Sandor Molnar created KNOX-3466:
-----------------------------------
Summary: Add Docker-based E2E CI tests for same-subject
requested-audience authorization in token exchange (KNOX-3455 Bucket 2, depends
on KNOX-3461)
Key: KNOX-3466
URL: https://issues.apache.org/jira/browse/KNOX-3466
Project: Apache Knox
Issue Type: Sub-task
Components: CI, Tests
Affects Versions: 3.1.0
Reporter: Sandor Molnar
Assignee: Sandor Molnar
Fix For: 3.1.0
h2. Summary
Add Docker-based E2E CI coverage proving that, for a same-subject RFC 8693 token
exchange, a requested audience is authorized against the subject token's own
{{aud}}
claim through a running Knox gateway.
This is a scoped slice of the KNOX-3455 acceptance-criteria list (the master
list
lives on KNOX-3455). It covers only the requested-audience-vs-subject-{{aud}}
ACs.
*Blocked on KNOX-3461*: the authorization logic
({{delegation.same.subject.requested.audience.enabled}}, set-containment
against the
subject token's {{aud}}) lives only on branch KNOX-3461 and is not yet on
{{master}}.
These tests can be written but will fail until KNOX-3461 merges.
h2. Approach
Reuse the same Docker-based E2E test framework introduced in KNOX-3449 (PR
#1396),
running as part of the regular/default CI build — *no separate docker compose*.
New
topology files are added to the CI {{Dockerfile}}
({{.github/workflows/build/Dockerfile}}) and auto-discovered {{test_*.py}}
scripts
exercise them against the running gateway.
h2. Reconciliation with the KNOX-3455 master list
The master list phrases these ACs as "full token prefix" matching returning
{{invalid_scope}}. The *shipped* design (KNOX-3461) is different and these ACs
are
reworded to match it:
* matching is exact set-containment, not prefix matching;
* the failure error code is {{invalid_target}} (RFC 8707), never
{{invalid_scope}}.
h2. Acceptance criteria (Bucket 2)
# With {{delegation.same.subject.requested.audience.enabled=true}} and a
passthrough
audience validator, a same-subject exchange whose requested audience is a
*subset*
of the subject token's {{aud}} claim succeeds and the requested audience is
conveyed
to the minted token.
# Under the same configuration, a same-subject exchange whose requested
audience is
*not* contained in the subject token's {{aud}} claim is rejected with HTTP
400,
error {{invalid_target}}, and the requested audience is not conveyed.
# With the flag at its fail-safe default ({{false}}), a same-subject exchange
with a
requested audience succeeds but the requested audience is *ignored* (not
conveyed),
so a passthrough audience validator cannot mint an arbitrarily-audienced token
without authorization.
h2. Topologies to add
* A same-subject topology with
{{delegation.same.subject.requested.audience.enabled=true}} and a passthrough
audience validator (for ACs 1 and 2).
* Reuse an existing flag-default topology, or add one with the flag
absent/false, for
AC 3.
Each new topology file must be wired into
{{.github/workflows/build/Dockerfile}} with
its own {{ADD}} line.
h2. Dependencies
* KNOX-3461 must merge to {{master}} before these tests can pass.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
