[
https://issues.apache.org/jira/browse/KNOX-3466?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Sandor Molnar updated KNOX-3466:
--------------------------------
Status: Patch Available (was: Open)
> Add Docker-based E2E CI tests for same-subject requested-audience
> authorization in token exchange (KNOX-3455 Bucket 2, depends on KNOX-3461)
> --------------------------------------------------------------------------------------------------------------------------------------------
>
> Key: KNOX-3466
> URL: https://issues.apache.org/jira/browse/KNOX-3466
> Project: Apache Knox
> Issue Type: Sub-task
> Components: CI, Tests
> Affects Versions: 3.1.0
> Reporter: Sandor Molnar
> Assignee: Sandor Molnar
> Priority: Major
> Fix For: 3.1.0
>
> Time Spent: 1h
> Remaining Estimate: 0h
>
> h2. Summary
> Add Docker-based E2E CI coverage proving that, for a same-subject RFC 8693
> token
> exchange, a requested audience is authorized against the subject token's own
> {{aud}}
> claim through a running Knox gateway.
> This is a scoped slice of the KNOX-3455 acceptance-criteria list (the master
> list
> lives on KNOX-3455). It covers only the requested-audience-vs-subject-{{aud}}
> ACs.
> *Blocked on KNOX-3461*: the authorization logic
> ({{delegation.same.subject.requested.audience.enabled}}, set-containment
> against the
> subject token's {{aud}}) lives only on branch KNOX-3461 and is not yet on
> {{master}}.
> These tests can be written but will fail until KNOX-3461 merges.
> h2. Approach
> Reuse the same Docker-based E2E test framework introduced in KNOX-3449 (PR
> #1396),
> running as part of the regular/default CI build — *no separate docker
> compose*. New
> topology files are added to the CI {{Dockerfile}}
> ({{.github/workflows/build/Dockerfile}}) and auto-discovered {{test_*.py}}
> scripts
> exercise them against the running gateway.
> h2. Reconciliation with the KNOX-3455 master list
> The master list phrases these ACs as "full token prefix" matching returning
> {{invalid_scope}}. The *shipped* design (KNOX-3461) is different and these
> ACs are
> reworded to match it:
> * matching is exact set-containment, not prefix matching;
> * the failure error code is {{invalid_target}} (RFC 8707), never
> {{invalid_scope}}.
> h2. Acceptance criteria (Bucket 2)
> # With {{delegation.same.subject.requested.audience.enabled=true}} and a
> passthrough
> audience validator, a same-subject exchange whose requested audience is a
> *subset*
> of the subject token's {{aud}} claim succeeds and the requested audience is
> conveyed
> to the minted token.
> # Under the same configuration, a same-subject exchange whose requested
> audience is
> *not* contained in the subject token's {{aud}} claim is rejected with HTTP
> 400,
> error {{invalid_target}}, and the requested audience is not conveyed.
> # With the flag at its fail-safe default ({{false}}), a same-subject exchange
> with a
> requested audience succeeds but the requested audience is *ignored* (not
> conveyed),
> so a passthrough audience validator cannot mint an arbitrarily-audienced
> token
> without authorization.
> h2. Topologies to add
> * A same-subject topology with
> {{delegation.same.subject.requested.audience.enabled=true}} and a
> passthrough
> audience validator (for ACs 1 and 2).
> * Reuse an existing flag-default topology, or add one with the flag
> absent/false, for
> AC 3.
> Each new topology file must be wired into
> {{.github/workflows/build/Dockerfile}} with
> its own {{ADD}} line.
> h2. Dependencies
> * KNOX-3461 must merge to {{master}} before these tests can pass.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
