[
https://issues.apache.org/jira/browse/KNOX-3478?focusedWorklogId=1043638&page=com.atlassian.jira.plugin.system.issuetabpanels:worklog-tabpanel#worklog-1043638
]
ASF GitHub Bot logged work on KNOX-3478:
----------------------------------------
Author: ASF GitHub Bot
Created on: 23/Sep/26 20:18
Start Date: 23/Sep/26 20:18
Worklog Time Spent: 10m
Work Description: moresandeep opened a new pull request, #1425:
URL: https://github.com/apache/knox/pull/1425
[KNOX-3478](https://issues.apache.org/jira/browse/KNOX-3478) - Add support
to forward auth tokens in KNOX-AUTH-SERVICE
## What changes were proposed in this pull request?
Downstream services increasingly need the caller's **JWT bearer token**
itself, not just the
resolved username — e.g. to re-validate it, to extract scopes, or to call a
third service on
the user's behalf. There is currently no way to get it: the token is
consumed and discarded
by `JWTFederationFilter`, and nothing carries it forward.
This PR fixes this by setting the new
**`preauth.auth.header.auth.token.name`** service parameter on
`KNOX-AUTH-SERVICE` and making `auth/api/v1/pre` and `auth/api/v1/extauthz`
return the caller's token in the named response header, which the calling proxy
then copies onto the downstream request.
The header name that enables this feature is
**`preauth.auth.header.auth.token.name`** . By default this feature is OFF i.e.
auth tokens are no propagated downstream by default.
## How was this patch tested?
This patch was tested locally.
## Integration Tests
Added `.github/workflows/tests/test_knoxauth_token_forwarding.py` (11 tests)
plus three topology fixtures, all picked up by the existing default `tests`
service with no `tests.yml` or compose change — these topologies coexist with
the base gateway config, so they don't need a dedicated step.
| Topology | Scenario |
|---|---|
| `knoxauthtoken.xml` | parameter set ⇒ token forwarded |
| `knoxauthtokenlimit.xml` | `size.limit=16`, below any real JWT ⇒ omitted,
still 200 |
| `knoxauthtokencollide.xml` | token name == actor id name ⇒ token dropped,
identity kept |
| `knoxtoken.xml`, `knoxldap.xml` | **unchanged** — negative controls
proving the feature stays opt-in |
All three new topologies configure `group.principal.mapping =
guest=forwarded-token-group`. That is deliberate, not decoration: it makes
`groupsMapped` true so every request goes through the identity-assertion
re-wrap described above. That branch is the one a unit test can most easily
pass while the real code path drops the token, so
`test_forwarded_token_survives_the_identity_assertion_rewrap` asserts the
mapped group **and** the token in the same response — if the mapping ever stops
running, the test fails loudly instead of passing vacuously.
Coverage: byte-identical JWT with no `Bearer` prefix; `sub` naming the
original caller alongside `X-Knox-Actor-ID`; `Cache-Control: no-store` present
when a token is emitted and absent when it isn't; no header when the parameter
is unset; none for a Basic-auth caller; oversized token omitted at 200;
collision preserving the identity; 401 with no header for unauthenticated and
for a tampered token.
Issue Time Tracking
-------------------
Worklog Id: (was: 1043638)
Remaining Estimate: 0h
Time Spent: 10m
> Extend auth service API to pass JWT token as header downstream
> --------------------------------------------------------------
>
> Key: KNOX-3478
> URL: https://issues.apache.org/jira/browse/KNOX-3478
> Project: Apache Knox
> Issue Type: Bug
> Components: Server
> Reporter: Sandeep More
> Assignee: Sandeep More
> Priority: Major
> Time Spent: 10m
> Remaining Estimate: 0h
>
> There could be cases where we might need to pass user authenticated tokens to
> be passed down to the downstream applications along side `
> preauth.auth.header.actor.id.name` and
> `preauth.auth.header.actor.groups.prefix`
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
