[
https://issues.apache.org/jira/browse/KNOX-3460?focusedWorklogId=1042572&page=com.atlassian.jira.plugin.system.issuetabpanels:worklog-tabpanel#worklog-1042572
]
ASF GitHub Bot logged work on KNOX-3460:
----------------------------------------
Author: ASF GitHub Bot
Created on: 18/Sep/26 08:03
Start Date: 18/Sep/26 08:03
Worklog Time Spent: 10m
Work Description: smolnar82 commented on PR #1409:
URL: https://github.com/apache/knox/pull/1409#issuecomment-5727089106
> Thanks Sandor, looks good to me. Now we audit all the authorization
decisions along with the exchange minting, and the refactor into helpers makes
the handle method more readable.
>
> I had thought we'd want to audit all failures. I think for SOC (number?)
or FedRamp all request failures would need to be audited. We don't necessarily
need to comply with any compliance specs, but it would limit use. Perhaps that
opens us up to flooding the audit logs on DOS attacks and we want to avoid it,
though I'd think in an enterprise deployment you'd have to handle that already
via other/external means.
You're right that all request failures should be audited; limiting
compliance use isn't worth it. I've added auditing for every rejection,
capturing who made the invalid request and (where known) for whom, with a
reason code on each. The flooding concern is handled: the reason codes let
downstream processing aggregate or rate-limit, on top of the external
protections an enterprise deployment would already have. Tests added for each
case.
Issue Time Tracking
-------------------
Worklog Id: (was: 1042572)
Time Spent: 50m (was: 40m)
> Audit all token-exchange flows including minted token fields
> ------------------------------------------------------------
>
> Key: KNOX-3460
> URL: https://issues.apache.org/jira/browse/KNOX-3460
> Project: Apache Knox
> Issue Type: Sub-task
> Components: Server
> Affects Versions: 3.1.0
> Reporter: Sandor Molnar
> Assignee: Sandor Molnar
> Priority: Major
> Fix For: 3.1.0
>
> Time Spent: 50m
> Remaining Estimate: 0h
>
> Only the delegation policy decision is audited today (TokenExchangeHandler
> success/failure inside the delegation branch). The same-subject exchange path
> emits no TOKEN_EXCHANGE audit record at all (only the generic AUTHENTICATION
> audit from the shared {{{}continueWithEstablishedSecurityContext{}}}).
> Minted-token fields — jti, expiry, issued_subject — are unauditable from the
> filter because they only exist after TokenResource mints the token, and
> TokenResource has no auditing whatsoever today.
> *Scope:*
> # Audit all three exchange paths in the handler with the fields known
> pre-mint (incl. same-subject).
> # Add a TOKEN_EXCHANGE mint-time audit in TokenResource.getJWT() for
> exchange-originated mints, emitting jti/expiry/issued_subject
> *Explicitly out of scope:* auditing ordinary (non-exchange) token issuance.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
