[
https://issues.apache.org/jira/browse/KNOX-3466?focusedWorklogId=1042015&page=com.atlassian.jira.plugin.system.issuetabpanels:worklog-tabpanel#worklog-1042015
]
ASF GitHub Bot logged work on KNOX-3466:
----------------------------------------
Author: ASF GitHub Bot
Created on: 16/Sep/26 15:12
Start Date: 16/Sep/26 15:12
Worklog Time Spent: 10m
Work Description: smolnar82 opened a new pull request, #1407:
URL: https://github.com/apache/knox/pull/1407
[KNOX-3466](https://issues.apache.org/jira/browse/KNOX-3466) - CI
integration tests for RFC 8693 same-subject requested-audience authorization
## What changes were proposed in this pull request?
Extends the token-exchange E2E suite (added in KNOX-3465) to cover the
same-subject requested-audience authorization introduced by KNOX-3461
(`delegation.same.subject.requested.audience.enabled`). No product code changes
— tests and CI topologies only.
- Three new CI topologies under `.github/workflows/build/conf/topologies/`
(and their Dockerfile `ADD` lines):
- `knoxidf-ldap-aud` — mint endpoint that stamps a fixed `aud`
(`https://recipient1,https://recipient2`) via the default `static` audience
validator, so subject tokens carry an `aud` to authorize against (per-user
limit `-1`, uncapped).
- `knoxidf-token-same-subject-aud` — exchange topology with the flag on
plus a `passthrough` audience validator.
- `knoxidf-token-passthrough` — identical but with the flag off, the
fail-safe control.
- Five new cases in `test_token_exchange.py` (with a
`_mint_subject_token_with_aud` helper and an `_aud_values` normalizer):
- flag on + requested audience carried by the subject token's `aud` → 200
and the audience is minted onto the exchanged token;
- flag on + requested audience not in the subject token's `aud` → 400
`invalid_target`;
- flag on + subject token has no `aud` → 400 `invalid_target`;
- flag off (default) + `passthrough` → requested audience dropped, not
minted;
- the flag is orthogonal to delegation — an `actor_token` exchange on the
flag-on topology (which does not enable delegation) is still rejected outright.
## How was this patch tested?
Ran the default Docker Compose test job locally against a gateway built from
the KNOX-3461 branch (the product change these tests exercise). Full suite
green: `91 passed`, including all 11 `test_token_exchange.py` cases (6 from
KNOX-3465 + 5 new). The three cases that gate on KNOX-3461 return 200 on plain
master and correctly flip to `400 invalid_target` (or drop the audience) with
the KNOX-3461 code in the image, which is the evidence for the feature.
```
tests-1 | ============================= test session starts
==============================
tests-1 | platform linux
Issue Time Tracking
-------------------
Worklog Id: (was: 1042015)
Remaining Estimate: 0h
Time Spent: 10m
> Add Docker-based E2E CI tests for same-subject requested-audience
> authorization in token exchange (KNOX-3455 Bucket 2, depends on KNOX-3461)
> --------------------------------------------------------------------------------------------------------------------------------------------
>
> Key: KNOX-3466
> URL: https://issues.apache.org/jira/browse/KNOX-3466
> Project: Apache Knox
> Issue Type: Sub-task
> Components: CI, Tests
> Affects Versions: 3.1.0
> Reporter: Sandor Molnar
> Assignee: Sandor Molnar
> Priority: Major
> Fix For: 3.1.0
>
> Time Spent: 10m
> Remaining Estimate: 0h
>
> h2. Summary
> Add Docker-based E2E CI coverage proving that, for a same-subject RFC 8693
> token
> exchange, a requested audience is authorized against the subject token's own
> {{aud}}
> claim through a running Knox gateway.
> This is a scoped slice of the KNOX-3455 acceptance-criteria list (the master
> list
> lives on KNOX-3455). It covers only the requested-audience-vs-subject-{{aud}}
> ACs.
> *Blocked on KNOX-3461*: the authorization logic
> ({{delegation.same.subject.requested.audience.enabled}}, set-containment
> against the
> subject token's {{aud}}) lives only on branch KNOX-3461 and is not yet on
> {{master}}.
> These tests can be written but will fail until KNOX-3461 merges.
> h2. Approach
> Reuse the same Docker-based E2E test framework introduced in KNOX-3449 (PR
> #1396),
> running as part of the regular/default CI build — *no separate docker
> compose*. New
> topology files are added to the CI {{Dockerfile}}
> ({{.github/workflows/build/Dockerfile}}) and auto-discovered {{test_*.py}}
> scripts
> exercise them against the running gateway.
> h2. Reconciliation with the KNOX-3455 master list
> The master list phrases these ACs as "full token prefix" matching returning
> {{invalid_scope}}. The *shipped* design (KNOX-3461) is different and these
> ACs are
> reworded to match it:
> * matching is exact set-containment, not prefix matching;
> * the failure error code is {{invalid_target}} (RFC 8707), never
> {{invalid_scope}}.
> h2. Acceptance criteria (Bucket 2)
> # With {{delegation.same.subject.requested.audience.enabled=true}} and a
> passthrough
> audience validator, a same-subject exchange whose requested audience is a
> *subset*
> of the subject token's {{aud}} claim succeeds and the requested audience is
> conveyed
> to the minted token.
> # Under the same configuration, a same-subject exchange whose requested
> audience is
> *not* contained in the subject token's {{aud}} claim is rejected with HTTP
> 400,
> error {{invalid_target}}, and the requested audience is not conveyed.
> # With the flag at its fail-safe default ({{false}}), a same-subject exchange
> with a
> requested audience succeeds but the requested audience is *ignored* (not
> conveyed),
> so a passthrough audience validator cannot mint an arbitrarily-audienced
> token
> without authorization.
> h2. Topologies to add
> * A same-subject topology with
> {{delegation.same.subject.requested.audience.enabled=true}} and a
> passthrough
> audience validator (for ACs 1 and 2).
> * Reuse an existing flag-default topology, or add one with the flag
> absent/false, for
> AC 3.
> Each new topology file must be wired into
> {{.github/workflows/build/Dockerfile}} with
> its own {{ADD}} line.
> h2. Dependencies
> * KNOX-3461 must merge to {{master}} before these tests can pass.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
