Sandor Molnar created KNOX-3467:
-----------------------------------
Summary: mplement and E2E-test requested-scope authorization for
token exchange (KNOX-3455 Bucket 3, blocked — no product support yet)
Key: KNOX-3467
URL: https://issues.apache.org/jira/browse/KNOX-3467
Project: Apache Knox
Issue Type: Sub-task
Components: CI, Tests
Affects Versions: 3.1.0
Reporter: Sandor Molnar
Assignee: Sandor Molnar
Fix For: 3.1.0
h2. Summary
The KNOX-3455 acceptance-criteria list (master list on KNOX-3455) includes
requested-scope behavior for RFC 8693 token exchange. *No product code
implements*
{*}this today{*}, so it cannot be tested end-to-end. This issue tracks the E2E
CI coverage that depends on it. The missing product capability Jira will be
linked here later.
h2. Current state
* The {{delegation.requested.scope.enabled}} provider parameter was *removed*
in
KNOX-3457 because it did nothing.
* On the exchange path, {{scope}} is not parsed, not validated, and not minted
— no
minted Knox token has ever carried a {{scope}} claim.
* Therefore the scope-related KNOX-3455 ACs are untestable until requesting
scope
becomes a real, live capability.
h2. Blocked acceptance criteria (from the KNOX-3455 master list)
# A requested scope that is not among the subject token's scopes is rejected
with {{{}invalid_scope{}}}.
# The minted token carries the correct {{scope}} claim (the {{scope}} field of
the "same-subject exchange returns correct sub/aud/iss/scope/issued_token_type"
AC).
# The "× no / all / some requested scopes" permutation axis of the exchange
ACs.
h2. Work required
# {*}Product{*}: implement requested-scope handling on the token-exchange path
— parse the RFC 8693 {{scope}} parameter, authorize it against the subject
token's scopes, reject unauthorized scopes with {{{}invalid_scope{}}}, and mint
the {{scope}} claim onto the issued token. (This likely warrants its own
feature/design discussion and may be split out.)
# {*}Test{*}: once the above lands, add Docker-based E2E CI coverage using the
KNOX-3449 framework — *no separate docker compose* — with topology files wired
into {{.github/workflows/build/Dockerfile}} and auto-discovered {{test_*.py}}
scripts.
h2. Dependencies
* Blocked until requesting scope is implemented on the exchange path (item 1
above).
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
