[
https://issues.apache.org/jira/browse/KNOX-3509?focusedWorklogId=1047119&page=com.atlassian.jira.plugin.system.issuetabpanels:worklog-tabpanel#worklog-1047119
]
ASF GitHub Bot logged work on KNOX-3509:
----------------------------------------
Author: ASF GitHub Bot
Created on: 13/Oct/26 01:09
Start Date: 13/Oct/26 01:09
Worklog Time Spent: 10m
Work Description: hsheinblatt commented on code in PR #1448:
URL: https://github.com/apache/knox/pull/1448#discussion_r4253756496
##########
gateway-provider-security-jwt/src/main/java/org/apache/knox/gateway/provider/federation/jwt/filter/K8sDestinationAudienceValidator.java:
##########
@@ -128,13 +158,16 @@ public class K8sDestinationAudienceValidator implements
RequestAudienceValidator
* since the header is expected to carry the routed request path directly.
*/
public static final String PATH_HEADER_FROM_URL_PARAM = PARAM_PREFIX +
"path.header.from.url";
Review Comment:
The validator is new. I don't think there has been a release since it was
added. And the extensibility model is to add a new validator. I believe it
should be OK to change this.
##########
gateway-provider-security-jwt/src/main/java/org/apache/knox/gateway/provider/federation/jwt/filter/K8sDestinationAudienceValidator.java:
##########
@@ -401,10 +768,16 @@ private static String paramOrDefault(final FilterConfig
filterConfig, final Stri
return (value == null || value.isEmpty()) ? defaultValue : value;
}
+ /**
+ * Splits on {@code ,} and trims each entry, but does not drop an entry that
trims to empty --
+ * for example a stray {@code ,,} or a trailing {@code ,} in {@link
#CLUSTER_DOMAINS_PARAM}.
+ * This is operator-supplied configuration, not request data, so it is
validated strictly: an
+ * empty entry is passed through to {@link ClusterDomain#parse(String)},
which rejects it, the
+ * same as any other malformed entry, rather than being silently discarded
here.
+ */
private static List<String> parseCommaSeparated(final String
commaSeparatedList) {
return Arrays.stream(commaSeparatedList.split(","))
Review Comment:
Fixed
Issue Time Tracking
-------------------
Worklog Id: (was: 1047119)
Time Spent: 2h (was: 1h 50m)
> Extend RequestAudienceValidator for non-delegation, dns form, service-only
> matching, and for act source validation
> ------------------------------------------------------------------------------------------------------------------
>
> Key: KNOX-3509
> URL: https://issues.apache.org/jira/browse/KNOX-3509
> Project: Apache Knox
> Issue Type: Sub-task
> Components: JWT
> Reporter: Harrison Sheinblatt
> Priority: Major
> Time Spent: 2h
> Remaining Estimate: 0h
>
> Extend the RequestAudienceValidator:
> # Enable audience validation of non-delegation tokens
> # Allow audiences in dns service form, for use when there is one trust domain
> # Allow audiences with no path to match all paths: this indicates that the
> audience is intended to show only the allowed service destination, not the
> particular endpoints. When used, the capabilities of the service allowed can
> be specified otherwise, such as with scopes in the future.
> # Allow an opt in check for service account actors to validate that the most
> recent act sub service account matches the source spiffe id from a trusted
> header. This shows that the service account for which the token was issued is
> the one using it, and prevents a leaked token from being used by a different
> source.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
