smolnar82 opened a new pull request, #1376: URL: https://github.com/apache/knox/pull/1376
[KNOX-3432](https://issues.apache.org/jira/browse/KNOX-3432) - Advertise RFC 8693 token-exchange grant type in KnoxIDF discovery metadata ## What changes were proposed in this pull request? KnoxIDF supports OAuth 2.0 Token Exchange (RFC 8693), but its OIDC discovery document (`.well-known/openid-configuration`) only listed `authorization_code` and `refresh_token` in `grant_types_supported`. Per RFC 8414 §2 that field must list every grant type the server supports, so a spec-compliant reader would wrongly conclude token exchange is unavailable. - Added `TOKEN_EXCHANGE_GRANT_TYPE = "urn:ietf:params:oauth:grant-type:token-exchange"` to `KnoxIDFConstants` (RFC 8693 §2.1, IANA-registered). Intentionally duplicated from `JWTFederationFilter.TOKEN_EXCHANGE` rather than shared; it's a fixed standard identifier, and duplicating avoids a module dependency on the JWT federation provider. - `DiscoveryResource` now includes this value in `grant_types_supported`. ## How was this patch tested? - Extended `DiscoveryResourceMetadataTest` to assert the discovery document advertises all three grant types, including the token-exchange URN. - `mvn -pl gateway-service-knoxidf test -Dtest=DiscoveryResourceMetadataTest`: passes. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
