smolnar82 opened a new pull request, #1405: URL: https://github.com/apache/knox/pull/1405
[KNOX-3461](https://issues.apache.org/jira/browse/KNOX-3461) - Authorize same-subject requested audience in RFC 8693 token exchange ## What changes were proposed in this pull request? Sub-task of KNOX-3441. When delegation is enabled, operators set the KNOXTOKEN audience validator to `passthrough` so the delegation policy authorizes requested audiences instead of a fixed list. But the delegation policy is only consulted for *delegation* exchanges, `same-subject` exchanges skip it entirely while still conveying the requested audience downstream. Under `passthrough` that let a same-subject caller request any audience with no authorization at all. This adds a new topology provider flag `delegation.same.subject.requested.audience.enabled` (default off / fail-safe) that governs same-subject requested-audience handling in `TokenExchangeHandler`: - **Delegation exchange** - unchanged; the requested audience is authorized by the delegation policy. - **Same-subject, flag off (default)** - the requested audience is ignored (not conveyed), so `passthrough` cannot mint an arbitrarily-audienced token without authorization. - **Same-subject, flag on** - the requested audience is honored but every value must be present in the subject token's own `aud` claim; otherwise the exchange is rejected with `invalid_target`. Enforcement lives in `TokenExchangeHandler` because it is the only layer holding the raw subject JWT (the downstream KNOXTOKEN `TokenResource` sees only the resolved `Subject`). Note: defaulting off changes behavior for existing `whitelist`/`static` deployments that today let a same-subject caller request an audience. They must opt in by setting the flag, which also brings the subject-token-`aud` enforcement. This matches the fail-safe convention of the other `delegation.*` flags. ## How was this patch tested? Automated unit tests (all passing): - `TokenExchangeHandlerTest` (75): added coverage for flag-off ignore, subset-authorized, audience-not-in-subject-token reject, subject-token-with-no-aud reject, and a delegation-path regression; updated existing same-subject conveyance tests for the new contract. - `JWTFederationFilterDelegationConfigTest` (8): new flag defaults to false and is independently configurable. - `JWTFederationFilterTokenExchangeTest` (60): regression. - `HadoopAuthFilterTest` (12): added the new init-param stub. `mvn -pl gateway-provider-security-jwt test -Dtest=TokenExchangeHandlerTest,JWTFederationFilterDelegationConfigTest,JWTFederationFilterTokenExchangeTest` ## Integration Tests N/A (will come in a new PR soon) ## UI changes N/A -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
