[
https://issues.apache.org/jira/browse/KNOX-3477?focusedWorklogId=1043147&page=com.atlassian.jira.plugin.system.issuetabpanels:worklog-tabpanel#worklog-1043147
]
ASF GitHub Bot logged work on KNOX-3477:
----------------------------------------
Author: ASF GitHub Bot
Created on: 21/Sep/26 10:49
Start Date: 21/Sep/26 10:49
Worklog Time Spent: 10m
Work Description: hanicz opened a new pull request, #1419:
URL: https://github.com/apache/knox/pull/1419
…it.log
[KNOX-3477](https://issues.apache.org/jira/browse/KNOX-3477) - Capture the
RFC 8693 delegation actor-chain in gateway-audit.log
## What changes were proposed in this pull request?
This change appends the ordered chain to the free-form message field in
`gateway-audit.log`:
- **AUTHENTICATION** and **TOKEN_EXCHANGE** records now carry
`act_chain=<iss>/<sub><-<iss>/<sub>...`, most-recent → oldest, `<-` separator,
sub-only fallback when `iss` is absent.
- Empty chain → field omitted, so ordinary non-delegated requests are
byte-for-byte unchanged.
- Shared renderer in SubjectUtils.renderActorChain(...) reused by both call
sites; **TOKEN_EXCHANGE** depth + members share one source of truth.
## How was this patch tested?
Unit tests, local tests
Created token for SAM,TOM and GUEST
New delegation policy where SAM and GUEST can act for TOM
**Hop 1** - sam acts for tom
```
curl -sk -X POST
"https://localhost:8443/gateway/delegation/knoxtoken/api/v1/token"; \
-H "Content-Type: application/x-www-form-urlencoded" \
-d "grant_type=urn:ietf:params:oauth:grant-type:token-exchange" \
--data-urlencode "subject_token=$TOM" -d
"subject_token_type=urn:ietf:params:oauth:token-type:jwt" \
--data-urlencode "actor_token=$SAM" -d
"actor_token_type=urn:ietf:params:oauth:token-type:jwt"
```
```
|KNOXTOKEN||||token-exchange|principal|USER/sam|success|event_type=token_exchange_allowed
actor_authority=USER actor_id=sam subject_token_iss=KNOXSSO
subject_token_sub=tom requested_subject=
requested_resources=[] audiences_honored=false act_chain_depth=0
```
**Hop 2** - guest acts on tom's already delegated token (Hop 1)
```
curl -sk -X POST
"https://localhost:8443/gateway/delegation/knoxtoken/api/v1/token"; \
-H "Content-Type: application/x-www-form-urlencoded" \
-d "grant_type=urn:ietf:params:oauth:grant-type:token-exchange" \
--data-urlencode "subject_token=$DELEG1" -d
"subject_token_type=urn:ietf:params:oauth:token-type:jwt" \
--data-urlencode "actor_token=$GUEST" -d
"actor_token_type=urn:ietf:params:oauth:token-type:jwt"
```
```
|KNOXTOKEN||||token-exchange|principal|USER/guest|success|event_type=token_exchange_allowed
actor_authority=USER actor_id=guest subject_token_iss=KNOXSSO
subject_token_sub=tom requested_subj
ect= requested_resources=[] audiences_honored=false act_chain_depth=1
act_chain=sam
|KNOXTOKEN|guest|||authentication|uri|/gateway/delegation/knoxtoken/api/v1/token|success|act_chain=sam
```
Authenticate Hop2 token
`|KNOX-AUTH-SERVICE|tom|||authentication|uri|/gateway/tokenconsumer/auth/api/v1/pre|success|act_chain=guest<-sam
`
Issue Time Tracking
-------------------
Worklog Id: (was: 1043147)
Remaining Estimate: 0h
Time Spent: 10m
> Capture the RFC 8693 delegation actor-chain in gateway-audit.log
> ----------------------------------------------------------------
>
> Key: KNOX-3477
> URL: https://issues.apache.org/jira/browse/KNOX-3477
> Project: Apache Knox
> Issue Type: Task
> Components: Server
> Affects Versions: 3.1.0
> Reporter: Tamás Hanicz
> Assignee: Tamás Hanicz
> Priority: Major
> Time Spent: 10m
> Remaining Estimate: 0h
>
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
