Sandor Molnar created KNOX-3437:
-----------------------------------
Summary: Address comments in PR 1373
Key: KNOX-3437
URL: https://issues.apache.org/jira/browse/KNOX-3437
Project: Apache Knox
Issue Type: Sub-task
Components: Server
Affects Versions: 3.1.0
Reporter: Sandor Molnar
Assignee: Sandor Molnar
Fix For: 3.1.0
Larry's [comment|https://github.com/apache/knox/pull/1373/changes#r3916619548]
from PR 1373:
{noformat}
I'm not sure that I like how this is being done. We are leaking exchange
specifics into the API service which should only be about issuing tokens.
Perhaps this is happening already elsewhere but I want to be careful not to do
this.
Author
The leak is really the naming, not the mechanism. I'll rename the attribute to
a generic knox.token.requested.audiences and reword the docs/comment so
TokenResource only knows "an upstream filter may have pre-resolved the
requested audiences; use them over the query param" — no RFC 8693 / exchange
references. The exchange specifics stay entirely in TokenExchangeHandler.
Pushing that shortly.
Contributor
Okay. Let's move forward here but I think we need to do some careful testing.
Having no way to ensure that the form body param is chosen over the query param
without using the JWTProvider may be problematic.{noformat}
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
