smolnar82 opened a new pull request, #1409: URL: https://github.com/apache/knox/pull/1409
[KNOX-3460](https://issues.apache.org/jira/browse/KNOX-3460) - Audit all RFC 8693 token-exchange paths and add a mint-time audit ## What changes were proposed in this pull request? Completes the RFC 8693 token-exchange audit trail: - **Handler (pre-mint):** every exchange path now emits an `Action.TOKEN_EXCHANGE` record exactly once. The same-subject path (including the KNOX-3461 requested-audience authorization and its fail-safe default) previously produced no `TOKEN_EXCHANGE` audit — it now audits SUCCESS/FAILURE like delegation. The delegation LDAP-unavailable path now emits an `UNAVAILABLE` record, so every delegation outcome (allow/deny/unavailable) is audited. - **TokenResource (mint-time):** `getJWT()` now emits a `TOKEN_EXCHANGE` SUCCESS audit for exchange-originated mints only, carrying the post-mint fields `jti`, `expiry`, and `issued_subject`. Ordinary (non-exchange) issuance stays unaudited. The pre-mint decision and the mint record share the request's audit correlation id. - Relocated the exchange marker to `CommonTokenConstants.TOKEN_EXCHANGE_REQUEST_ATTR` (value unchanged) so the KNOXTOKEN service can distinguish exchange mints from ordinary issuance. - Minor cleanup: extracted the handler's request-parameter and delegation validation and the delegation branch into helper methods (behavior-preserving). ## How was this patch tested? Automated unit tests (all green): - `TokenExchangeHandlerTest` — same-subject SUCCESS (authorized audience / honoring-off), same-subject FAILURE on audience rejection, delegation UNAVAILABLE on group-lookup failure. - `TokenServiceResourceTest` — mint audit fires with `jti`/`expiry`/`issued_subject` when the exchange marker is set; no mint audit for ordinary issuance. - `JWTFederationFilterTokenExchangeTest` — confirms the constant relocation is transparent. ``` mvn -pl gateway-spi,gateway-provider-security-jwt,gateway-service-knoxtoken -am test -Dtest=TokenExchangeHandlerTest,JWTFederationFilterTokenExchangeTest,TokenServiceResourceTest ``` ## Integration Tests No new integration tests; the change is covered by unit tests at the handler and KNOXTOKEN-service layers. Existing RFC 8693 CI integration suites (KNOX-3465/3466) remain applicable and unaffected. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
