arunk-kumar opened a new pull request, #1421:
URL: https://github.com/apache/knox/pull/1421
## Summary
- `DefaultTokenAuthorityService` previously hard-cast the configured
signing/verification
key to RSAPrivateKey/RSAPublicKey, failing if an operator configured an EC
key.
- Generalized key handling to accept RSA or EC keys, matched against the
requested JWS
algorithm (RS*/PS* for RSA, ES* for EC), throwing a TokenServiceException
on mismatch
instead of a raw ClassCastException.
- Added a `TokenUtils.getThumbprint(ECPublicKey, ...)` overload alongside
the existing
RSA one, and reworded the `GatewayResources` key-type-mismatch messages to
be
algorithm-agnostic.
- Scope intentionally kept to `DefaultTokenAuthorityService` + `TokenUtils`;
`JWKSResource`
and the external-PEM `verifyToken(JWT, RSAPublicKey)` overload are left
for follow-up.
## Test plan
- Added unit tests: EC signing (`ES256`), EC `start()`/KID caching,
algorithm/key-type
mismatch (expects `TokenServiceException`), EC JWK thumbprint.
- Existing RSA/HMAC tests pass unmodified — no behavior change for those
paths.
- Full `mvn clean verify` across the entire reactor: BUILD SUCCESS.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
