic flows), or 1
(secure default, customers must set consciously to enable realistic agentic
flows).
##########
gateway-service-knoxtoken/src/main/java/org/apache/knox/gateway/service/knoxtoken/TokenResource.java:
##########
@@ -945,6 +972,11 @@ protected TokenResponseContext
getTokenResponse(UserContext context) {
} else {
response = new TokenResponseContext(null, null,
Response.serverError());
}
+ } catch (ActorChainDepthExceededException e) {
+ log.rejectedTokenExchange(e.getMessage());
Review Comment:
This doesn't seem like it is returned as an RFC 8693 compliant json
response. It may be OK since this enforcement is a necessary best practice, not
required by the spec, but I thought all failures for token exchange needed to
conform.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
