Sandor Molnar created KNOX-3455:
-----------------------------------
Summary: CI Gate - Same-Subject Token Exchange End-to-End Tests
Pass in Default CI Run
Key: KNOX-3455
URL: https://issues.apache.org/jira/browse/KNOX-3455
Project: Apache Knox
Issue Type: Task
Components: CI
Reporter: Sandor Molnar
Assignee: Sandor Molnar
Fix For: 3.1.0
As a KNOXIDF client, I want CI evidence that same-subject token exchange works
end-to-end through a running Knox gateway, so that I can validate the
capability before integrating my service.
ACCEPTANCE CRITERIA:
# A new integration test file for token exchange is added and runs in the
default CI build.
# A successful same-subject exchange returns correct sub, aud, iss, scope, and
issued_token_type values in the issued token.
# A successful same subject with no act claim exchange where no scopes are
present in the subject token passes.
# A successful same subject with no act claim exchange where all requested
scopes are present in the subject token passes.
# A successful same subject with no act claim and no requested scopes passes.
# A successful same subject with act claim and no requested scopes passes.
# A successful same subject with act claim and requested scope and
# A request missing the audience parameter returns HTTP 400 with error code
invalid_request.
# A request with multiple audience values returns HTTP 400 with error code
invalid_request.
# A request where the subject token has no act cliam and has an audience claim
that is a full token prefix of the requested audience passes.
# A request where the subject token has no act claim and has an audience claim
that is not a full token prefix of the requested audience returns error code
invalid_scope.
# A request where the requested audience is not in the subject token's aud
claim returns error code invalid_scope.
# A request where the subject token has scopes defined and a requested scope
is not in the subject token returns error code invalid_scope.
# A cross-subject attempt using the topology with delegation disabled returns
an error indicating delegation is not permitted.
# A same-subject exchange against the delegation-enabled topology succeeds
normally.
# The delegation topology file and the same-subject-only topology file are
added to the CI Dockerfile.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
