smolnar82 commented on code in PR #1405:
URL: https://github.com/apache/knox/pull/1405#discussion_r4034174099
##########
gateway-provider-security-jwt/src/main/java/org/apache/knox/gateway/provider/federation/jwt/filter/JWTFederationFilter.java:
##########
@@ -131,6 +131,18 @@ public class JWTFederationFilter extends AbstractJWTFilter
{
// Has no effect on a same-subject exchange.
public static final String DELEGATION_ENFORCE_REQUESTED_AUDIENCE_MAX_ONE =
"delegation.enforce.requested.audience.max.one";
+ // Topology provider param (default false/absent). Gates whether a
+ // same-subject token exchange may honor a requested audience/resource at
+ // all. While off (the fail-safe default), the requested audience is ignored
+ // for same-subject exchanges, so a passthrough audience validator cannot
+ // mint an arbitrarily-audienced token without authorization. While on, the
+ // requested audience is honored but must be authorized against the subject
+ // token's own aud claim; any requested value the subject token does not
+ // already carry is rejected. Unlike the delegation.* flags above, this one
+ // affects only same-subject exchanges (delegation exchanges are authorized
+ // by the delegation policy regardless of this flag).
+ public static final String
DELEGATION_SAME_SUBJECT_REQUESTED_AUDIENCE_ENABLED =
"delegation.same.subject.requested.audience.enabled";
Review Comment:
Good call, agreed, "delegation" is misleading since this applies to
same-subject exchange and works independently of delegation.server.enabled.
Renaming to `token.exchange.same.subject.requested.audience.enabled` (keeping
the dot convention of the sibling flags). Will update the constant, field,
getter, comment, and tests.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
