[
https://issues.apache.org/jira/browse/KNOX-3564?focusedWorklogId=1053983&page=com.atlassian.jira.plugin.system.issuetabpanels:worklog-tabpanel#worklog-1053983
]
ASF GitHub Bot logged work on KNOX-3564:
----------------------------------------
Author: ASF GitHub Bot
Created on: 11/Nov/26 08:11
Start Date: 11/Nov/26 08:11
Worklog Time Spent: 10m
Work Description: smolnar82 commented on PR #1505:
URL: https://github.com/apache/knox/pull/1505#issuecomment-6790687932
Cc. @hsheinblatt
Issue Time Tracking
-------------------
Worklog Id: (was: 1053983)
Time Spent: 20m (was: 10m)
> KnoxIDF: Increase DELEGATION_POLICY_USERS.username column size to 2048 to
> support SPIFFE IDs
> --------------------------------------------------------------------------------------------
>
> Key: KNOX-3564
> URL: https://issues.apache.org/jira/browse/KNOX-3564
> Project: Apache Knox
> Issue Type: Bug
> Components: JWT, KnoxIDF
> Reporter: Sandor Molnar
> Assignee: Sandor Molnar
> Priority: Major
> Fix For: 3.1.0
>
> Time Spent: 20m
> Remaining Estimate: 0h
>
> The {{username}} column of the {{DELEGATION_POLICY_USERS}} table is currently
> {{VARCHAR(1023)}} ({{{}VARCHAR2(1023){}}} on Oracle). The SPIFFE
> specification allows a SPIFFE ID to be up to 2048 bytes long ([SPIFFE ID
> spec, section
> 2.3|https://spiffe.io/docs/latest/spiffe-specs/spiffe-id/#23-maximum-spiffe-id-length]).
> Any SPIFFE ID longer than 1023 characters therefore can't be stored as a
> permitted user on a delegation policy.
> Integrating consumers have agreed to align with the spec maximum, so Knox
> should do the same. The column would then also match
> {{{}DELEGATION_POLICIES.actor_id{}}}, which is already {{{}VARCHAR(2048){}}}.
> *Proposed changes:*
> * {{{}createKnoxIDFDelegationPolicyTables.sql{}}}: change
> {{DELEGATION_POLICY_USERS.username}} from {{VARCHAR(1023)}} to
> {{VARCHAR(2048)}}
> * {{{}createKnoxIDFDelegationPolicyTablesOracle.sql{}}}: change
> {{DELEGATION_POLICY_USERS.username}} from {{VARCHAR2(1023)}} to
> {{VARCHAR2(2048)}}
> * Check that the composite primary key {{(registration_id, username)}} still
> fits the index key size limit of each supported database (36 + 2048 bytes)
> * Add or extend a test that saves and reads back a delegation policy whose
> username is 2048 characters long
> *Notes:*
> * The tables are created with {{{}CREATE TABLE IF NOT EXISTS{}}}, so a
> deployment that already has the table will keep the old column size. That
> shouldn't matter because KnoxIDF is unreleased (3.1.0-SNAPSHOT).
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
