Sandeep More created KNOX-3499:
----------------------------------
Summary: Issuers named in `jwt.expected.issuer` never reach the
trusted issuer registry
Key: KNOX-3499
URL: https://issues.apache.org/jira/browse/KNOX-3499
Project: Apache Knox
Issue Type: Bug
Components: Server
Reporter: Sandeep More
`AbstractJWTFilter.validateToken` has two disjoint signature verification routes
and picks between them by testing the static list **first**
```
(`gateway-provider-security-jwt/.../filter/AbstractJWTFilter.java:572-585`):
if (expectedIssuers.contains(token.getIssuer())) {
// static list: provider-configured PEM/JWKS/instance-key chain
return doFullTokenValidation(..., Set.of());
}
final Set<URI> registeredIssuerJwks =
resolveRegisteredIssuerJwks(token.getIssuer(), request);
if (!registeredIssuerJwks.isEmpty()) {
return doFullTokenValidation(..., registeredIssuerJwks);
}
handleValidationError(request, response, SC_UNAUTHORIZED, null);
```
As a result any issuer named in `jwt.expected.issuer` never reaches the
trusted issuer registry, even if it is registered there with `dynamicJwks`.
`resolveRegisteredIssuerJwks` is not consulted at all for that issuer.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
