[jira] [Work logged] (KNOX-3461) Same subject validation for requested audience

[ASF GitHub Bot (Jira)]

     [ 
https://issues.apache.org/jira/browse/KNOX-3461?focusedWorklogId=1041968&page=com.atlassian.jira.plugin.system.issuetabpanels:worklog-tabpanel#worklog-1041968
 ]

ASF GitHub Bot logged work on KNOX-3461:
----------------------------------------

                Author: ASF GitHub Bot
            Created on: 16/Sep/26 11:14
            Start Date: 16/Sep/26 11:14
    Worklog Time Spent: 10m 
      Work Description: github-actions[bot] commented on PR #1405:
URL: https://github.com/apache/knox/pull/1405#issuecomment-5696543131

   ## Test Results
     5 files    5 suites   28s ⏱️
    90 tests  90 ✅ 0 💤 0 ❌
   108 runs  108 ✅ 0 💤 0 ❌
   
   Results for commit 0fe07b3a.
   
   
[test-results]:data:application/gzip;base64,H4sIABh6qmoC/13MSw7CIBSF4a00jB3cAg1cN2OQR3JjWwyFkXHv0qa16PD7T3JeLNDoF3bthkvHlkL5C1eSyRTnSq6r65LXDeHAbSnW/pUHPWs5QzA0/gSfUkx7SWVeH3vQO47HtpyPm5vDze2fjdNEuYJB8KDuwhgXPJccuR8c9MoLoVGCFiiVEgKRvT8u3a0fAgEAAA==
   




Issue Time Tracking
-------------------

    Worklog Id:     (was: 1041968)
    Time Spent: 0.5h  (was: 20m)

> Same subject validation for requested audience
> ----------------------------------------------
>
>                 Key: KNOX-3461
>                 URL: https://issues.apache.org/jira/browse/KNOX-3461
>             Project: Apache Knox
>          Issue Type: Sub-task
>          Components: JWT
>            Reporter: Harrison Sheinblatt
>            Assignee: Sandor Molnar
>            Priority: Major
>          Time Spent: 0.5h
>  Remaining Estimate: 0h
>
> When delegation is enabled, we'll want to set the knoxidf audience strategy 
> to passthrough so we rely on the delegation policy to authorize a requested 
> audience instead of the hardcoded list. But once that's set, then the 
> same-subject requested audience is unauthorized at all. So we either need to 
> not allow requested audiences just for same-subject exchanges with a setting, 
> or add enforcement, or both. 
> The simplest thing is to add a setting to skip reading the requested audience 
> only for same-subject token exchanges.
> The natural authz is to validate the original subject token has the audience 
> requested to allow the requested audience. So if the flag to allow reading 
> the audience for same-subject exchange is on, we'd authorize on the subject 
> token. If this proves a problem, we can turn it off or figure out a way to 
> add more audiences to the user tokens knox issues.



--
This message was sent by Atlassian Jira
(v8.20.10#820010)