[
https://issues.apache.org/jira/browse/KNOX-3355?focusedWorklogId=1031014&page=com.atlassian.jira.plugin.system.issuetabpanels:worklog-tabpanel#worklog-1031014
]
ASF GitHub Bot logged work on KNOX-3355:
----------------------------------------
Author: ASF GitHub Bot
Created on: 18/Jul/26 03:25
Start Date: 18/Jul/26 03:25
Worklog Time Spent: 10m
Work Description: hsheinblatt opened a new pull request, #1311:
URL: https://github.com/apache/knox/pull/1311
KNOX-3355 - Add TrustedOidcIssuerService schema and interface
Feature context:
Support OIDC JWKS discovery to validate tokens from external authorizers.
Currently,
there is a fixed trusted JWKS list created as part of initial configuration
that can be used
to validate tokens. Allow the dynamic registration of trusted issuers with a
flag that they are
trusted for OIDC JWKS discovery. Tokens will be validated with discovered
JWKS from
such trusted issuers.
An initial detailed use case is to validate kubernetes service account
tokens from
external kubernetes clusters. When the kubernetes cluster is created or
integrated,
the kubernetes issuer can be registered as trusted for JWKS discovery
without knox
service disruption. Then, service account tokens from that cluster can be
validated
using OIDC discovery for JWKS.
The implementation plan is bottom up: first the storage and interface for
the trusted
issuers, then the implementation of registration through an admin API in
knox idf, and
then the token validation integration. It will be part of knox_idf
initially, but written to
be portable so that it can be moved into a different or separate service if
more
OIDC discovery use cases emerge.
How this patch was tested:
New unit tests are added.
Follow on changes will implement the interface and then integrate in the
implementation
into KnoxIDF flows, but now there is no integration or UI changes.
Note this was originally posted in https://github.com/apache/knox/pull/1270
. The knox_idf
branch was altered, so this PR is made on top of the updated branch.
Comments on that pull request are also addressed here:
* Filed https://issues.apache.org/jira/browse/KNOX-3384 to track moving
gateway-site.xml content to doc
* Added NOT NULL statements to the Derby SQL file. Note that it's not
necessary on the
primary key column as that will default to enforce NOT NULL, but it's
still included for
clarity.
* Moved the cluster_name column to the end for all SQL files.
* For the requestedBy column: it can be null if we can't resolve the
principal name of
the API caller. Arguably one should not set up permissions so that is
possible, but in
general it could happen.
Issue Time Tracking
-------------------
Worklog Id: (was: 1031014)
Time Spent: 1h 20m (was: 1h 10m)
> Trusted OIDC Issuer service and storage for Knox IDF
> ----------------------------------------------------
>
> Key: KNOX-3355
> URL: https://issues.apache.org/jira/browse/KNOX-3355
> Project: Apache Knox
> Issue Type: Task
> Components: JWT
> Reporter: Harrison Sheinblatt
> Assignee: Harrison Sheinblatt
> Priority: Major
> Time Spent: 1h 20m
> Remaining Estimate: 0h
>
> Create the storage layer and service for Trusted OIDC Issuers. Will include:
> TRUSTED_OIDC_ISSUERS schema, ServiceType, POJO, TrustedOidcIssuerService
> interface, JDBC impl, factory.
> Filter and admin interface use will be in another task.
> Implementation tasks for KNOX-3349.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
