smolnar82 opened a new pull request, #1375: URL: https://github.com/apache/knox/pull/1375
[KNOX-3433](https://issues.apache.org/jira/browse/KNOX-3433) - Set issued_token_type in KnoxIDF token responses ## What changes were proposed in this pull request? RFC 8693 §2.2.1 requires the token response to include `issued_token_type`; KnoxIDF didn't set it. KnoxIDF always mints a JWT, so `TokenResource.buildResponseMap` now sets `issued_token_type = urn:ietf:params:oauth:token-type:jwt` on all grants (authorization_code, refresh_token, client_credentials). ## How was this patch tested? Docker Compose integration suite: all 77 tests pass, including `test_knoxidf`: ``` tests-1 | platform linux -- Python 3.10.20, pytest-9.0.3, pluggy-1.6.0 tests-1 | rootdir: /tests tests-1 | collected 77 items tests-1 | tests-1 | test_health.py ..... [ 6%] tests-1 | test_k8s_serviceaccount_validation.py ...... [ 14%] tests-1 | test_knox_admin_path_traversal.py ... [ 18%] tests-1 | test_knox_auth_service_and_ldap.py ... [ 22%] tests-1 | test_knox_configs.py . [ 23%] tests-1 | test_knox_ldap_cache.py ... [ 27%] tests-1 | test_knox_ldap_injection.py ....... [ 36%] tests-1 | test_knox_ldap_proxy_search.py ......... [ 48%] tests-1 | test_knoxauth_preauth_and_paths.py ...... [ 55%] tests-1 | test_knoxidf.py ...... [ 63%] tests-1 | test_knoxsso_redirect.py . [ 64%] tests-1 | test_knoxtoken_jwt.py .................... [ 90%] tests-1 | test_remote_auth.py ... [ 94%] tests-1 | test_remoteauth_extauthz_additional_path.py .... [100%] tests-1 | tests-1 | =============================== warnings summary =============================== tests-1 | ../usr/local/lib/python3.10/site-packages/ldap3/utils/asn1.py:50 tests-1 | /usr/local/lib/python3.10/site-packages/ldap3/utils/asn1.py:50: DeprecationWarning: tagMap is deprecated. Please use TAG_MAP instead. tests-1 | from pyasn1.codec.ber.encoder import tagMap, typeMap, AbstractItemEncoder tests-1 | tests-1 | ../usr/local/lib/python3.10/site-packages/ldap3/utils/asn1.py:50 tests-1 | /usr/local/lib/python3.10/site-packages/ldap3/utils/asn1.py:50: DeprecationWarning: typeMap is deprecated. Please use TYPE_MAP instead. tests-1 | from pyasn1.codec.ber.encoder import tagMap, typeMap, AbstractItemEncoder tests-1 | tests-1 | test_health.py: 5 warnings tests-1 | test_k8s_serviceaccount_validation.py: 6 warnings tests-1 | test_knox_admin_path_traversal.py: 3 warnings tests-1 | test_knox_auth_service_and_ldap.py: 3 warnings tests-1 | test_knox_configs.py: 1 warning tests-1 | test_knox_ldap_cache.py: 3 warnings tests-1 | test_knox_ldap_injection.py: 7 warnings tests-1 | test_knoxauth_preauth_and_paths.py: 6 warnings tests-1 | test_knoxidf.py: 6 warnings tests-1 | test_knoxsso_redirect.py: 1 warning tests-1 | test_knoxtoken_jwt.py: 20 warnings tests-1 | test_remote_auth.py: 3 warnings tests-1 | test_remoteauth_extauthz_additional_path.py: 4 warnings tests-1 | /usr/local/lib/python3.10/site-packages/urllib3/connectionpool.py:1110: InsecureRequestWarning is being made to host 'knox'. Adding certificate verification is strongly advised. See:https://urllib3.readthedocs.io/en/latest/advanced-usage.html#tls-warnings tests-1 | warnings.warn( tests-1 | tests-1 | -- Docs: https://docs.pytest.org/en/stable/how-to/capture-warnings.html tests-1 | ----------------- generated xml file: /tests/test-results.xml ------------------ tests-1 | ======================= 77 passed, 70 warnings in 7.68s ======================== ``` ## Integration Tests `test_knoxidf.py` now asserts the JWT URN in the client_credentials, authorization_code, and refresh_token responses. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
