[
https://issues.apache.org/jira/browse/KNOX-3493?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18120847#comment-18120847
]
ASF subversion and git services commented on KNOX-3493:
-------------------------------------------------------
Commit 8fc8018f7e21972f419e84b53c308431a0e405a1 in knox's branch
refs/heads/master from Sandor Molnar
[ https://gitbox.apache.org/repos/asf?p=knox.git;h=8fc8018f7 ]
KNOX-3493: Add k8s SA policy-enforced actor-token and headless
requested_subject delegation E2E tests (#1434)
> k8s delegation E2E: policy-enforced SA actor-token delegation and headless
> SA-subject requested_subject exchange
> ----------------------------------------------------------------------------------------------------------------
>
> Key: KNOX-3493
> URL: https://issues.apache.org/jira/browse/KNOX-3493
> Project: Apache Knox
> Issue Type: Bug
> Components: Server
> Affects Versions: 3.1.0
> Reporter: Sandor Molnar
> Assignee: Sandor Molnar
> Priority: Critical
> Fix For: 3.1.0
>
> Time Spent: 40m
> Remaining Estimate: 0h
>
> *Description*
> Add the two token-exchange E2E scenarios that depend on delegation-policy
> enforcement in the exchange path - actor-token (on-behalf-of) delegation and
> headless (requested_subject) exchange. These cannot be tested against the
> currently-merged backend: TokenExchangeHandler builds a delegation Subject
> but performs no DelegationPolicyService.evaluate check, and there is no
> requested_subject/headless handling at all. This sub-task lands once that
> backend work merges, reusing the harness delivered by the sibling ticket.
> *In scope*
> Extend test_k8s_delegation.py (harness from the sibling ticket) with the
> delegation + headless scenarios below, including both the policy-allows (200)
> and policy-denies (400) cases.
> Seed delegation policies as part of test setup via the admin API (or the
> compose bootstrap) so the allow/deny paths are deterministic.
> *Out of scope*
> Harness, CA/issuer export, KNOXIDF_ADMIN topology, same-subject exchange, and
> negative-path tests — all delivered by the sibling ticket.
> The backend enforcement + requested_subject/headless implementation itself —
> tracked under the in-flight backend work (see Dependencies); this ticket is
> tests only.
> *Acceptance criteria*
> * (AC4) A delegation exchange with an SA actor_token + a Knox-user
> subject_token succeeds with HTTP 200 when a matching delegation policy
> exists, and is rejected with HTTP 400 when no policy matches.
> * (AC5) A headless exchange with an SA subject_token + requested_subject
> succeeds with HTTP 200 when policy allows headless delegation, and is
> rejected when it does not.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
