[
https://issues.apache.org/jira/browse/KNOX-3465?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18116046#comment-18116046
]
ASF subversion and git services commented on KNOX-3465:
-------------------------------------------------------
Commit da99fa6c718dbed1b04de9aeb1f21ad79ae27021 in knox's branch
refs/heads/master from Sandor Molnar
[ https://gitbox.apache.org/repos/asf?p=knox.git;h=da99fa6c7 ]
KNOX-3465: add CI integration tests for RFC 8693 token exchange (same-subject
and delegation gating) (#1406)
> Add Docker-based E2E CI tests for RFC 8693 token exchange — same-subject
> success and delegation gating (KNOX-3455 Bucket 1)
> ---------------------------------------------------------------------------------------------------------------------------
>
> Key: KNOX-3465
> URL: https://issues.apache.org/jira/browse/KNOX-3465
> Project: Apache Knox
> Issue Type: Sub-task
> Components: CI, Tests
> Affects Versions: 3.1.0
> Reporter: Sandor Molnar
> Assignee: Sandor Molnar
> Priority: Major
> Fix For: 3.1.0
>
> Time Spent: 40m
> Remaining Estimate: 0h
>
> h2. Summary
> Add Docker-based E2E CI coverage proving RFC 8693 token exchange works
> end-to-end
> through a running Knox gateway, for the subset of KNOX-3455 acceptance
> criteria that
> is already backed by product code on {{{}master{}}}.
> This is a scoped slice of the KNOX-3455 acceptance-criteria list (the master
> list
> lives on KNOX-3455). It deliberately excludes:
> * the same-subject requested-audience authorization ACs, which depend on the
> unmerged
> KNOX-3461 — tracked separately.
> * the requested-scope ACs, for which no product behavior exists yet (scope
> is not
> parsed, minted, or validated on the exchange path after the
> {{delegation.requested.scope.enabled}} flag was removed in KNOX-3457) —
> tracked
> separately, blocked until requesting scope becomes live.
> h2. Approach
> Reuse the same Docker-based E2E test framework introduced in KNOX-3449 (PR
> #1396),
> running as part of the regular/default CI build — {*}no separate docker
> compose{*}. New
> topology files are added to the CI {{Dockerfile
> }}({{{}.github/workflows/build/Dockerfile{}}}) and auto-discovered
> {{test_*.py}} scripts
> exercise them against the running gateway.
> h2. Acceptance criteria (Bucket 1 — testable on {{master}} today)
> # Same-subject exchange returns the correct {{{}sub{}}}, {{{}aud{}}},
> {{{}iss{}}}, and
> {{issued_token_type}} in the minted token.
> ** NOTE: {{scope}} is intentionally excluded — no minted Knox token carries a
> {{scope}} claim.
> # Permutations of {{no-act}} / {{act}} claim on the subject token all
> succeed.
> ** NOTE: the "requested scopes" permutation axis from the KNOX-3455 master
> list is
> excluded here — scope does not affect the exchange outcome.
> # A delegation exchange with a missing {{audience}} returns HTTP 400 with
> error
> {{invalid_request}} (delegation-enabled topology, audience-required
> enforcement on).
> # A delegation exchange with more than one {{audience}} returns HTTP 400
> with error
> {{invalid_request}} (delegation-enabled topology, max-one enforcement on).
> # A cross-subject exchange against a delegation-{*}disabled{*} topology is
> rejected with
> HTTP 400, error {{{}invalid_request{}}}, message
> {{{}"Delegation is not enabled for this topology"{}}}.
> # A same-subject exchange against a delegation-{*}enabled{*} topology
> succeeds
> (zero-config H2 delegation policy service; no policy seeding required).
> h2. Topologies to add
> * A same-subject / delegation-disabled topology (plain KNOXIDF token
> exchange) used
> for ACs 1, 2, and 5.
> * A delegation-enabled topology with {{{}delegation.server.enabled=true{}}},
> {{{}delegation.requested.subject.enabled=true{}}},
> {{{}delegation.enforce.requested.audience.required=true{}}}, and
> {{{}delegation.enforce.requested.audience.max.one=true{}}}, used for ACs 3,
> 4, and 6.
> Each new topology file must be wired into
> {{.github/workflows/build/Dockerfile}} with
> its own {{ADD}} line, alongside the existing topologies.
> h2. Out of scope (tracked separately)
> * Requested-audience-vs-subject-{{{}aud{}}} authorization (blocked on
> KNOX-3461):
> requested audience must be a subset of the subject token's {{{}aud{}}}, else
> HTTP 400
> {{{}invalid_target{}}}. NOTE: the KNOX-3455 master list phrases these as
> "full token
> prefix" / {{{}invalid_scope{}}}; the shipped design is exact set-containment
> returning
> {{{}invalid_target{}}}.
> * Requested-scope ACs (blocked until requesting scope becomes live):
> "requested scope
> not in subject token's scopes → {{{}invalid_scope{}}}", plus the {{scope}}
> claim in the
> issued token.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
