Sandor Molnar created KNOX-3465:
-----------------------------------
Summary: Add Docker-based E2E CI tests for RFC 8693 token exchange
— same-subject success and delegation gating (KNOX-3455 Bucket 1)
Key: KNOX-3465
URL: https://issues.apache.org/jira/browse/KNOX-3465
Project: Apache Knox
Issue Type: Sub-task
Components: CI, Tests
Affects Versions: 3.1.0
Reporter: Sandor Molnar
Assignee: Sandor Molnar
Fix For: 3.1.0
h2. Summary
Add Docker-based E2E CI coverage proving RFC 8693 token exchange works
end-to-end
through a running Knox gateway, for the subset of KNOX-3455 acceptance criteria
that
is already backed by product code on {{{}master{}}}.
This is a scoped slice of the KNOX-3455 acceptance-criteria list (the master
list
lives on KNOX-3455). It deliberately excludes:
* the same-subject requested-audience authorization ACs, which depend on the
unmerged
KNOX-3461 — tracked separately.
* the requested-scope ACs, for which no product behavior exists yet (scope is
not
parsed, minted, or validated on the exchange path after the
{{delegation.requested.scope.enabled}} flag was removed in KNOX-3457) — tracked
separately, blocked until requesting scope becomes live.
h2. Approach
Reuse the same Docker-based E2E test framework introduced in KNOX-3449 (PR
#1396),
running as part of the regular/default CI build — {*}no separate docker
compose{*}. New
topology files are added to the CI {{Dockerfile
}}({{{}.github/workflows/build/Dockerfile{}}}) and auto-discovered
{{test_*.py}} scripts
exercise them against the running gateway.
h2. Acceptance criteria (Bucket 1 — testable on {{master}} today)
# Same-subject exchange returns the correct {{{}sub{}}}, {{{}aud{}}},
{{{}iss{}}}, and
{{issued_token_type}} in the minted token.
** NOTE: {{scope}} is intentionally excluded — no minted Knox token carries a
{{scope}} claim.
# Permutations of {{no-act}} / {{act}} claim on the subject token all succeed.
** NOTE: the "requested scopes" permutation axis from the KNOX-3455 master
list is
excluded here — scope does not affect the exchange outcome.
# A delegation exchange with a missing {{audience}} returns HTTP 400 with error
{{invalid_request}} (delegation-enabled topology, audience-required enforcement
on).
# A delegation exchange with more than one {{audience}} returns HTTP 400 with
error
{{invalid_request}} (delegation-enabled topology, max-one enforcement on).
# A cross-subject exchange against a delegation-{*}disabled{*} topology is
rejected with
HTTP 400, error {{{}invalid_request{}}}, message
{{{}"Delegation is not enabled for this topology"{}}}.
# A same-subject exchange against a delegation-{*}enabled{*} topology succeeds
(zero-config H2 delegation policy service; no policy seeding required).
h2. Topologies to add
* A same-subject / delegation-disabled topology (plain KNOXIDF token exchange)
used
for ACs 1, 2, and 5.
* A delegation-enabled topology with {{{}delegation.server.enabled=true{}}},
{{{}delegation.requested.subject.enabled=true{}}},
{{{}delegation.enforce.requested.audience.required=true{}}}, and
{{{}delegation.enforce.requested.audience.max.one=true{}}}, used for ACs 3, 4,
and 6.
Each new topology file must be wired into
{{.github/workflows/build/Dockerfile}} with
its own {{ADD}} line, alongside the existing topologies.
h2. Out of scope (tracked separately)
* Requested-audience-vs-subject-{{{}aud{}}} authorization (blocked on
KNOX-3461):
requested audience must be a subset of the subject token's {{{}aud{}}}, else
HTTP 400
{{{}invalid_target{}}}. NOTE: the KNOX-3455 master list phrases these as "full
token
prefix" / {{{}invalid_scope{}}}; the shipped design is exact set-containment
returning
{{{}invalid_target{}}}.
* Requested-scope ACs (blocked until requesting scope becomes live):
"requested scope
not in subject token's scopes → {{{}invalid_scope{}}}", plus the {{scope}}
claim in the
issued token.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
