[
https://issues.apache.org/jira/browse/KNOX-3464?focusedWorklogId=1042534&page=com.atlassian.jira.plugin.system.issuetabpanels:worklog-tabpanel#worklog-1042534
]
ASF GitHub Bot logged work on KNOX-3464:
----------------------------------------
Author: ASF GitHub Bot
Created on: 18/Sep/26 05:12
Start Date: 18/Sep/26 05:12
Worklog Time Spent: 10m
Work Description: smolnar82 commented on code in PR #1410:
URL: https://github.com/apache/knox/pull/1410#discussion_r4043992081
##########
knox-site/docs/knoxidf/endpoints.md:
##########
@@ -208,6 +209,47 @@ plus any allowed profile claims (`preferred_username`,
`email`, `email_verified`
mismatch, PKCE failure, bad `client_secret`, disabled/expired refresh token) or
`invalid_request` (unsupported `grant_type`).
+### Token Exchange grant
+
+Trades one JWT for another under [RFC
8693](https://www.rfc-editor.org/rfc/rfc8693) — either for
+the same subject (e.g. to narrow a token's audience) or, when delegation is
enabled, for a
+different subject on whose behalf a trusted actor acts. The concepts,
switches, and delegation-policy
+model are covered on the [Token Exchange & Delegation](token_exchange.md)
page; this section is the
+wire-level reference.
+
+| Parameter | Required | Description |
+|-----------|----------|-------------|
+| `grant_type` | Yes | `urn:ietf:params:oauth:grant-type:token-exchange`. |
+| `subject_token` | Yes | The token whose subject the exchange is for. |
+| `subject_token_type` | Yes | `urn:ietf:params:oauth:token-type:jwt` or its
alias `urn:ietf:params:oauth:token-type:access_token`; any other type →
`invalid_request`. |
+| `actor_token` | No | Token of the acting party in an on-behalf-of exchange. |
+| `actor_token_type` | Conditional | Required when `actor_token` is present,
and must be absent otherwise. Same JWT-family types. |
+| `requested_subject` | No | Subject to impersonate in a headless exchange.
Read only when `delegation.requested.subject.enabled=true`. |
+| `resource` | No | Target service URI(s), RFC 8707. Absolute URI, no
fragment, else `invalid_target`. Repeatable / comma-splittable. |
+| `audience` | No | Logical target audience(s). Repeatable / comma-splittable.
|
+
+**Success (`200`):** the standard token response, extended with the RFC 8693
`issued_token_type`:
+
+```json
+{
+ "access_token": "<JWT>",
+ "token_id": "<UUID>",
+ "token_type": "Bearer",
+ "issued_token_type": "urn:ietf:params:oauth:token-type:jwt",
+ "expires_in": 86400,
+ "managed_token": "true"
Review Comment:
This is just a sample response, I can change it to `false`.
In production development this really depends on the TSS setting on the
topology.
Issue Time Tracking
-------------------
Worklog Id: (was: 1042534)
Time Spent: 50m (was: 40m)
> Document delegation policy and trusted OIDC features in KnoxIDF
> ---------------------------------------------------------------
>
> Key: KNOX-3464
> URL: https://issues.apache.org/jira/browse/KNOX-3464
> Project: Apache Knox
> Issue Type: Sub-task
> Components: Document
> Affects Versions: 3.1.0
> Reporter: Sandor Molnar
> Assignee: Sandor Molnar
> Priority: Major
> Fix For: 3.1.0
>
> Time Spent: 50m
> Remaining Estimate: 0h
>
> Lots of changes went in w/o documentation. We need to enhance existing
> KnoxIDF documents with the details.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
