[
https://issues.apache.org/jira/browse/KNOX-3408?focusedWorklogId=1034158&page=com.atlassian.jira.plugin.system.issuetabpanels:worklog-tabpanel#worklog-1034158
]
ASF GitHub Bot logged work on KNOX-3408:
----------------------------------------
Author: ASF GitHub Bot
Created on: 06/Aug/26 07:40
Start Date: 06/Aug/26 07:40
Worklog Time Spent: 10m
Work Description: hsheinblatt opened a new pull request, #1339:
URL: https://github.com/apache/knox/pull/1339
KNOX-3408 - Allow no actor token in JWTFederationFilter.handleTokenExchange
## What changes were proposed in this pull request?
RFC 8693 requires that the actor token be optional for token exchange.
Change the handleTokenExchange method to allow a missing actor token.
When actor_token is absent, the Subject has the subject from the subject
token
as PrimaryPrincipal with no TokenExchangePrincipal. Note that headless
delegation using ImpersonatedPrincipal is currently not represented in this
path.
## How was this patch tested?
A unit test for the new path is added. Regression tests for subject handling
in
JWTFederationFilter.handleTokenExchange and TokenExchangePrincipal handling
in AbstractIdentityAssertionFilter.continueChainAsPrincipal handling were also
added and run before the feature change to show no regression.
## Integration Tests
N/A
Issue Time Tracking
-------------------
Worklog Id: (was: 1034158)
Remaining Estimate: 0h
Time Spent: 10m
> JWTFederationFilter.handleTokenExchange to allow missing actor token for RFC
> 8693 OIDC token exchange
> -----------------------------------------------------------------------------------------------------
>
> Key: KNOX-3408
> URL: https://issues.apache.org/jira/browse/KNOX-3408
> Project: Apache Knox
> Issue Type: Task
> Components: JWT
> Reporter: Harrison Sheinblatt
> Priority: Major
> Time Spent: 10m
> Remaining Estimate: 0h
>
> In RFC 8693 the actor token is optional, so the filter must allow token
> exchange to continue if there is no actor token. We will not use
> TokenExchangePrincipal in that case, leaving the headless delegation case for
> a future task.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
