[
https://issues.apache.org/jira/browse/KNOX-3501?focusedWorklogId=1045707&page=com.atlassian.jira.plugin.system.issuetabpanels:worklog-tabpanel#worklog-1045707
]
ASF GitHub Bot logged work on KNOX-3501:
----------------------------------------
Author: ASF GitHub Bot
Created on: 05/Oct/26 12:35
Start Date: 05/Oct/26 12:35
Worklog Time Spent: 10m
Work Description: moresandeep opened a new pull request, #1441:
URL: https://github.com/apache/knox/pull/1441
[KNOX-3501](https://issues.apache.org/jira/browse/KNOX-3501) - JWT cookie
tokens fail validation when `knox.token.exp.server-managed=true`
## What changes were proposed in this pull request?
### Problem
Currently, JWT tokens in a cookie (e.g. `hadoop-jwt`) fail validation when
`knox.token.exp.server-managed=true`.
There are cases where token mangement is turned on AND knox tokens are
issued from other knox service (e,g, KnoxSSO) tokens of which are not tracked
in the knox instance where request is received.
To address this issue, we need a way to ensure that the validation passes
for hadoop-jwt even when `knox.token.exp.server-managed=true` .
### Proposed Fix
The proposed fix adds a parameter to topology
`knox.token.allow.unknown.cookie.state` (default `false`). When this flag is
set to `true` AND token state is enabled (i.e.
`knox.token.exp.server-managed`=`true`) Knox will rely on the expiry of the
cookie JWT and not throw a `UnknownTokenException`
### Edge cases
In case where the cookie does not have expiry this token would work forever,
to prevent this we reject tokens that *do not have expiry*
### Future work
There appears a patch in websockets which probably needs to be handled. The
scope of this fix is limited to JWTProvider and KnoxSSO.
### Example topology config
```
<provider>
<role>federation</role>
<name>JWTProvider</name>
<enabled>true</enabled>
<!
Issue Time Tracking
-------------------
Worklog Id: (was: 1045707)
Remaining Estimate: 0h
Time Spent: 10m
> JWT cookie tokens fail validation when knox.token.exp.server-managed=true
> -------------------------------------------------------------------------
>
> Key: KNOX-3501
> URL: https://issues.apache.org/jira/browse/KNOX-3501
> Project: Apache Knox
> Issue Type: Bug
> Components: Server
> Reporter: Sandeep More
> Assignee: Sandeep More
> Priority: Major
> Time Spent: 10m
> Remaining Estimate: 0h
>
> Currently, JWT tokens in a cookie (e.g. hadoop-jwt) fail validation when
> `knox.token.exp.server-managed=true` We need a way to ensure that the
> validation passes for hadoop-jwt even when
> `knox.token.exp.server-managed=true` .
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
