Sandor Molnar created KNOX-3564:
-----------------------------------
Summary: KnoxIDF: Increase DELEGATION_POLICY_USERS.username column
size to 2048 to support SPIFFE IDs
Key: KNOX-3564
URL: https://issues.apache.org/jira/browse/KNOX-3564
Project: Apache Knox
Issue Type: Bug
Components: JWT, KnoxIDF
Reporter: Sandor Molnar
Assignee: Sandor Molnar
Fix For: 3.1.0
The {{username}} column of the {{DELEGATION_POLICY_USERS}} table is currently
{{VARCHAR(1023)}} ({{{}VARCHAR2(1023){}}} on Oracle). The SPIFFE specification
allows a SPIFFE ID to be up to 2048 bytes long ([SPIFFE ID spec, section
2.3|https://spiffe.io/docs/latest/spiffe-specs/spiffe-id/#23-maximum-spiffe-id-length]).
Any SPIFFE ID longer than 1023 characters therefore can't be stored as a
permitted user on a delegation policy.
Integrating consumers have agreed to align with the spec maximum, so Knox
should do the same. The column would then also match
{{{}DELEGATION_POLICIES.actor_id{}}}, which is already {{{}VARCHAR(2048){}}}.
*Proposed changes:*
* {{{}createKnoxIDFDelegationPolicyTables.sql{}}}: change
{{DELEGATION_POLICY_USERS.username}} from {{VARCHAR(1023)}} to {{VARCHAR(2048)}}
* {{{}createKnoxIDFDelegationPolicyTablesOracle.sql{}}}: change
{{DELEGATION_POLICY_USERS.username}} from {{VARCHAR2(1023)}} to
{{VARCHAR2(2048)}}
* Check that the composite primary key {{(registration_id, username)}} still
fits the index key size limit of each supported database (36 + 2048 bytes)
* Add or extend a test that saves and reads back a delegation policy whose
username is 2048 characters long
*Notes:*
* The tables are created with {{{}CREATE TABLE IF NOT EXISTS{}}}, so a
deployment that already has the table will keep the old column size. That
shouldn't matter because KnoxIDF is unreleased (3.1.0-SNAPSHOT).
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
