[
https://issues.apache.org/jira/browse/KNOX-3475?focusedWorklogId=1042628&page=com.atlassian.jira.plugin.system.issuetabpanels:worklog-tabpanel#worklog-1042628
]
ASF GitHub Bot logged work on KNOX-3475:
----------------------------------------
Author: ASF GitHub Bot
Created on: 18/Sep/26 10:55
Start Date: 18/Sep/26 10:55
Worklog Time Spent: 10m
Work Description: smolnar82 opened a new pull request, #1414:
URL: https://github.com/apache/knox/pull/1414
[KNOX-3475](https://issues.apache.org/jira/browse/KNOX-3475) - Enforce
delegation policy `status` at authorization time
## What changes were proposed in this pull request?
A KnoxIDF delegation policy (RFC 8693 token exchange) carries a `status`
field (`active` / `revoked`). The status was validated at the REST layer and
stored, but **never read at authorization time**:
`JdbcDelegationPolicyService.evaluate(...)` looked the policy up by actor and
then checked headless/user/group/resource/scope, never the status. So a policy
that was *revoked instead of deleted* (its row still present with
`status="revoked"`) kept authorizing exchanges.
This PR closes that gap:
- **`gateway-spi` `DelegationPolicy`** — add canonical
`STATUS_ACTIVE`/`STATUS_REVOKED` constants and an `isActive()` helper (true
only for exactly `"active"`; revoked, null, or any unknown value is treated as
not-active — fail-safe).
- **`gateway-server` `JdbcDelegationPolicyService.evaluate()`** — new **Step
1.5** immediately after the actor lookup: `if (!policy.isActive()) return
deny("policy_not_active")`. It short-circuits before any
user/group/resource/scope check, so a revoked-but-present policy can never
authorize. `H2DBDelegationPolicyService` (the embedded-H2 backend that runs in
production) inherits `evaluate()` and therefore the check.
- **`gateway-service-knoxidf` `DelegationPolicyRequest`** — point its status
constants at the SPI ones (single source of truth; no behavior change).
Client-facing effect: a revoked actor's delegation exchange is rejected as
every other policy denial is — `400 invalid_request` / "The token exchange
request is rejected by policy".
## How was this patch tested?
Automated unit tests (all green):
- `DelegationPolicyTest.isActiveOnlyForExactlyActiveStatus` — `active` →
true; `revoked`, `null`, and an unknown value → false.
- `JdbcDelegationPolicyServiceTest`:
- `testEvaluateDenyRevokedPolicy` — a registered `revoked` policy denies
with `policy_not_active` and `effectiveTtlSec== 0`.
- `testEvaluateDenyAfterPolicyUpdatedToRevoked` — the exact JIRA scenario:
an `active` policy authorizes, then the **same record** is updated to `revoked`
→ denied.
- `H2DBDelegationPolicyServiceTest.shouldDenyEvaluateWhenPolicyRevoked` —
proves the inherited check fires on the embedded-H2 subclass used in production.
Run with `mvn -pl gateway-spi,gateway-server,gateway-service-knoxidf test`
(build/install `gateway-spi` first, or use `-am`).
## Integration Tests
Added
`test_token_exchange.py::test_delegation_exchange_denied_after_policy_revoked`
- the suite's first end-to-end happy-path delegation exchange. Via the
`KNOXIDF_ADMIN` REST API (`knoxidf-admin` topology) it seeds an **active**
`(USER, guest)` policy, proves the delegation exchange succeeds (200 +
`access_token`), PUTs `status=revoked` on the **same record** (full-replace —
the "revoked, not deleted" scenario), then replays the identical exchange (same
tokens, same resource) and asserts it is now rejected with `400
invalid_request` / "rejected by policy". No topology changes were needed: the
policy store is a gateway-wide singleton, so a policy registered via
`knoxidf-admin` is seen by the exchange on `knoxidf-token-delegation`.
Full docker-compose suite:
```
tests-1 |
-------------------------------------------------------------------
tests-1 | Your code has been rated at 10.00/10 (previous run: 9.97/10,
+0.03)
tests-1 |
tests-1 | Waiting for knox...
tests-1 | ============================= test session starts
==============================
tests-1 | platform linux
Issue Time Tracking
-------------------
Worklog Id: (was: 1042628)
Remaining Estimate: 0h
Time Spent: 10m
> Delegation policy enforcement in JdbcDelegationPolicyService.evaluate() must
> check status
> -----------------------------------------------------------------------------------------
>
> Key: KNOX-3475
> URL: https://issues.apache.org/jira/browse/KNOX-3475
> Project: Apache Knox
> Issue Type: Sub-task
> Components: JWT
> Reporter: Harrison Sheinblatt
> Assignee: Sandor Molnar
> Priority: Major
> Time Spent: 10m
> Remaining Estimate: 0h
>
> There's no check the status is active before using the policy currently. If a
> policy is not deleted but instead updated with revoked status, then the
> policy should not be applied. Unit tests need to be added as well.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
