[
https://issues.apache.org/jira/browse/KNOX-3281?focusedWorklogId=1043383&page=com.atlassian.jira.plugin.system.issuetabpanels:worklog-tabpanel#worklog-1043383
]
ASF GitHub Bot logged work on KNOX-3281:
----------------------------------------
Author: ASF GitHub Bot
Created on: 22/Sep/26 17:26
Start Date: 22/Sep/26 17:26
Worklog Time Spent: 10m
Work Description: arunk-kumar opened a new pull request, #1421:
URL: https://github.com/apache/knox/pull/1421
## Summary
- `DefaultTokenAuthorityService` previously hard-cast the configured
signing/verification
key to RSAPrivateKey/RSAPublicKey, failing if an operator configured an EC
key.
- Generalized key handling to accept RSA or EC keys, matched against the
requested JWS
algorithm (RS*/PS* for RSA, ES* for EC), throwing a TokenServiceException
on mismatch
instead of a raw ClassCastException.
- Added a `TokenUtils.getThumbprint(ECPublicKey, ...)` overload alongside
the existing
RSA one, and reworded the `GatewayResources` key-type-mismatch messages to
be
algorithm-agnostic.
- Scope intentionally kept to `DefaultTokenAuthorityService` + `TokenUtils`;
`JWKSResource`
and the external-PEM `verifyToken(JWT, RSAPublicKey)` overload are left
for follow-up.
## Test plan
- Added unit tests: EC signing (`ES256`), EC `start()`/KID caching,
algorithm/key-type
mismatch (expects `TokenServiceException`), EC JWK thumbprint.
- Existing RSA/HMAC tests pass unmodified — no behavior change for those
paths.
- Full `mvn clean verify` across the entire reactor: BUILD SUCCESS.
Issue Time Tracking
-------------------
Worklog Id: (was: 1043383)
Remaining Estimate: 0h
Time Spent: 10m
> DefaultTokenAuthorityService only supports RSA keys, fails with EC-based
> signing keys
> -------------------------------------------------------------------------------------
>
> Key: KNOX-3281
> URL: https://issues.apache.org/jira/browse/KNOX-3281
> Project: Apache Knox
> Issue Type: Task
> Components: Server
> Affects Versions: 2.0.0, 1.6.0, 2.1.0
> Reporter: Sandor Molnar
> Assignee: Sandor Molnar
> Priority: Critical
> Fix For: 3.1.0
>
> Time Spent: 10m
> Remaining Estimate: 0h
>
> *Description:*
> The current implementation of
> {{DefaultTokenAuthorityService}} (gateway-server module) assumes that signing
> keys are of type {{RSAPublicKey}} / {{{}RSAPrivateKey{}}}.
> During initialization, the service explicitly casts or operates on RSA key
> types, which makes it incompatible with other valid key algorithms supported
> by Java security APIs, such as EC (Elliptic Curve) keys.
> As a result, when a non-RSA key pair (e.g., EC-based keys) is configured for
> token signing, the service fails to start due to type mismatch or unsupported
> key handling.
> *Steps to Reproduce:*
> # Configure token signing with an EC key pair (e.g., using {{ECPrivateKey}}
> / {{{}ECPublicKey{}}})
> # Start the Knox gateway
> # Observe service initialization failure in {{DefaultTokenAuthorityService}}
> *Actual Result:*
> The service fails to initialize when non-RSA keys are used.
> *Expected Result:*
> The service should support multiple key algorithms (at least RSA and EC), as
> long as they are compatible with the configured signing algorithm (e.g., JWT
> signing via JCA/JCE).
> *Impact:*
> * Prevents users from using modern or preferred cryptographic algorithms
> (e.g., EC keys)
> * Limits interoperability and flexibility in security configurations
> * May block deployments with stricter security/compliance requirements
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
