smolnar82 opened a new pull request, #1373: URL: https://github.com/apache/knox/pull/1373
[KNOX-3424](https://issues.apache.org/jira/browse/KNOX-3424) - Complete RFC 8707/8693 dynamic `resource`/`audience` handling in KNOXTOKEN and token exchange ## What changes were proposed in this pull request? Follow-up to #1356, finishing the dynamic-audience work so Knox implements both RFC 8707 (Resource Indicators) and RFC 8693 (Token Exchange) end to end. Three self-contained commits: 1. **Replace the `audience` query param with a URL-validated `resource` param.** The KNOXTOKEN service now reads the per-request target via `resource` instead of `audience`. Each value must be an absolute URI without a fragment (RFC 8707 §2 / RFC 3986 §4.3); a value that is not a valid absolute URI, or that carries a fragment, is rejected with `400 Bad Request` / `INVALID_RESOURCE`. Repeated and comma-separated values are supported; whitespace is trimmed. The pluggable audience validators (`static` / `whitelist` / `passthrough`) are unchanged in behavior. 2. **Wire the RFC 8693 `resource`/`audience` body parameters into token exchange.** The JWTProvider's `TokenExchangeHandler` now parses the optional `resource`/`audience` body params from the exchange request and conveys them to the downstream KNOXTOKEN service via a new shared request attribute (`CommonTokenConstants.REQUESTED_AUDIENCES_REQUEST_ATTR`), so they land in the minted token's `aud` claim. `resource` values are URI-validated (malformed → `invalid_target`); `audience` values are logical service names taken verbatim. When present, the body values take precedence over the `resource` query parameter. 2. **JSON-escape the caller-supplied `resource` value in the token error body.** The token-issuance error echoed the caller-supplied value back in a hand-concatenated JSON body, so a value containing a `"` could break out of the JSON string. The `{"error": ..., "code": ...}` body is now rendered through `JsonUtils` (the same escaping the KNOX-3423/#1354 filter-layer error path uses), keeping the existing `{error, code}` / `ErrorCode` shape. Documentation in `knox-site/docs/config_knox_token.md` is updated to describe the `resource` parameter, the absolute-URI requirement, and the RFC 8707 mapping into the `aud` claim. ## How was this patch tested? Automated unit tests (all green, offline Maven build): - `TokenExchangeHandlerTest` — 21 tests, including 8 new ones covering `resource`/`audience` body-param parsing, comma-splitting, invalid-URI and fragment rejection as `invalid_target`, empty-value rejection, and the no-param case leaving the request attribute unset. - `TokenServiceResourceTest` — 101 tests, including new coverage for the `resource` query param, invalid-URI/fragment rejection, exchange-attribute precedence over the query param, and a regression test asserting a `resource` value containing double quotes yields a well-formed, parseable JSON error body with the value round-tripped intact. - `JWTFederationFilterTokenExchangeTest` — 56 tests, re-run to confirm no regression on the broader exchange path. Checkstyle passes with 0 violations across `gateway-spi`, `gateway-provider-security-jwt`, and `gateway-service-knoxtoken`. ## Integration Tests No new integration test was added: the change is an extension of the existing token-exchange / dynamic-audience paths, which are covered comprehensively at the unit level, and the KnoxIDF federation broker flow (`test_knoxidf.py` / `test_knoxidf_federation.py`) already exercises the token-exchange handler this PR modifies. Because commit 2 touches the JWTProvider federation broker path, adding the **`test-federation`** label here before pushing, so the Keycloak-backed E2E federation suite runs against these changes. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
