Raghav-Mah3shwari opened a new pull request, #1325:
URL: https://github.com/apache/knox/pull/1325
## What changes were proposed in this pull request?
This PR adds a new Docker Compose integration test suite that covers the
`knoxtoken` topology (JWTProvider federation) and the KNOXTOKEN token-issuance
service. Both are baked into the CI test image but were previously exercised by
**no** integration test.
New file: `.github/workflows/tests/test_knoxtoken_jwt.py`
It validates a real end-to-end token flow:
1. Mint a Knox JWT from the KNOXTOKEN service
(`gateway/knoxldap/knoxtoken/api/v1/token`) using Basic auth.
2. Present that bearer token to the JWTProvider-protected topology
(`gateway/knoxtoken/auth/api/v1/pre`) and confirm the caller identity is
asserted.
Test cases:
- `test_token_endpoint_returns_jwt_and_metadata` — token response contains
`access_token`, `token_type: Bearer`, `expires_in`, and the token is a
well-formed 3-segment JWT.
- `test_token_requires_authentication` — anonymous token request returns 401.
- `test_jwt_grants_access_to_federated_topology` — a valid JWT authenticates
and yields `x-knox-actor-username: guest`.
- `test_federated_topology_requires_token` — a request with no token returns
401.
- `test_federated_topology_rejects_invalid_token` — a malformed bearer token
returns 401.
The suite reuses the existing `common_utils` helpers and follows the current
test style. It does not overlap with existing tests: all other suites use Basic
auth or preauth headers, and none issue a Knox token or authenticate via
JWTProvider.
No production code, topologies, or workflow behavior are changed.
## How was this patch tested?
- Verified endpoint paths and contract against the codebase before writing:
- KNOXTOKEN path `knoxtoken/api/v1/token` and JSON keys `access_token` /
`token_type` / `expires_in`
(`gateway-service-knoxtoken/.../TokenResource.java`).
- Auth service path `auth/api/v1/pre`
(`gateway-service-auth/.../PreAuthResource.java`).
- `knoxtoken.xml` uses `JWTProvider` with `RS256`, matching the gateway's
default token signing algorithm.
- The new file is auto-discovered by the default `pytest` run in
`docker-compose.yml` (it is not in the single-EKU `--ignore` list), so it
executes as part of the existing Docker Compose test job.
- Locally, the suite can be run with:
```bash
docker compose -f ./.github/workflows/compose/docker-compose.yml up -d
docker compose -f ./.github/workflows/compose/docker-compose.yml run --rm
tests
```
## Integration Tests
This PR is itself an addition of integration tests under
`.github/workflows/tests`. No Java unit tests are added because the change only
introduces black-box HTTP integration tests against the packaged gateway; the
underlying KNOXTOKEN and JWTProvider components already have Java unit coverage
in their respective modules.
## UI changes
N/A — no UI changes.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
