[
https://issues.apache.org/jira/browse/KNOX-3509?focusedWorklogId=1046880&page=com.atlassian.jira.plugin.system.issuetabpanels:worklog-tabpanel#worklog-1046880
]
ASF GitHub Bot logged work on KNOX-3509:
----------------------------------------
Author: ASF GitHub Bot
Created on: 11/Oct/26 23:11
Start Date: 11/Oct/26 23:11
Worklog Time Spent: 10m
Work Description: lmccay commented on code in PR #1448:
URL: https://github.com/apache/knox/pull/1448#discussion_r4243644514
##########
gateway-provider-security-jwt/src/main/java/org/apache/knox/gateway/provider/federation/jwt/filter/K8sDestinationAudienceValidator.java:
##########
@@ -128,13 +158,16 @@ public class K8sDestinationAudienceValidator implements
RequestAudienceValidator
* since the header is expected to carry the routed request path directly.
*/
public static final String PATH_HEADER_FROM_URL_PARAM = PARAM_PREFIX +
"path.header.from.url";
Review Comment:
@hsheinblatt - if this is an existing API in released code then this may be
valid but if it isn't being used by any consumers in an actual release then we
can resolve this as not an issue.
Issue Time Tracking
-------------------
Worklog Id: (was: 1046880)
Time Spent: 1h (was: 50m)
> Extend RequestAudienceValidator for non-delegation, dns form, service-only
> matching, and for act source validation
> ------------------------------------------------------------------------------------------------------------------
>
> Key: KNOX-3509
> URL: https://issues.apache.org/jira/browse/KNOX-3509
> Project: Apache Knox
> Issue Type: Sub-task
> Components: JWT
> Reporter: Harrison Sheinblatt
> Priority: Major
> Time Spent: 1h
> Remaining Estimate: 0h
>
> Extend the RequestAudienceValidator:
> # Enable audience validation of non-delegation tokens
> # Allow audiences in dns service form, for use when there is one trust domain
> # Allow audiences with no path to match all paths: this indicates that the
> audience is intended to show only the allowed service destination, not the
> particular endpoints. When used, the capabilities of the service allowed can
> be specified otherwise, such as with scopes in the future.
> # Allow an opt in check for service account actors to validate that the most
> recent act sub service account matches the source spiffe id from a trusted
> header. This shows that the service account for which the token was issued is
> the one using it, and prevents a leaked token from being used by a different
> source.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
