[
https://issues.apache.org/jira/browse/KNOX-3501?focusedWorklogId=1045900&page=com.atlassian.jira.plugin.system.issuetabpanels:worklog-tabpanel#worklog-1045900
]
ASF GitHub Bot logged work on KNOX-3501:
----------------------------------------
Author: ASF GitHub Bot
Created on: 06/Oct/26 10:33
Start Date: 06/Oct/26 10:33
Worklog Time Spent: 10m
Work Description: moresandeep commented on code in PR #1441:
URL: https://github.com/apache/knox/pull/1441#discussion_r4194222855
##########
gateway-provider-security-jwt/src/main/java/org/apache/knox/gateway/provider/federation/jwt/filter/AbstractJWTFilter.java:
##########
@@ -251,22 +262,95 @@ protected void setJwsTypeVerifier(final FilterConfig
filterConfig, final String
}
protected boolean tokenIsStillValid(final JWT jwtToken) throws
UnknownTokenException {
- Date expires =
getServerManagedStateExpiration(TokenUtils.getTokenId(jwtToken));
+ return tokenIsStillValid(jwtToken, false);
+ }
+
+ /**
+ * @param tolerateUnknownState when true, a token with no server-managed
state record falls back to
+ * its own {@code exp} claim instead of raising {@link
UnknownTokenException}; see
+ * {@link #ALLOW_UNKNOWN_COOKIE_TOKEN_STATE}.
+ */
+ protected boolean tokenIsStillValid(final JWT jwtToken, final boolean
tolerateUnknownState) throws UnknownTokenException {
+ return tokenIsStillValid(jwtToken,
+ resolveServerManagedState(TokenUtils.getTokenId(jwtToken),
tolerateUnknownState, null));
+ }
+
+ private boolean tokenIsStillValid(final JWT jwtToken, final
ServerManagedState state) {
+ Date expires = state.getExpiration();
if (expires == null) {
// if there is no expiration date then the lifecycle is tied entirely to
// the cookie validity - otherwise ensure that the current time is before
// the designated expiration time
expires = jwtToken.getExpiresDate();
+ if (expires == null && state.isAbsentTolerated()) {
+ /*
+ * Tolerating absent state means deferring to the token's own exp
claim, so there has to
+ * be one. With neither a state record nor an exp claim the cookie has
no expiry at all,
+ * it would authenticate forever, and (state being absent) could never
be revoked which
+ * would be a problem so reject it.
+ */
+
log.toleratedCookieTokenHasNoExpiry(Tokens.getTokenIDDisplayText(TokenUtils.getTokenId(jwtToken)),
+ ALLOW_UNKNOWN_COOKIE_TOKEN_STATE);
+ return false;
+ }
}
return expires == null || new Date().before(expires);
}
protected boolean tokenIsStillValid(final String tokenId) throws
UnknownTokenException {
- Date expires = getServerManagedStateExpiration(tokenId);
+ Date expires = resolveServerManagedState(tokenId, false,
null).getExpiration();
return expires == null || (new Date().before(expires));
}
- private Date getServerManagedStateExpiration(final String tokenId) throws
UnknownTokenException {
+ /**
+ * The outcome of consulting server-managed token state for one request.
+ *
+ * <p>A null {@link #getExpiration()} is ambiguous on its own, it covers
+ * 1. "no state service configured",
+ * 2. "token carries no knox.id",
+ * 3. "state record holds no expiry" and
+ * 4. "no state record exists".
+ * {@link #isAbsentTolerated()} singles out the last case ("no state record
exists"),
+ * and only when explicitly opted in,
+ * so that callers can treat a absent record differently from a token Knox
+ * has no opinion about.
+ */
+ private static final class ServerManagedState {
Review Comment:
Thanks for the review @smolnar82! I do agree that
1. The ServerManagedState class buys us less in short term
2. The name of the class is misleading.
The reason for the class was so that we have a way to expand the checks in
the future for token state service, currently there is only boolean state
exists or no, if no then we have other options now (with this patch) the idea
was to encapsulate this logic in the inner class.
Perhaps we can take this up next time we encounter this issue, let me rework
the patch.
Issue Time Tracking
-------------------
Worklog Id: (was: 1045900)
Time Spent: 40m (was: 0.5h)
> JWT cookie tokens fail validation when knox.token.exp.server-managed=true
> -------------------------------------------------------------------------
>
> Key: KNOX-3501
> URL: https://issues.apache.org/jira/browse/KNOX-3501
> Project: Apache Knox
> Issue Type: Bug
> Components: Server
> Reporter: Sandeep More
> Assignee: Sandeep More
> Priority: Major
> Time Spent: 40m
> Remaining Estimate: 0h
>
> Currently, JWT tokens in a cookie (e.g. hadoop-jwt) fail validation when
> `knox.token.exp.server-managed=true` We need a way to ensure that the
> validation passes for hadoop-jwt even when
> `knox.token.exp.server-managed=true` .
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
