moresandeep opened a new pull request, #1441: URL: https://github.com/apache/knox/pull/1441
[KNOX-3501](https://issues.apache.org/jira/browse/KNOX-3501) - JWT cookie tokens fail validation when `knox.token.exp.server-managed=true` ## What changes were proposed in this pull request? ### Problem Currently, JWT tokens in a cookie (e.g. `hadoop-jwt`) fail validation when `knox.token.exp.server-managed=true`. There are cases where token mangement is turned on AND knox tokens are issued from other knox service (e,g, KnoxSSO) tokens of which are not tracked in the knox instance where request is received. To address this issue, we need a way to ensure that the validation passes for hadoop-jwt even when `knox.token.exp.server-managed=true` . ### Proposed Fix The proposed fix adds a parameter to topology `knox.token.allow.unknown.cookie.state` (default `false`). When this flag is set to `true` AND token state is enabled (i.e. `knox.token.exp.server-managed`=`true`) Knox will rely on the expiry of the cookie JWT and not throw a `UnknownTokenException` ### Edge cases In case where the cookie does not have expiry this token would work forever, to prevent this we reject tokens that *do not have expiry* ### Future work There appears a patch in websockets which probably needs to be handled. The scope of this fix is limited to JWTProvider and KnoxSSO. ### Example topology config ``` <provider> <role>federation</role> <name>JWTProvider</name> <enabled>true</enabled> <!-- read the cookie --> <param><name>knox.token.use.cookie</name><value>true</value></param> <param><name>knox.token.cookie.name</name><value>hadoop-jwt</value></param> <!-- trust the issuing gateway --> <param><name>knox.token.verification.pem</name><value>MIICxjCCAa4CCQ...</value></param> <param><name>jwt.expected.issuer</name><value>KNOXSSO</value></param> <!-- server-managed state is on, but these cookies have none --> <param><name>knox.token.exp.server-managed</name><value>true</value></param> <param><name>knox.token.allow.unknown.cookie.state</name><value>true</value></param> </provider> ``` ## How was this patch tested? This patch was tested locally. using the above config. Following are the logs ``` ==> install/knox-3.1.0-SNAPSHOT/logs/gateway.log <== 2026-10-05 08:23:06,076 c2580d1f-2fb0-489b-949e-3fab36616d30 ERROR token.state (DefaultTokenStateService.java:validateToken(367)) - Unknown token 59f7919c...434c083aab29 2026-10-05 08:23:06,077 c2580d1f-2fb0-489b-949e-3fab36616d30 WARN federation.jwt (AbstractJWTFilter.java:resolveServerManagedState(372)) - No server-managed token state found for cookie token (59f7919c...434c083aab29); falling back to the token's own expiration. knox.token.allow.unknown.cookie.state is enabled. ==> install/knox-3.1.0-SNAPSHOT/logs/gateway-audit.log <== 26/10/05 08:23:06 ||c2580d1f-2fb0-489b-949e-3fab36616d30|audit|127.0.0.1|KNOX-AUTH-SERVICE|admin|||authentication|uri|/gateway/token/auth/api/v1/pre|success| 26/10/05 08:23:06 ||c2580d1f-2fb0-489b-949e-3fab36616d30|audit|127.0.0.1|KNOX-AUTH-SERVICE|admin|||identity-mapping|principal|admin|success|Groups: [] 26/10/05 08:23:06 ||c2580d1f-2fb0-489b-949e-3fab36616d30|audit|127.0.0.1|KNOX-AUTH-SERVICE|admin|||access|uri|/gateway/token/auth/api/v1/pre|success|Response status: 200 ``` ## Integration Tests (Please add or update integration tests [`.github/workflows/tests`](.github/workflows/tests) for the feature you are adding. If no unit test is added, please explain why. Check out [`.github/workflows/tests/README.md`](./workflows/tests/README.md) for instructions) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
