[
https://issues.apache.org/jira/browse/KNOX-3464?focusedWorklogId=1042402&page=com.atlassian.jira.plugin.system.issuetabpanels:worklog-tabpanel#worklog-1042402
]
ASF GitHub Bot logged work on KNOX-3464:
----------------------------------------
Author: ASF GitHub Bot
Created on: 17/Sep/26 15:43
Start Date: 17/Sep/26 15:43
Worklog Time Spent: 10m
Work Description: smolnar82 opened a new pull request, #1410:
URL: https://github.com/apache/knox/pull/1410
[KNOX-3464](https://issues.apache.org/jira/browse/KNOX-3464) - Document
KnoxIDF RFC 8693 token exchange & delegation
## What changes were proposed in this pull request?
Documents the previously-undocumented KnoxIDF RFC 8693 Token Exchange &
Delegation feature in the `knox-site/` MkDocs site, and corrects/fills gaps
found while auditing the KnoxIDF reference pages against the source.
Documentation only - no code changes.
**New page**
- `knoxidf/token_exchange.md` — the conceptual home for the feature:
same-subject vs delegated (actor-token / headless) exchange, delegation
policies (`(actorAuthority, actorId)` keying,
`canActForUsers`/`canActForGroups`, `allowHeadlessExchange`, `tokenTtlSec`,
`resourcePolicy`, evaluation order, generic-denial and LDAP fail-closed
behavior), requested-audience enforcement, token lifetime, actor-chain depth
cap, Kubernetes ServiceAccount subjects, the delegation-policy admin API, a
config summary, and `curl` examples.
**Reference-page edits**
- `endpoints.md` — Token Exchange grant subsection, Delegation Policies
admin section + summary row, and a note that registration is served only by
`/client/register` (the bare `/client` GET/POST are unimplemented and return
500).
- `configuration.md` — new Token-exchange/delegation and
Delegation-policy-service tables; **corrected** dead trusted issuer discovery
keys (`gateway.trustedoidcissuer.*` →
`gateway.trusted.oidc.issuer.discovery.*`) and DB TLS truststore keys
(`.path`/`.alias` → `.file`/`.type` + `.verify.server.cert`); **added**
`gateway.signing.key.passphrase.alias` an `knoxidf.custom.loopback.hosts`;
fixed a broken `.html` cross-link.
- `security.md` — Delegation authorization section; custom-loopback-hosts
note.
- `operations.md` — delegation-policy persistence subsection;
token-exchange/delegation audit-field table.
- `index.md` — token exchange / delegation capability row.
- `config_knox_token.md` — clarifying note that classic KNOXTOKEN
`expires_in` is an absolute epoch-ms timestamp while KnoxIDF returns RFC 6749
relative seconds.
- `mkdocs.yml` — nav entry for the new page.
All parameter names, defaults, endpoints, and error codes were verified
against the source constants.
## How was this patch tested?
- `mkdocs build --strict` — builds with **zero** warnings referencing any
`knoxidf/` page and the new `token_exchange.md`. (The 11 remaining strict
warnings are all pre-existing, unrelated issues on other pages: nav entries for
not-yet-written files and legacy `.html` links in
`knox_cli.md`/`service_oozie.md`.)
- Cross-page anchors added by this change were verified to resolve.
- Each documented config key / endpoint / error code was grep-verified
against the Java source (`--include=*.java`) to confirm exact strings and
defaults.
## Integration Tests
N/A
## UI changes
N/A
Issue Time Tracking
-------------------
Worklog Id: (was: 1042402)
Remaining Estimate: 0h
Time Spent: 10m
> Document delegation policy and trusted OIDC features in KnoxIDF
> ---------------------------------------------------------------
>
> Key: KNOX-3464
> URL: https://issues.apache.org/jira/browse/KNOX-3464
> Project: Apache Knox
> Issue Type: Sub-task
> Components: Document
> Affects Versions: 3.1.0
> Reporter: Sandor Molnar
> Assignee: Sandor Molnar
> Priority: Major
> Fix For: 3.1.0
>
> Time Spent: 10m
> Remaining Estimate: 0h
>
> Lots of changes went in w/o documentation. We need to enhance existing
> KnoxIDF documents with the details.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
