[
https://issues.apache.org/jira/browse/KNOX-3476?focusedWorklogId=1042699&page=com.atlassian.jira.plugin.system.issuetabpanels:worklog-tabpanel#worklog-1042699
]
ASF GitHub Bot logged work on KNOX-3476:
----------------------------------------
Author: ASF GitHub Bot
Created on: 18/Sep/26 14:01
Start Date: 18/Sep/26 14:01
Worklog Time Spent: 10m
Work Description: smolnar82 opened a new pull request, #1416:
URL: https://github.com/apache/knox/pull/1416
[KNOX-3476](https://issues.apache.org/jira/browse/KNOX-3476) - Add
end-to-end integration tests for the RFC 8693 delegation path
## What changes were proposed in this pull request?
Adds CI-only integration coverage for the full RFC 8693 delegation path
through a running Knox gateway (no product code changed):
- **`.github/workflows/tests/test_delegation.py`**: drives the delegation
path against seeded per-actor policies (registered via the `KNOXIDF_ADMIN` REST
API):
- AC2 user policy,
- AC3 group policy,
- AC4 multi-actor isolation,
- AC5 subject-not-in-group deny,
- AC6 no-policy deny,
- AC7 resource-not-in-policy deny,
- AC8 policy TTL caps token lifetime,
- AC9 headless succeed/deny.
Denials assert the RFC 6749 §5.2 `invalid_request` body.
- **`.github/workflows/tests/delegation_helpers.py`**: shared
`token_exchange` / `assert_oauth_error` / `aud_values` helpers and a
`DelegationPolicyAdmin` client, extracted from `test_token_exchange.py` so both
suites use one implementation.
-
**`.github/workflows/build/conf/topologies/knoxidf-token-delegation-policy.xml`**:
new topology that mints the delegation result (server delegation +
requested-subject/audience enforcement, nested `act` claim, passthrough
audience validator, large service TTL so a shorter per-policy TTL is provably
what caps lifetime).
The suite deliberately does not revoke the tokens it mints and uses
`recursiveUser`/`sam` as actors and `tom` as subject — none of which any other
suite mints against a per-user-limited topology — so its footprint on the
gateway-wide token store cannot exhaust another user's quota. This keeps the
tests correct without token management, matching the production posture where
token management is not enabled for tokens involved in RFC 8693 exchanges.
## How was this patch tested?
Ran the full Docker Compose integration suite locally: **101 passed**; see
below
## Integration Tests
```
tests-1 | ------------------------------------
tests-1 | Your code has been rated at 10.00/10
tests-1 |
tests-1 | Waiting for knox...
tests-1 | ============================= test session starts
==============================
tests-1 | platform linux
Issue Time Tracking
-------------------
Worklog Id: (was: 1042699)
Remaining Estimate: 0h
Time Spent: 10m
> CI Gate - Cross-Subject Delegation Exchange with Policy Enforcement Tests
> Pass in CI
> ------------------------------------------------------------------------------------
>
> Key: KNOX-3476
> URL: https://issues.apache.org/jira/browse/KNOX-3476
> Project: Apache Knox
> Issue Type: Task
> Components: CI
> Affects Versions: 3.1.0
> Reporter: Sandor Molnar
> Assignee: Sandor Molnar
> Priority: Major
> Fix For: 3.1.0
>
> Time Spent: 10m
> Remaining Estimate: 0h
>
> As a KnoxIDF client, I want CI evidence that the full delegation path
> including policy evaluation, LDAP group lookup, act chain, per-policy TTL,
> and headless delegation gating works end-to-end through a running Knox
> gateway.
> *ACCEPTANCE CRITERIA:*
> # A new integration test file for delegation tests is added and runs in the
> default CI build.
> # A successful delegation exchange with a user-based policy produces an
> issued token with correct sub, act, aud, iss (scope is deferred now) values.
> # A delegation exchange where the subject user is in an allowed LDAP group
> succeeds
> # When multiple delegation policies are registered for different actors,
> each actor can only access the resources in its own policy. Attempting to use
> one actor's policy for another actor's resource fails.
> # A delegation exchange where the subject user is not in the required LDAP
> group returns invalid_request.
> # An exchange by an actor with no registered policy returns invalid_request.
> # An exchange requesting a resource not in the policy returns
> invalid_request.
> # An exchange where the policy max token TTL is shorter than the
> service-level TTL produces an issued token with a lifetime at or below the
> policy max.
> # A headless delegation exchange succeeds when the policy allows it and
> fails with invalid_request when the policy does not.
> # Deferred: An exchange requesting a scope not allowed for the requested
> resource returns invalid_request.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
