[
https://issues.apache.org/jira/browse/KNOX-3405?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18104882#comment-18104882
]
ASF subversion and git services commented on KNOX-3405:
-------------------------------------------------------
Commit f0a5c94d0e6c175234f0e32f8b3ae45aa5cd0886 in knox's branch
refs/heads/master from Sandor Molnar
[ https://gitbox.apache.org/repos/asf?p=knox.git;h=f0a5c94d0 ]
Knox as an OAuth 2.0 / OpenID Connect Provider (KnoxIDF) (#1351)
Apache Knox as an OAuth 2.0 / OpenID Connect Authorization Server.
Supports the Authorization Code flow (with PKCE for public clients),
refresh-token and token-exchange grants, dynamic client registration, a
discovery document + JWKS endpoint, and brokered login to external OIDC
Providers with persisted federated identities.
Includes the Trusted OIDC Issuer registry and admin API (KNOX-3355,
KNOX-3368), gateway-config plumbing (KNOX-3390), and token-exchange
extensions for dynamic JWKS and issuer attributes (KNOX-3405, KNOX-3408).
Security hardening (KNOX-3414) reviewed and tested across the feature:
- Client authentication on every code/refresh redemption — PKCE (S256
only) or a constant-time client_secret check; no unauthenticated path.
- Single-use authorization codes and refresh tokens, atomically consumed
before issuance to close replay/rotation races.
- Full federated id_token validation (signature, issuer, audience,
exp/nbf, required sub, and OIDC nonce binding); fail closed on
misconfiguration.
- Open-redirect prevention at registration and authorize (HTTPS-only
except loopback, normalized-path wildcard match, scope whitelist).
- Secrets at rest via AliasService (fail closed); federated access tokens
never persisted; consent bound to the initiating subject (POST-only).
- Secure-by-default flags (anonymous registration, auto-consent), correct
RFC 6749/6750 error statuses, XSS escaping, structured audit records,
and signing-key rotation (multi-JWK publication, kid-based verification).
Documented in a new KnoxIDF book (overview, getting started, endpoint and
configuration reference, security, federation, operations).
Co-authored-by: hsheinblatt <[email protected]>
Co-authored-by: Harrison <[email protected]>
Co-Authored-By: Claude Opus 4.8 <[email protected]>
> Extend JWTFederationFilter for dynamic JWKS and iss attribute on
> token-exchange
> -------------------------------------------------------------------------------
>
> Key: KNOX-3405
> URL: https://issues.apache.org/jira/browse/KNOX-3405
> Project: Apache Knox
> Issue Type: Task
> Components: JWT
> Reporter: Harrison Sheinblatt
> Assignee: Harrison Sheinblatt
> Priority: Major
> Time Spent: 1h 20m
> Remaining Estimate: 0h
>
> Extend JWTFederationFilter in two ways: (1) store the validated token's iss
> claim as a request attribute for downstream handlers; and (2) for
> grant_type=token-exchange, when the static jwt.expected.issuer check fails,
> consult TrustedOidcIssuerService — calling resolveJwksUri() for dynamic-JWKS
> issuers, which in turn uses the OIDC discovery document cache.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
