smolnar82 opened a new pull request, #1407: URL: https://github.com/apache/knox/pull/1407
[KNOX-3466](https://issues.apache.org/jira/browse/KNOX-3466) - CI integration tests for RFC 8693 same-subject requested-audience authorization ## What changes were proposed in this pull request? Extends the token-exchange E2E suite (added in KNOX-3465) to cover the same-subject requested-audience authorization introduced by KNOX-3461 (`delegation.same.subject.requested.audience.enabled`). No product code changes — tests and CI topologies only. - Three new CI topologies under `.github/workflows/build/conf/topologies/` (and their Dockerfile `ADD` lines): - `knoxidf-ldap-aud` — mint endpoint that stamps a fixed `aud` (`https://recipient1,https://recipient2`) via the default `static` audience validator, so subject tokens carry an `aud` to authorize against (per-user limit `-1`, uncapped). - `knoxidf-token-same-subject-aud` — exchange topology with the flag on plus a `passthrough` audience validator. - `knoxidf-token-passthrough` — identical but with the flag off, the fail-safe control. - Five new cases in `test_token_exchange.py` (with a `_mint_subject_token_with_aud` helper and an `_aud_values` normalizer): - flag on + requested audience carried by the subject token's `aud` → 200 and the audience is minted onto the exchanged token; - flag on + requested audience not in the subject token's `aud` → 400 `invalid_target`; - flag on + subject token has no `aud` → 400 `invalid_target`; - flag off (default) + `passthrough` → requested audience dropped, not minted; - the flag is orthogonal to delegation — an `actor_token` exchange on the flag-on topology (which does not enable delegation) is still rejected outright. ## How was this patch tested? Ran the default Docker Compose test job locally against a gateway built from the KNOX-3461 branch (the product change these tests exercise). Full suite green: `91 passed`, including all 11 `test_token_exchange.py` cases (6 from KNOX-3465 + 5 new). The three cases that gate on KNOX-3461 return 200 on plain master and correctly flip to `400 invalid_target` (or drop the audience) with the KNOX-3461 code in the image, which is the evidence for the feature. ``` tests-1 | ============================= test session starts ============================== tests-1 | platform linux -- Python 3.10.20, pytest-9.0.3, pluggy-1.6.0 tests-1 | rootdir: /tests tests-1 | collected 91 items tests-1 | tests-1 | test_health.py ..... [ 5%] tests-1 | test_k8s_delegation.py ... [ 8%] tests-1 | test_k8s_serviceaccount_validation.py ...... [ 15%] tests-1 | test_knox_admin_path_traversal.py ... [ 18%] tests-1 | test_knox_auth_service_and_ldap.py ... [ 21%] tests-1 | test_knox_configs.py . [ 23%] tests-1 | test_knox_ldap_cache.py ... [ 26%] tests-1 | test_knox_ldap_injection.py ....... [ 34%] tests-1 | test_knox_ldap_proxy_search.py ......... [ 43%] tests-1 | test_knoxauth_preauth_and_paths.py ...... [ 50%] tests-1 | test_knoxidf.py ...... [ 57%] tests-1 | test_knoxsso_redirect.py . [ 58%] tests-1 | test_knoxtoken_jwt.py .................... [ 80%] tests-1 | test_remote_auth.py ... [ 83%] tests-1 | test_remoteauth_extauthz_additional_path.py .... [ 87%] tests-1 | test_token_exchange.py ........... [100%] tests-1 | tests-1 | =============================== warnings summary =============================== tests-1 | ../usr/local/lib/python3.10/site-packages/ldap3/utils/asn1.py:50 ... tests-1 | tests-1 | -- Docs: https://docs.pytest.org/en/stable/how-to/capture-warnings.html tests-1 | ----------------- generated xml file: /tests/test-results.xml ------------------ tests-1 | ======================= 91 passed, 83 warnings in 16.96s ======================= tests-1 exited with code 0 Aborting on container exit... Container compose-tests-1 Stopping Container compose-tests-1 Stopped Config w Enable Watch d Detach ``` **_Note:_** until #1405 merges to master, those three cases are expected to be red on this PR's own CI run; the positive-control and delegation-orthogonality cases stay green. ## Integration Tests Adds `.github/workflows/tests/test_token_exchange.py` cases and CI topologies as described above. Runs in the default Docker Compose job (no opt-in label required). `pylint` 10.00/10. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
