moresandeep commented on PR #1461: URL: https://github.com/apache/knox/pull/1461#issuecomment-6320975815
> The description has no "How was this patch tested?" section, please add that. > > Separately, correct the JIRA description itself: BC does check iPAddress SANs, and the real cause is the null hostname. > > Additionally, with `HttpClient`, IP-literal JWKS hosts work under BC-FIPS: the host reaches the socket and the iPAddress SAN is matched. The KNOX-3498 diagnostics are now misleading, since they say it's "not a truststore problem, use a DNS hostname". Please remove them: > > * https://github.com/apache/knox/blob/038a1332f32eae4b7d38f7239089b35a17855864/gateway-server/src/main/java/org/apache/knox/gateway/services/token/impl/DefaultTokenAuthorityService.java#L375-L382 > > * https://github.com/apache/knox/blob/038a1332f32eae4b7d38f7239089b35a17855864/gateway-server/src/main/java/org/apache/knox/gateway/services/token/impl/DefaultTokenAuthorityService.java#L422-L432 > > * https://github.com/apache/knox/blob/962e3ee6b534262d517161581791b42df93becc3/gateway-server/src/main/java/org/apache/knox/gateway/services/token/impl/TokenAuthorityServiceMessages.java#L36-L47 > > > Please also remove the now-unused imports. `jwksVerificationFailed` already logs the real cause. I made all the changes except the last one, i don't want to change the code and messages in a hurry so I filed a JIRA to handle this https://issues.apache.org/jira/browse/KNOX-3524 -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
