[
https://issues.apache.org/jira/browse/KNOX-3441?focusedWorklogId=1041595&page=com.atlassian.jira.plugin.system.issuetabpanels:worklog-tabpanel#worklog-1041595
]
ASF GitHub Bot logged work on KNOX-3441:
----------------------------------------
Author: ASF GitHub Bot
Created on: 15/Sep/26 09:11
Start Date: 15/Sep/26 09:11
Worklog Time Spent: 10m
Work Description: hsheinblatt opened a new pull request, #1398:
URL: https://github.com/apache/knox/pull/1398
KNOX-3441 - Add delegated token exchange (actor-token and headless) with
policy enforcement and audit
## What changes were proposed in this pull request?
Implements RFC 8693 delegated token exchange in TokenExchangeHandler:
a request is classified as same-subject (dispatched unchanged) or a
delegation attempt, expressed either interactively via actor_token or,
headlessly, via a requested_subject that differs from the subject_token's
own subject. All delegation behavior is gated behind five new topology
flags on JWTFederationFilter (delegation.server.enabled,
delegation.requested.subject.enabled,
delegation.enforce.requested.audience.required,
delegation.enforce.requested.audience.exactly.one,
delegation.requested.scope.enabled),
each defaulting to false and resolved once at init() alongside the filter's
existing DelegationPolicyService resolution, exposed to TokenExchangeHandler
through a new evaluateDelegationPolicy() callback so the handler retains no
direct GatewayServices/GatewayConfig access.
Delegation requests are rejected uniformly when delegation.server.enabled is
off, and the invalid combination of actor_token present with a differing
requested_subject is rejected once the gate is on. For headless delegation,
createSubjectForHeadlessDelegation() treats the subject_token's identity as
the actor (PrimaryPrincipal) and requested_subject as the impersonated
party, carried via TokenExchangePrincipal with a null subjectIssuer; no
ActorChainPrincipal is added, since subject_token here is the actor's own
token, not the impersonated user's. requested_subject is format-validated
(length bound, no control characters) and, per flag, audience/resource
values can be required (at least one) and/or capped (at most one distinct
combined audience/resource value).
DelegationPolicyService.evaluate() is called exactly once for an otherwise
valid delegated exchange, for both the actor_token and requested_subject
forms. The actor identity passed to the policy check is derived from the
actor's validated JWT: a Kubernetes service-account subject
(system:serviceaccount:<namespace>:<sa-name>) is tagged K8S_SA with actorId
"<issuer>:<namespace>:<sa-name>" (avoiding collisions across namespaces/
clusters); every other subject is tagged USER with the subject value itself
as actorId. A policy denial maps to HTTP 400 invalid_request with a generic
description that does not identify which value or scope failed; the
pre-existing canActFor.groups UnsupportedOperationException still maps to
HTTP 501, unaffected. Requested scopes are passed through as empty for now;
scope parsing/validation is deferred. Actor-chain depth is parsed but not
yet capped, and PolicyDecision's effectiveTtlSec is computed but not yet
used to override the issued token's TTL
Issue Time Tracking
-------------------
Worklog Id: (was: 1041595)
Remaining Estimate: 0h
Time Spent: 10m
> Delegation policy enforcement in token RFC 8693 token exchange
> --------------------------------------------------------------
>
> Key: KNOX-3441
> URL: https://issues.apache.org/jira/browse/KNOX-3441
> Project: Apache Knox
> Issue Type: Task
> Components: JWT
> Reporter: Harrison Sheinblatt
> Priority: Major
> Time Spent: 10m
> Remaining Estimate: 0h
>
> Enable the enforcement of delegation policies for token exchange.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
