[
https://issues.apache.org/jira/browse/KNOX-3476?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Sandor Molnar updated KNOX-3476:
--------------------------------
Status: Patch Available (was: Open)
> CI Gate - Cross-Subject Delegation Exchange with Policy Enforcement Tests
> Pass in CI
> ------------------------------------------------------------------------------------
>
> Key: KNOX-3476
> URL: https://issues.apache.org/jira/browse/KNOX-3476
> Project: Apache Knox
> Issue Type: Task
> Components: CI
> Affects Versions: 3.1.0
> Reporter: Sandor Molnar
> Assignee: Sandor Molnar
> Priority: Major
> Fix For: 3.1.0
>
> Time Spent: 20m
> Remaining Estimate: 0h
>
> As a KnoxIDF client, I want CI evidence that the full delegation path
> including policy evaluation, LDAP group lookup, act chain, per-policy TTL,
> and headless delegation gating works end-to-end through a running Knox
> gateway.
> *ACCEPTANCE CRITERIA:*
> # A new integration test file for delegation tests is added and runs in the
> default CI build.
> # A successful delegation exchange with a user-based policy produces an
> issued token with correct sub, act, aud, iss (scope is deferred now) values.
> # A delegation exchange where the subject user is in an allowed LDAP group
> succeeds
> # When multiple delegation policies are registered for different actors,
> each actor can only access the resources in its own policy. Attempting to use
> one actor's policy for another actor's resource fails.
> # A delegation exchange where the subject user is not in the required LDAP
> group returns invalid_request.
> # An exchange by an actor with no registered policy returns invalid_request.
> # An exchange requesting a resource not in the policy returns
> invalid_request.
> # An exchange where the policy max token TTL is shorter than the
> service-level TTL produces an issued token with a lifetime at or below the
> policy max.
> # A headless delegation exchange succeeds when the policy allows it and
> fails with invalid_request when the policy does not.
> # Deferred: An exchange requesting a scope not allowed for the requested
> resource returns invalid_request.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
