smolnar82 opened a new pull request, #1406: URL: https://github.com/apache/knox/pull/1406
[KNOX-3465](https://issues.apache.org/jira/browse/KNOX-3465) - Add CI integration tests for RFC 8693 token exchange (same-subject and delegation gating) ## What changes were proposed in this pull request? Adds end-to-end CI evidence that RFC 8693 token exchange works through a running Knox gateway, covering the "Bucket 1" acceptance criteria of the "master" list KNOX-3455 (the subset backed by product code already on `master`; the requested-audience-vs-subject-aud cases wait on KNOX-3461 and the requested-scope cases wait on scope support landing). - **`test_token_exchange.py`** — new suite of 6 tests. The subject token is a genuine Knox JWT minted via the KNOXIDF token endpoint on `knoxidf-ldap` (a request with no `grant_type` falls through to the base KNOXTOKEN minting path); because it is Knox-signed, it verifies on the exchange path with no trusted-issuer registration. Covers: - same-subject exchange preserves `sub`/`iss` and advertises `issued_token_type` = `...:jwt`; - a same-subject exchange whose subject token carries no `act` claim succeeds and adds none; - a delegation exchange with a missing audience → `400 invalid_request`; - a delegation exchange with more than one audience → `400 invalid_request`; - a delegation exchange against a delegation-disabled topology → `400 invalid_request` "Delegation is not enabled for this topology"; - a same-subject exchange against a delegation-enabled topology still succeeds. - **`conf/topologies/knoxidf-token-delegation.xml`** — new delegation-enabled topology (`delegation.server.enabled=true` plus both requested-audience enforcement flags); the existing `knoxidf-token.xml` serves as the delegation-disabled counterpart. - **`build/Dockerfile`** — ADD the new topology into the CI knox image. Runs in the default Docker Compose build — no separate stack. ## How was this patch tested? Ran the full Docker Compose integration job locally (`.github/workflows/tests`): **86 passed**, including all 6 new `test_token_exchange.py` cases. `py_compile` clean and `pylint` 10.00/10 on the new file; no regression in the existing suites: ``` tests-1 | ============================= test session starts ============================== tests-1 | platform linux -- Python 3.10.20, pytest-9.0.3, pluggy-1.6.0 tests-1 | rootdir: /tests tests-1 | collected 86 items tests-1 | tests-1 | test_health.py ..... [ 5%] tests-1 | test_k8s_delegation.py ... [ 9%] tests-1 | test_k8s_serviceaccount_validation.py ...... [ 16%] tests-1 | test_knox_admin_path_traversal.py ... [ 19%] tests-1 | test_knox_auth_service_and_ldap.py ... [ 23%] tests-1 | test_knox_configs.py . [ 24%] tests-1 | test_knox_ldap_cache.py ... [ 27%] tests-1 | test_knox_ldap_injection.py ....... [ 36%] tests-1 | test_knox_ldap_proxy_search.py ......... [ 46%] tests-1 | test_knoxauth_preauth_and_paths.py ...... [ 53%] tests-1 | test_knoxidf.py ...... [ 60%] tests-1 | test_knoxsso_redirect.py . [ 61%] tests-1 | test_knoxtoken_jwt.py .................... [ 84%] tests-1 | test_remote_auth.py ... [ 88%] tests-1 | test_remoteauth_extauthz_additional_path.py .... [ 93%] tests-1 | test_token_exchange.py ...... [100%] tests-1 | tests-1 | =============================== warnings summary =============================== tests-1 | ../usr/local/lib/python3.10/site-packages/ldap3/utils/asn1.py:50 ... tests-1 | -- Docs: https://docs.pytest.org/en/stable/how-to/capture-warnings.html tests-1 | ----------------- generated xml file: /tests/test-results.xml ------------------ tests-1 | ======================= 86 passed, 78 warnings in 15.47s ======================= tests-1 exited with code 0 Aborting on container exit... Container compose-tests-1 Stopping Container compose-tests-1 Stopped Config w Enable Watch d Detach ``` ## Integration Tests This PR *is* the integration tests — see `.github/workflows/tests/test_token_exchange.py`. No opt-in label required; the suite runs in the default job. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
