[
https://issues.apache.org/jira/browse/KNOX-3476?focusedWorklogId=1042703&page=com.atlassian.jira.plugin.system.issuetabpanels:worklog-tabpanel#worklog-1042703
]
ASF GitHub Bot logged work on KNOX-3476:
----------------------------------------
Author: ASF GitHub Bot
Created on: 18/Sep/26 14:10
Start Date: 18/Sep/26 14:10
Worklog Time Spent: 10m
Work Description: github-actions[bot] commented on PR #1416:
URL: https://github.com/apache/knox/pull/1416#issuecomment-5731215264
## Test Results
4 files 4 suites 43s ⏱️
108 tests 108 ✅ 0 💤 0 ❌
126 runs 126 ✅ 0 💤 0 ❌
Results for commit 29aacbb4.
[test-results]:data:application/gzip;base64,H4sIAG5GrWoC/13MSw7CIBSF4a00jB1USgu4GXMvj4TYFkNh1Lh3KamIDr//JGcn1s1mI7eOXTqyJRcrdAoQnV8PDtl5icd27cVH9y0p9Z8e7plTX4MFN/8EE4IPZwlpLZ90OlEvm/J9LG4Oi9s/5ZfFxQxCJYBCZIxrHLUFhsAE4KgGQyXnglOUE1hDXm91XK3fBAEAAA==
Issue Time Tracking
-------------------
Worklog Id: (was: 1042703)
Time Spent: 20m (was: 10m)
> CI Gate - Cross-Subject Delegation Exchange with Policy Enforcement Tests
> Pass in CI
> ------------------------------------------------------------------------------------
>
> Key: KNOX-3476
> URL: https://issues.apache.org/jira/browse/KNOX-3476
> Project: Apache Knox
> Issue Type: Task
> Components: CI
> Affects Versions: 3.1.0
> Reporter: Sandor Molnar
> Assignee: Sandor Molnar
> Priority: Major
> Fix For: 3.1.0
>
> Time Spent: 20m
> Remaining Estimate: 0h
>
> As a KnoxIDF client, I want CI evidence that the full delegation path
> including policy evaluation, LDAP group lookup, act chain, per-policy TTL,
> and headless delegation gating works end-to-end through a running Knox
> gateway.
> *ACCEPTANCE CRITERIA:*
> # A new integration test file for delegation tests is added and runs in the
> default CI build.
> # A successful delegation exchange with a user-based policy produces an
> issued token with correct sub, act, aud, iss (scope is deferred now) values.
> # A delegation exchange where the subject user is in an allowed LDAP group
> succeeds
> # When multiple delegation policies are registered for different actors,
> each actor can only access the resources in its own policy. Attempting to use
> one actor's policy for another actor's resource fails.
> # A delegation exchange where the subject user is not in the required LDAP
> group returns invalid_request.
> # An exchange by an actor with no registered policy returns invalid_request.
> # An exchange requesting a resource not in the policy returns
> invalid_request.
> # An exchange where the policy max token TTL is shorter than the
> service-level TTL produces an issued token with a lifetime at or below the
> policy max.
> # A headless delegation exchange succeeds when the policy allows it and
> fails with invalid_request when the policy does not.
> # Deferred: An exchange requesting a scope not allowed for the requested
> resource returns invalid_request.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
