KNOX-3405: Extend JWTFederationFilter for dynamic JWKS and iss attribute on token-exchange - #1340
Open
hsheinblatt wants to merge 13 commits into
Open
KNOX-3405: Extend JWTFederationFilter for dynamic JWKS and iss attribute on token-exchange#1340hsheinblatt wants to merge 13 commits into
hsheinblatt wants to merge 13 commits into
Conversation
* KnoxIDF - Initial commit * KnoxIDF - multi OP support * KnoxIDF - make token endpoint configurable during discovery * KnoxIDF - Code cleanup and bug fixes * KnoxIDF - Multi OP enablement improvements and code adoption to Larry's recent changes * KnoxIDF - Add REFRESH_TOKEN support * KnoxIDF - Automatically enable JdbcFederatedIdentityService when KnoxIDF is present in any topology * KnoxIDF - Added Docker-based integration tests * KnoxIDF: configurable user params provider (only LDAP for now) * KnoxIDF: add support for auth code flow with PKCE * KnoxIDF: fix an issue with the empty user params provider implementation * KnoxIDF: Refactor Docker build to use local Maven artifacts and unify CI/Dev workflows
…#1311) * KNOX-3355 - Add TrustedOidcIssuerService schema and interface Co-authored-by: Harrison <hsheinblatt@cloudera.com>
…d TrustedOidcIssuerServiceFactory (apache#1315)
…d the missing methods (apache#1322)
…limit-reached instead of 500 (apache#1328)
…Authz (apache#1337) Remove redundant admin URL paths, still allowing separate ACLs for different knox idf admin APIs using PathAclAuthz. Co-authored-by: Harrison <hsheinblatt@cloudera.com>
…change (apache#1339) * KNOX-3408 - Regression tests for subject handling in JWTFederationFilter.handleTokenExchange and TokenExchangePrincipal handling in AbstractIdentityAssertionFilter#continueChainAsPrincipal handling Only unit tests are added for existing functionality. * KNOX-3408 - Allow no actor token in JWTFederationFilter.handleTokenExchange. --------- Co-authored-by: Harrison <hsheinblatt@cloudera.com>
…bute on token-exchange Test issues to improve: Several tests use a helper rather than a mock, DynamicJwksPassTokenAuthority. This causes ambiguity in what method precisely was called and what failed. Additionally, fixing that becomes more complex because the token exchange requests use both a subject token and an actor token, so both tokens are validated, and it's either ambiguous or complex to ensure that each token validation path is correct. EasyMock should allow a range of times(0, 1) to be called, so we can make the appropriate signature verification optional for negative tests. That is, we can write the tests so that the order of enforcement for each condition is arbitrary: all the other conditions would evaluate to true if executed first. Once the actor token is made optional, we can simplify the negative test cases to use only a subject token, and then specify the mocks precisely so each negative test case validates the correct methods are called, if called, and no extra methods are called, the test can be insensitive to the order of validation checks, and we can remove the DynamicJwksPassTokenAuthority helper.
…alidation independent, and ensure that both the single subject token and the subject plus actor token request paths are covered.
lmccay
reviewed
Aug 9, 2026
Contributor
There was a problem hiding this comment.
@hsheinblatt - please provide more of a description and some details of the tests that you added and ran altogether. I'd also like to make sure that if some error messages/logs were changed for certain behavior that we know what they are. It looks like you probably fixed some previously inaccurate log messages. There may be implications for others tests and integrations. Also, change the PR Title to reflect the Jira name.
smolnar82
changed the title
Contributor
|
@hsheinblatt - I'd to rebase the |
Contributor
|
And I'm echoing the above request from @lmccay : we need more verbose description, and more importantly, more detailed test steps. |
Author
|
Replaced with #1342 on the rebased knox_idf branch. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
KNOX-3405 - Extend JWTFederationFilter for dynamic JWKS and iss attribute on token-exchange
How was this patch tested?
Unit tests were added
Integration Tests
N/A Will be added once flow is complete