smolnar82 opened a new pull request, #1488: URL: https://github.com/apache/knox/pull/1488
[KNOX-3548](https://issues.apache.org/jira/browse/KNOX-3548) - KnoxIDF: allow advertising the authorization and client registration endpoints on other topologies ## What changes were proposed in this pull request? Two new optional `KNOXIDF` service params tell the discovery documents to advertise an endpoint on another topology. They work the same way `token.exchange.topology.name` already does for the token endpoint: | Param | Moves | |---|---| | `authorization.topology.name` | `authorization_endpoint` | | `client.registration.topology.name` | `registration_endpoint` | This makes it possible to split the authorization code flow across topologies that use different authentication: `/authorize` on an SSO-fronted topology, `/token` on one that accepts client credentials, and client registration on one that accepts bearer tokens. All of them still publish one discovery document, from a single topology. - The params apply to both the OIDC discovery document (`/.well-known/openid-configuration`) and the RFC 8414 metadata document (`/.well-known/oauth-authorization-server`, both paths). Both documents are built by `AuthorizationServerMetadata.buildOAuthMetadata`. - `issuer` and `jwks_uri` always stay on the current topology. - `userinfo_endpoint` still follows `token.exchange.topology.name`. - New package-private `DiscoveryEndpointResolver`: it reads the current topology and the three params from the servlet context, and resolves each advertised endpoint URL. Before this change, `DiscoveryResource` and `AuthorizationServerMetadata` each did their own string substitution. - A blank param is treated as unset. - Topology substitution now rewrites only the base URL's `/<topology>/` path segment. The old `String.replace(current, target)` also rewrote other occurrences of the name. For example, a topology named `knoxidf` turned `/gateway/knoxidf/knoxidf/api/v1/token` into `/gateway/<target>/<target>/api/v1/token`. This changes token and userinfo URLs only in that broken case. - Docs: both params are added to `knoxidf/configuration.md`, and the endpoints tip in `knoxidf/endpoints.md` mentions them. The params are new, so existing deployments are unaffected. ## How was this patch tested? - New `DiscoveryEndpointResolverTest`, which runs through both `DiscoveryResource` and `OAuthServerMetadataResource`: - all 8 combinations of the three params, set or unset. Each param moves only its own endpoints, userinfo follows the token param, and `issuer` and `jwks_uri` stay on the current topology; - blank params keep every endpoint on the current topology; - a current topology named `knoxidf`: only the topology segment is rewritten, not the `knoxidf/api/v1` resource path. - `OAuthServerMetadataTest` was updated to the new `buildOAuthMetadata` signature. - `mvn -pl gateway-service-knoxidf verify` passes: unit tests, checkstyle, PMD, spotbugs and forbiddenapis. ## Integration Tests No integration test was added or changed. The existing discovery assertions in `test_knoxidf.py` cover the default behaviour, with the new params unset and the token endpoint moved by `token.exchange.topology.name`; they still apply unchanged. The new params are covered by the unit tests above, which drive the real JAX-RS resources. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
