[
https://issues.apache.org/jira/browse/KNOX-3414?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18104532#comment-18104532
]
ASF subversion and git services commented on KNOX-3414:
-------------------------------------------------------
Commit d9b1453d2895cd2fe75a1c60093b4935de4f495e in knox's branch
refs/heads/knox_idf from Sandor Molnar
[ https://gitbox.apache.org/repos/asf?p=knox.git;h=d9b1453d2 ]
KNOX-3414: security hardening for the OIDC provider (Tier 1 + Tier 2)
Fixes a batch of security and correctness findings from reviewing the
squashed "Knox as OIDC Provider" feature. Reviewed and tested together.
Tier 1 (critical):
- 1.1 Authenticate the client on the auth-code token exchange. The
JWTFederationFilter Bearer path forwards to the token endpoint without
checking client_secret, so a stolen code could be redeemed by anyone
holding some valid Knox JWT. The endpoint now independently binds
redemption to the client: PKCE code_verifier (S256) when a challenge was
stored, else a constant-time client_secret check.
- 1.2 Validate the federated id_token (signature via the OP JWKS, expected
issuer, audience, exp/nbf) before trusting any claim; fail closed when
jwks.endpoint/issuer are not configured.
- 1.3 Add knoxidf.client.registration.anonymous.allowed (default false):
dynamic client registration refuses anonymous callers unless explicitly
enabled. Sample knoxidf-ldap topology opts in to preserve open reg.
- 1.4 Stop leaking custom claims across users: build a per-request copy of
the claim map instead of mutating the shared singleton field.
Tier 2 (high):
- 2.1 Default issueTime to now in JWTokenAttributesBuilder so every token
gets a correct iat (fixes iat=1970 on KnoxSSO cookies/assertions).
- 2.2 Set SCOPE_ATTRIBUTE to the scope value (was a double getClaim -> null).
- 2.3 Match redirect_uri on parsed URI components with a path/host boundary
(fixes wildcard open-redirect via startsWith).
- 2.5 Require S256 PKCE; reject plain.
- 2.6 Use the Knox truststore for federated OP HTTP calls.
- 2.7 Treat auto_consent as a server-side policy, not a client bypass.
- 2.8 Escape username in LDAP DN/filter (Rdn.escapeValue).
- 2.9 Require and validate state on the authorize flow.
- 2.10 Null-guard the federated callback / registration and return 4xx.
Tests: TokenResourceClientAuthTest, RegistrationResourceAnonymousGuardTest,
FederatedOpConfigurationTest, JWTTokenTest iat assertion.
Deferred to follow-up PRs: 1.5 (secrets at rest via AliasService),
2.4 + 2.11 (atomic single-use auth-code consume + schema migration across
dialects; the auth-code replay window remains until 2.4 lands), Tier 3/4.
Co-Authored-By: Claude Opus 4.8 <[email protected]>
> KnoxIDF (OIDC Provider): security hardening, correctness fixes, and
> documentation
> ---------------------------------------------------------------------------------
>
> Key: KNOX-3414
> URL: https://issues.apache.org/jira/browse/KNOX-3414
> Project: Apache Knox
> Issue Type: Improvement
> Components: KnoxIDF
> Reporter: Sandor Molnar
> Assignee: Sandor Molnar
> Priority: Critical
> Fix For: 3.1.0
>
>
> Follow-up work on the KnoxIDF OAuth2/OIDC Authorization Server. Items to fix:
> Client authentication & flow security
> - Authenticate the client on the refresh_token grant.
> - Authenticate the client on the authorization_code grant (PKCE S256 or
> constant-time client_secret).
> - Reject PKCE plain; accept only S256, and advertise only S256 in discovery.
> - Require and validate state/nonce; bind the federated id_token to the
> request via nonce.
> - Atomically consume authorization codes and refresh tokens before issuance
> (close replay windows).
> Federation
> - Fully validate the federated OP id_token (signature/JWKS, issuer, audience,
> exp/nbf, sub) before trusting any claim.
> - Reject a federated id_token missing sub with a 4xx, not a 500.
> - Fail closed when a federated-OP client-secret alias is unresolvable.
> - Stop persisting federated OP access tokens at rest; store only
> ID-token-derived identity data.
> - Activate federated-identity persistence (was silently disabled) with
> self-provisioning embedded Derby default.
> Redirect-URI / registration
> - Normalize redirect_uri path before wildcard matching; match on parsed URI
> components (fix open redirect).
> - Build a well-formed success redirect when redirect_uri already carries a
> query.
> - Require HTTPS for registered redirect URIs (loopback HTTP excepted, RFC
> 8252).
> - Make anonymous dynamic client registration an explicit, secure-by-default
> opt-in.
> Correctness / robustness
> - Fix SCOPE_ATTRIBUTE always resolving to null (double getClaim).
> - Fix iat=1970 regression on non-KnoxIDF tokens (default issue time to now).
> - /userinfo returns 401 invalid_token, not 500, for a bad bearer token.
> - Fix broken double-checked locking in service init paths.
> - Escape LDAP username input; remove hardcoded LDAP system-password fallback
> (fail fast).
> - Per-request claim map (fix cross-user claim leakage in the shared
> singleton).
> Persistence
> - Fix TOCTOU on federated-identity insert (unique constraint as arbiter).
> - Write identity + attributes in a single transaction.
> - Align Derby schema (NOT NULL / unique index) with other dialects.
> Key management & auditing
> - Publish multiple JWKs and select the verification key by kid (enables
> zero-downtime signing-key rotation).
> - Emit structured audit records across the OAuth2/OIDC endpoints.
> OIDC discovery / docs
> - Complete OIDC discovery metadata for OAuth/MCP client integration.
> - Add opt-in Keycloak federation E2E test; extend existing E2E suite to cover
> the fixes above.
> - Add the Identity Federation (OIDC Provider) documentation book.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
