smolnar82 opened a new pull request, #1410: URL: https://github.com/apache/knox/pull/1410
[KNOX-3464](https://issues.apache.org/jira/browse/KNOX-3464) - Document KnoxIDF RFC 8693 token exchange & delegation ## What changes were proposed in this pull request? Documents the previously-undocumented KnoxIDF RFC 8693 Token Exchange & Delegation feature in the `knox-site/` MkDocs site, and corrects/fills gaps found while auditing the KnoxIDF reference pages against the source. Documentation only - no code changes. **New page** - `knoxidf/token_exchange.md` — the conceptual home for the feature: same-subject vs delegated (actor-token / headless) exchange, delegation policies (`(actorAuthority, actorId)` keying, `canActForUsers`/`canActForGroups`, `allowHeadlessExchange`, `tokenTtlSec`, `resourcePolicy`, evaluation order, generic-denial and LDAP fail-closed behavior), requested-audience enforcement, token lifetime, actor-chain depth cap, Kubernetes ServiceAccount subjects, the delegation-policy admin API, a config summary, and `curl` examples. **Reference-page edits** - `endpoints.md` — Token Exchange grant subsection, Delegation Policies admin section + summary row, and a note that registration is served only by `/client/register` (the bare `/client` GET/POST are unimplemented and return 500). - `configuration.md` — new Token-exchange/delegation and Delegation-policy-service tables; **corrected** dead trusted issuer discovery keys (`gateway.trustedoidcissuer.*` → `gateway.trusted.oidc.issuer.discovery.*`) and DB TLS truststore keys (`.path`/`.alias` → `.file`/`.type` + `.verify.server.cert`); **added** `gateway.signing.key.passphrase.alias` an `knoxidf.custom.loopback.hosts`; fixed a broken `.html` cross-link. - `security.md` — Delegation authorization section; custom-loopback-hosts note. - `operations.md` — delegation-policy persistence subsection; token-exchange/delegation audit-field table. - `index.md` — token exchange / delegation capability row. - `config_knox_token.md` — clarifying note that classic KNOXTOKEN `expires_in` is an absolute epoch-ms timestamp while KnoxIDF returns RFC 6749 relative seconds. - `mkdocs.yml` — nav entry for the new page. All parameter names, defaults, endpoints, and error codes were verified against the source constants. ## How was this patch tested? - `mkdocs build --strict` — builds with **zero** warnings referencing any `knoxidf/` page and the new `token_exchange.md`. (The 11 remaining strict warnings are all pre-existing, unrelated issues on other pages: nav entries for not-yet-written files and legacy `.html` links in `knox_cli.md`/`service_oozie.md`.) - Cross-page anchors added by this change were verified to resolve. - Each documented config key / endpoint / error code was grep-verified against the Java source (`--include=*.java`) to confirm exact strings and defaults. ## Integration Tests N/A ## UI changes N/A -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
