smolnar82 opened a new pull request, #1416: URL: https://github.com/apache/knox/pull/1416
[KNOX-3476](https://issues.apache.org/jira/browse/KNOX-3476) - Add end-to-end integration tests for the RFC 8693 delegation path ## What changes were proposed in this pull request? Adds CI-only integration coverage for the full RFC 8693 delegation path through a running Knox gateway (no product code changed): - **`.github/workflows/tests/test_delegation.py`**: drives the delegation path against seeded per-actor policies (registered via the `KNOXIDF_ADMIN` REST API): - AC2 user policy, - AC3 group policy, - AC4 multi-actor isolation, - AC5 subject-not-in-group deny, - AC6 no-policy deny, - AC7 resource-not-in-policy deny, - AC8 policy TTL caps token lifetime, - AC9 headless succeed/deny. Denials assert the RFC 6749 §5.2 `invalid_request` body. - **`.github/workflows/tests/delegation_helpers.py`**: shared `token_exchange` / `assert_oauth_error` / `aud_values` helpers and a `DelegationPolicyAdmin` client, extracted from `test_token_exchange.py` so both suites use one implementation. - **`.github/workflows/build/conf/topologies/knoxidf-token-delegation-policy.xml`**: new topology that mints the delegation result (server delegation + requested-subject/audience enforcement, nested `act` claim, passthrough audience validator, large service TTL so a shorter per-policy TTL is provably what caps lifetime). The suite deliberately does not revoke the tokens it mints and uses `recursiveUser`/`sam` as actors and `tom` as subject — none of which any other suite mints against a per-user-limited topology — so its footprint on the gateway-wide token store cannot exhaust another user's quota. This keeps the tests correct without token management, matching the production posture where token management is not enabled for tokens involved in RFC 8693 exchanges. ## How was this patch tested? Ran the full Docker Compose integration suite locally: **101 passed**; see below ## Integration Tests ``` tests-1 | ------------------------------------ tests-1 | Your code has been rated at 10.00/10 tests-1 | tests-1 | Waiting for knox... tests-1 | ============================= test session starts ============================== tests-1 | platform linux -- Python 3.10.20, pytest-9.0.3, pluggy-1.6.0 tests-1 | rootdir: /tests tests-1 | collected 101 items tests-1 | tests-1 | test_delegation.py ......... [ 8%] tests-1 | test_health.py ..... [ 13%] tests-1 | test_k8s_delegation.py ... [ 16%] tests-1 | test_k8s_serviceaccount_validation.py ...... [ 22%] tests-1 | test_knox_admin_path_traversal.py ... [ 25%] tests-1 | test_knox_auth_service_and_ldap.py ... [ 28%] tests-1 | test_knox_configs.py . [ 29%] tests-1 | test_knox_ldap_cache.py ... [ 32%] tests-1 | test_knox_ldap_injection.py ....... [ 39%] tests-1 | test_knox_ldap_proxy_search.py ......... [ 48%] tests-1 | test_knoxauth_preauth_and_paths.py ...... [ 54%] tests-1 | test_knoxidf.py ...... [ 60%] tests-1 | test_knoxsso_redirect.py . [ 61%] tests-1 | test_knoxtoken_jwt.py .................... [ 81%] tests-1 | test_remote_auth.py ... [ 84%] tests-1 | test_remoteauth_extauthz_additional_path.py .... [ 88%] tests-1 | test_token_exchange.py ............ [100%] tests-1 | tests-1 | =============================== warnings summary =============================== ... tests-1 | -- Docs: https://docs.pytest.org/en/stable/how-to/capture-warnings.html tests-1 | ----------------- generated xml file: /tests/test-results.xml ------------------ tests-1 | ====================== 101 passed, 93 warnings in 24.09s ======================= tests-1 exited with code 0 Aborting on container exit... Container compose-tests-1 Stopping Container compose-tests-1 Stopped Config w Enable Watch d Detach ``` ## UI changes N/A -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
