hanicz opened a new pull request, #1419: URL: https://github.com/apache/knox/pull/1419
…it.log [KNOX-3477](https://issues.apache.org/jira/browse/KNOX-3477) - Capture the RFC 8693 delegation actor-chain in gateway-audit.log ## What changes were proposed in this pull request? This change appends the ordered chain to the free-form message field in `gateway-audit.log`: - **AUTHENTICATION** and **TOKEN_EXCHANGE** records now carry `act_chain=<iss>/<sub><-<iss>/<sub>...`, most-recent → oldest, `<-` separator, sub-only fallback when `iss` is absent. - Empty chain → field omitted, so ordinary non-delegated requests are byte-for-byte unchanged. - Shared renderer in SubjectUtils.renderActorChain(...) reused by both call sites; **TOKEN_EXCHANGE** depth + members share one source of truth. ## How was this patch tested? Unit tests, local tests Created token for SAM,TOM and GUEST New delegation policy where SAM and GUEST can act for TOM **Hop 1** - sam acts for tom ``` curl -sk -X POST "https://localhost:8443/gateway/delegation/knoxtoken/api/v1/token"; \ -H "Content-Type: application/x-www-form-urlencoded" \ -d "grant_type=urn:ietf:params:oauth:grant-type:token-exchange" \ --data-urlencode "subject_token=$TOM" -d "subject_token_type=urn:ietf:params:oauth:token-type:jwt" \ --data-urlencode "actor_token=$SAM" -d "actor_token_type=urn:ietf:params:oauth:token-type:jwt" ``` ``` |KNOXTOKEN||||token-exchange|principal|USER/sam|success|event_type=token_exchange_allowed actor_authority=USER actor_id=sam subject_token_iss=KNOXSSO subject_token_sub=tom requested_subject= requested_resources=[] audiences_honored=false act_chain_depth=0 ``` **Hop 2** - guest acts on tom's already delegated token (Hop 1) ``` curl -sk -X POST "https://localhost:8443/gateway/delegation/knoxtoken/api/v1/token"; \ -H "Content-Type: application/x-www-form-urlencoded" \ -d "grant_type=urn:ietf:params:oauth:grant-type:token-exchange" \ --data-urlencode "subject_token=$DELEG1" -d "subject_token_type=urn:ietf:params:oauth:token-type:jwt" \ --data-urlencode "actor_token=$GUEST" -d "actor_token_type=urn:ietf:params:oauth:token-type:jwt" ``` ``` |KNOXTOKEN||||token-exchange|principal|USER/guest|success|event_type=token_exchange_allowed actor_authority=USER actor_id=guest subject_token_iss=KNOXSSO subject_token_sub=tom requested_subj ect= requested_resources=[] audiences_honored=false act_chain_depth=1 act_chain=sam |KNOXTOKEN|guest|||authentication|uri|/gateway/delegation/knoxtoken/api/v1/token|success|act_chain=sam ``` Authenticate Hop2 token `|KNOX-AUTH-SERVICE|tom|||authentication|uri|/gateway/tokenconsumer/auth/api/v1/pre|success|act_chain=guest<-sam ` -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
