[
https://issues.apache.org/jira/browse/KNOX-3564?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Sandor Molnar resolved KNOX-3564.
---------------------------------
Resolution: Fixed
> KnoxIDF: Increase DELEGATION_POLICY_USERS.username column size to 2048 to
> support SPIFFE IDs
> --------------------------------------------------------------------------------------------
>
> Key: KNOX-3564
> URL: https://issues.apache.org/jira/browse/KNOX-3564
> Project: Apache Knox
> Issue Type: Bug
> Components: JWT, KnoxIDF
> Reporter: Sandor Molnar
> Assignee: Sandor Molnar
> Priority: Major
> Fix For: 3.1.0
>
> Time Spent: 40m
> Remaining Estimate: 0h
>
> The {{username}} column of the {{DELEGATION_POLICY_USERS}} table is currently
> {{VARCHAR(1023)}} ({{{}VARCHAR2(1023){}}} on Oracle). The SPIFFE
> specification allows a SPIFFE ID to be up to 2048 bytes long ([SPIFFE ID
> spec, section
> 2.3|https://spiffe.io/docs/latest/spiffe-specs/spiffe-id/#23-maximum-spiffe-id-length]).
> Any SPIFFE ID longer than 1023 characters therefore can't be stored as a
> permitted user on a delegation policy.
> Integrating consumers have agreed to align with the spec maximum, so Knox
> should do the same. The column would then also match
> {{{}DELEGATION_POLICIES.actor_id{}}}, which is already {{{}VARCHAR(2048){}}}.
> *Proposed changes:*
> * {{{}createKnoxIDFDelegationPolicyTables.sql{}}}: change
> {{DELEGATION_POLICY_USERS.username}} from {{VARCHAR(1023)}} to
> {{VARCHAR(2048)}}
> * {{{}createKnoxIDFDelegationPolicyTablesOracle.sql{}}}: change
> {{DELEGATION_POLICY_USERS.username}} from {{VARCHAR2(1023)}} to
> {{VARCHAR2(2048)}}
> * Check that the composite primary key {{(registration_id, username)}} still
> fits the index key size limit of each supported database (36 + 2048 bytes)
> * Add or extend a test that saves and reads back a delegation policy whose
> username is 2048 characters long
> *Notes:*
> * The tables are created with {{{}CREATE TABLE IF NOT EXISTS{}}}, so a
> deployment that already has the table will keep the old column size. That
> shouldn't matter because KnoxIDF is unreleased (3.1.0-SNAPSHOT).
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
