Sandor Molnar created KNOX-3476:
-----------------------------------
Summary: CI Gate - Cross-Subject Delegation Exchange with Policy
Enforcement Tests Pass in CI
Key: KNOX-3476
URL: https://issues.apache.org/jira/browse/KNOX-3476
Project: Apache Knox
Issue Type: Task
Components: CI
Affects Versions: 3.1.0
Reporter: Sandor Molnar
Assignee: Sandor Molnar
Fix For: 3.1.0
As a KnoxIDF client, I want CI evidence that the full delegation path including
policy evaluation, LDAP group lookup, act chain, per-policy TTL, and headless
delegation gating works end-to-end through a running Knox gateway.
*ACCEPTANCE CRITERIA:*
# A new integration test file for delegation tests is added and runs in the
default CI build.
# A successful delegation exchange with a user-based policy produces an issued
token with correct sub, act, aud, iss (scope is deferred now) values.
# A delegation exchange where the subject user is in an allowed LDAP group
succeeds
# When multiple delegation policies are registered for different actors, each
actor can only access the resources in its own policy. Attempting to use one
actor's policy for another actor's resource fails.
# A delegation exchange where the subject user is not in the required LDAP
group returns invalid_request.
# An exchange by an actor with no registered policy returns invalid_request.
# An exchange requesting a resource not in the policy returns invalid_request.
# An exchange where the policy max token TTL is shorter than the service-level
TTL produces an issued token with a lifetime at or below the policy max.
# A headless delegation exchange succeeds when the policy allows it and fails
with invalid_request when the policy does not.
# Deferred: An exchange requesting a scope not allowed for the requested
resource returns invalid_request.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
