moresandeep opened a new pull request, #1425: URL: https://github.com/apache/knox/pull/1425
[KNOX-3478](https://issues.apache.org/jira/browse/KNOX-3478) - Add support to forward auth tokens in KNOX-AUTH-SERVICE ## What changes were proposed in this pull request? Downstream services increasingly need the caller's **JWT bearer token** itself, not just the resolved username — e.g. to re-validate it, to extract scopes, or to call a third service on the user's behalf. There is currently no way to get it: the token is consumed and discarded by `JWTFederationFilter`, and nothing carries it forward. This PR fixes this by setting the new **`preauth.auth.header.auth.token.name`** service parameter on `KNOX-AUTH-SERVICE` and making `auth/api/v1/pre` and `auth/api/v1/extauthz` return the caller's token in the named response header, which the calling proxy then copies onto the downstream request. The header name that enables this feature is **`preauth.auth.header.auth.token.name`** . By default this feature is OFF i.e. auth tokens are no propagated downstream by default. ## How was this patch tested? This patch was tested locally. ## Integration Tests Added `.github/workflows/tests/test_knoxauth_token_forwarding.py` (11 tests) plus three topology fixtures, all picked up by the existing default `tests` service with no `tests.yml` or compose change — these topologies coexist with the base gateway config, so they don't need a dedicated step. | Topology | Scenario | |---|---| | `knoxauthtoken.xml` | parameter set ⇒ token forwarded | | `knoxauthtokenlimit.xml` | `size.limit=16`, below any real JWT ⇒ omitted, still 200 | | `knoxauthtokencollide.xml` | token name == actor id name ⇒ token dropped, identity kept | | `knoxtoken.xml`, `knoxldap.xml` | **unchanged** — negative controls proving the feature stays opt-in | All three new topologies configure `group.principal.mapping = guest=forwarded-token-group`. That is deliberate, not decoration: it makes `groupsMapped` true so every request goes through the identity-assertion re-wrap described above. That branch is the one a unit test can most easily pass while the real code path drops the token, so `test_forwarded_token_survives_the_identity_assertion_rewrap` asserts the mapped group **and** the token in the same response — if the mapping ever stops running, the test fails loudly instead of passing vacuously. Coverage: byte-identical JWT with no `Bearer` prefix; `sub` naming the original caller alongside `X-Knox-Actor-ID`; `Cache-Control: no-store` present when a token is emitted and absent when it isn't; no header when the parameter is unset; none for a Basic-auth caller; oversized token omitted at 200; collision preserving the identity; 401 with no header for unauthenticated and for a tampered token. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
