[ https://issues.apache.org/jira/browse/KNOX-3028?focusedWorklogId=914511&page=com.atlassian.jira.plugin.system.issuetabpanels:worklog-tabpanel#worklog-914511 ]
ASF GitHub Bot logged work on KNOX-3028: ---------------------------------------- Author: ASF GitHub Bot Created on: 13/Apr/24 20:37 Start Date: 13/Apr/24 20:37 Worklog Time Spent: 10m Work Description: lmccay commented on code in PR #900: URL: https://github.com/apache/knox/pull/900#discussion_r1564243026 ########## gateway-service-knoxtoken/src/main/java/org/apache/knox/gateway/service/knoxtoken/TokenResource.java: ########## @@ -626,14 +628,14 @@ public Response revoke(String token) { final String tokenId = getTokenId(token); if (isKnoxSsoCookie(tokenId)) { errorStatus = Response.Status.FORBIDDEN; - error = "SSO cookie (" + Tokens.getTokenIDDisplayText(tokenId) + ") cannot not be revoked." ; + error = "SSO cookie (" + Tokens.getTokenIDDisplayText(tokenId) + ") cannot not be revoked."; errorCode = ErrorCode.UNAUTHORIZED; } else if (triesToRevokeOwnToken(tokenId, revoker) || allowedRenewers.contains(revoker)) { tokenStateService.revokeToken(tokenId); log.revokedToken(getTopologyName(), - Tokens.getTokenDisplayText(token), - Tokens.getTokenIDDisplayText(tokenId), - revoker); + Tokens.getTokenDisplayText(token), Review Comment: Not sure why it was the previous indentation. I guess someone is lining up the dots? That is not a convention that is standard. That said, I don't know why this was changed at all. Likely some IDE shenanigans related to my migration to a new dev machine. These are all in the same method and I am working backwards through them. I ilke how the code reads with this formatting. If you can look at the code in context and think I should revert the changes then I will. We should also add to the checkstyle rules if that is the case though. Issue Time Tracking ------------------- Worklog Id: (was: 914511) Time Spent: 1h 20m (was: 1h 10m) > KnoxToken extension for OAuth Token Flows > ----------------------------------------- > > Key: KNOX-3028 > URL: https://issues.apache.org/jira/browse/KNOX-3028 > Project: Apache Knox > Issue Type: Bug > Components: JWT > Reporter: Larry McCay > Assignee: Larry McCay > Priority: Major > Fix For: 2.1.0 > > Time Spent: 1h 20m > Remaining Estimate: 0h > > This change will extend the existing TokenResource for KNOXTOKEN service to > include OAuth specifics such as expected URL, error messages and flows to > support Token Exchange Flow and Token Refresh. > This is being driven by a specific need to proxy access to the Iceberg REST > Catalog API. In this specific usecase, we need to intercept the use of the > following endpoint URLs and serve the token exchange flow for the > authenticating user. > {code} > /v1/oauth/tokens > {code} > Details for these requirements can be found in the openapi description for > the catalog API [1]. > In addition to this usecase, we should add generic support for the token > exchange flow with more generic URL that better aligns with what others use. > {code} > /oauth/v1/token > {code} > We will support the use of the "oauth" service name within the existing > KNOXTOKEN service with an extension of the TokenResource which adapts the > existing KNOXTOKEN behavior to the expectations of clients on OAuth responses. > In order to support both URLs, the deployment contributor will need to > register a url pattern for each usecase and the resource path within the > jersey service will need to accommodate the dynamic nature of the Iceberg > REST Catalog API which will add the catalog API service name as well. > {code} > /icecli/v1/oauth/tokens/ > {code} > Where "icecli" may be some configurable service name and need to match to the > incoming URL. > We will wildcard that by making it a regex matched path param. > We will also need to accommodate a first-class Knox pattern and service name > of "oauth" and only allow "token" or "oauth" after the v1 with the remaining > path fragment being optional for the iceberg specific "tokens". > Not pretty but it will work. > 1. > https://github.com/apache/iceberg/blob/main/open-api/rest-catalog-open-api.yaml -- This message was sent by Atlassian Jira (v8.20.10#820010)