[jira] [Work logged] (KNOX-3460) Audit all token-exchange flows including minted token fields

[ASF GitHub Bot (Jira)]

     [ 
https://issues.apache.org/jira/browse/KNOX-3460?focusedWorklogId=1042344&page=com.atlassian.jira.plugin.system.issuetabpanels:worklog-tabpanel#worklog-1042344
 ]

ASF GitHub Bot logged work on KNOX-3460:
----------------------------------------

                Author: ASF GitHub Bot
            Created on: 17/Sep/26 12:25
            Start Date: 17/Sep/26 12:25
    Worklog Time Spent: 10m 
      Work Description: github-actions[bot] commented on PR #1409:
URL: https://github.com/apache/knox/pull/1409#issuecomment-5714318471

   ## Test Results
     5 files    5 suites   32s ⏱️
   101 tests 101 ✅ 0 💤 0 ❌
   119 runs  119 ✅ 0 💤 0 ❌
   
   Results for commit c029de9c.
   
   
[test-results]:data:application/gzip;base64,H4sIADjcq2oC/13MyQ7CIBSF4VdpWLvg0kGuL2MYE2JbDMPK+O4iqYguv/8k50GsW00kl2E+DSRmlxp0DiI5vxeOrLgs6b0BhY+uMSv1n27uXhJtwQq3/gQTgg9HCXmvn4AH2mVXvo/V3WF1/6f8trlUQBRlqA0qmJjhMI+aC3VeAGHRFHGSlkuOUkjyfAF64OnCBAEAAA==
   




Issue Time Tracking
-------------------

    Worklog Id:     (was: 1042344)
    Time Spent: 0.5h  (was: 20m)

> Audit all token-exchange flows including minted token fields
> ------------------------------------------------------------
>
>                 Key: KNOX-3460
>                 URL: https://issues.apache.org/jira/browse/KNOX-3460
>             Project: Apache Knox
>          Issue Type: Sub-task
>          Components: Server
>    Affects Versions: 3.1.0
>            Reporter: Sandor Molnar
>            Assignee: Sandor Molnar
>            Priority: Major
>             Fix For: 3.1.0
>
>          Time Spent: 0.5h
>  Remaining Estimate: 0h
>
> Only the delegation policy decision is audited today (TokenExchangeHandler 
> success/failure inside the delegation branch). The same-subject exchange path 
> emits no TOKEN_EXCHANGE audit record at all (only the generic AUTHENTICATION 
> audit from the shared {{{}continueWithEstablishedSecurityContext{}}}). 
> Minted-token fields — jti, expiry, issued_subject — are unauditable from the 
> filter because they only exist after TokenResource mints the token, and 
> TokenResource has no auditing whatsoever today.
> *Scope:*
>  # Audit all three exchange paths in the handler with the fields known 
> pre-mint (incl. same-subject).
>  # Add a TOKEN_EXCHANGE mint-time audit in TokenResource.getJWT() for 
> exchange-originated mints, emitting jti/expiry/issued_subject
> *Explicitly out of scope:* auditing ordinary (non-exchange) token issuance.



--
This message was sent by Atlassian Jira
(v8.20.10#820010)