[
https://issues.apache.org/jira/browse/KNOX-3465?focusedWorklogId=1041988&page=com.atlassian.jira.plugin.system.issuetabpanels:worklog-tabpanel#worklog-1041988
]
ASF GitHub Bot logged work on KNOX-3465:
----------------------------------------
Author: ASF GitHub Bot
Created on: 16/Sep/26 12:25
Start Date: 16/Sep/26 12:25
Worklog Time Spent: 10m
Work Description: smolnar82 opened a new pull request, #1406:
URL: https://github.com/apache/knox/pull/1406
[KNOX-3465](https://issues.apache.org/jira/browse/KNOX-3465) - Add CI
integration tests for RFC 8693 token exchange (same-subject and delegation
gating)
## What changes were proposed in this pull request?
Adds end-to-end CI evidence that RFC 8693 token exchange works through a
running Knox gateway, covering the "Bucket 1" acceptance criteria of the
"master" list KNOX-3455 (the subset backed by product code already on `master`;
the requested-audience-vs-subject-aud cases wait on KNOX-3461 and the
requested-scope cases wait on scope support landing).
- **`test_token_exchange.py`** — new suite of 6 tests. The subject token is
a genuine Knox JWT minted via the KNOXIDF token endpoint on `knoxidf-ldap` (a
request with no `grant_type` falls through to the base KNOXTOKEN minting path);
because it is Knox-signed, it verifies on the exchange path with no
trusted-issuer registration. Covers:
- same-subject exchange preserves `sub`/`iss` and advertises
`issued_token_type` = `...:jwt`;
- a same-subject exchange whose subject token carries no `act` claim
succeeds and adds none;
- a delegation exchange with a missing audience → `400 invalid_request`;
- a delegation exchange with more than one audience → `400
invalid_request`;
- a delegation exchange against a delegation-disabled topology → `400
invalid_request` "Delegation is not enabled for this topology";
- a same-subject exchange against a delegation-enabled topology still
succeeds.
- **`conf/topologies/knoxidf-token-delegation.xml`** — new
delegation-enabled topology (`delegation.server.enabled=true` plus both
requested-audience enforcement flags); the existing `knoxidf-token.xml` serves
as the delegation-disabled counterpart.
- **`build/Dockerfile`** — ADD the new topology into the CI knox image.
Runs in the default Docker Compose build — no separate stack.
## How was this patch tested?
Ran the full Docker Compose integration job locally
(`.github/workflows/tests`): **86 passed**, including all 6 new
`test_token_exchange.py` cases. `py_compile` clean and `pylint` 10.00/10 on the
new file; no regression in the existing suites:
```
tests-1 | ============================= test session starts
==============================
tests-1 | platform linux
Issue Time Tracking
-------------------
Worklog Id: (was: 1041988)
Remaining Estimate: 0h
Time Spent: 10m
> Add Docker-based E2E CI tests for RFC 8693 token exchange — same-subject
> success and delegation gating (KNOX-3455 Bucket 1)
> ---------------------------------------------------------------------------------------------------------------------------
>
> Key: KNOX-3465
> URL: https://issues.apache.org/jira/browse/KNOX-3465
> Project: Apache Knox
> Issue Type: Sub-task
> Components: CI, Tests
> Affects Versions: 3.1.0
> Reporter: Sandor Molnar
> Assignee: Sandor Molnar
> Priority: Major
> Fix For: 3.1.0
>
> Time Spent: 10m
> Remaining Estimate: 0h
>
> h2. Summary
> Add Docker-based E2E CI coverage proving RFC 8693 token exchange works
> end-to-end
> through a running Knox gateway, for the subset of KNOX-3455 acceptance
> criteria that
> is already backed by product code on {{{}master{}}}.
> This is a scoped slice of the KNOX-3455 acceptance-criteria list (the master
> list
> lives on KNOX-3455). It deliberately excludes:
> * the same-subject requested-audience authorization ACs, which depend on the
> unmerged
> KNOX-3461 — tracked separately.
> * the requested-scope ACs, for which no product behavior exists yet (scope
> is not
> parsed, minted, or validated on the exchange path after the
> {{delegation.requested.scope.enabled}} flag was removed in KNOX-3457) —
> tracked
> separately, blocked until requesting scope becomes live.
> h2. Approach
> Reuse the same Docker-based E2E test framework introduced in KNOX-3449 (PR
> #1396),
> running as part of the regular/default CI build — {*}no separate docker
> compose{*}. New
> topology files are added to the CI {{Dockerfile
> }}({{{}.github/workflows/build/Dockerfile{}}}) and auto-discovered
> {{test_*.py}} scripts
> exercise them against the running gateway.
> h2. Acceptance criteria (Bucket 1 — testable on {{master}} today)
> # Same-subject exchange returns the correct {{{}sub{}}}, {{{}aud{}}},
> {{{}iss{}}}, and
> {{issued_token_type}} in the minted token.
> ** NOTE: {{scope}} is intentionally excluded — no minted Knox token carries a
> {{scope}} claim.
> # Permutations of {{no-act}} / {{act}} claim on the subject token all
> succeed.
> ** NOTE: the "requested scopes" permutation axis from the KNOX-3455 master
> list is
> excluded here — scope does not affect the exchange outcome.
> # A delegation exchange with a missing {{audience}} returns HTTP 400 with
> error
> {{invalid_request}} (delegation-enabled topology, audience-required
> enforcement on).
> # A delegation exchange with more than one {{audience}} returns HTTP 400
> with error
> {{invalid_request}} (delegation-enabled topology, max-one enforcement on).
> # A cross-subject exchange against a delegation-{*}disabled{*} topology is
> rejected with
> HTTP 400, error {{{}invalid_request{}}}, message
> {{{}"Delegation is not enabled for this topology"{}}}.
> # A same-subject exchange against a delegation-{*}enabled{*} topology
> succeeds
> (zero-config H2 delegation policy service; no policy seeding required).
> h2. Topologies to add
> * A same-subject / delegation-disabled topology (plain KNOXIDF token
> exchange) used
> for ACs 1, 2, and 5.
> * A delegation-enabled topology with {{{}delegation.server.enabled=true{}}},
> {{{}delegation.requested.subject.enabled=true{}}},
> {{{}delegation.enforce.requested.audience.required=true{}}}, and
> {{{}delegation.enforce.requested.audience.max.one=true{}}}, used for ACs 3,
> 4, and 6.
> Each new topology file must be wired into
> {{.github/workflows/build/Dockerfile}} with
> its own {{ADD}} line, alongside the existing topologies.
> h2. Out of scope (tracked separately)
> * Requested-audience-vs-subject-{{{}aud{}}} authorization (blocked on
> KNOX-3461):
> requested audience must be a subset of the subject token's {{{}aud{}}}, else
> HTTP 400
> {{{}invalid_target{}}}. NOTE: the KNOX-3455 master list phrases these as
> "full token
> prefix" / {{{}invalid_scope{}}}; the shipped design is exact set-containment
> returning
> {{{}invalid_target{}}}.
> * Requested-scope ACs (blocked until requesting scope becomes live):
> "requested scope
> not in subject token's scopes → {{{}invalid_scope{}}}", plus the {{scope}}
> claim in the
> issued token.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
