[
https://issues.apache.org/jira/browse/KNOX-3499?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Work on KNOX-3499 started by Sandor Molnar.
-------------------------------------------
> Issuers named in `jwt.expected.issuer` never reach the trusted issuer registry
> ------------------------------------------------------------------------------
>
> Key: KNOX-3499
> URL: https://issues.apache.org/jira/browse/KNOX-3499
> Project: Apache Knox
> Issue Type: Bug
> Components: Server
> Reporter: Sandeep More
> Assignee: Sandor Molnar
> Priority: Major
>
> `AbstractJWTFilter.validateToken` has two disjoint signature verification
> routes
> and picks between them by testing the static list **first**
> ```
> (`gateway-provider-security-jwt/.../filter/AbstractJWTFilter.java:572-585`):
> if (expectedIssuers.contains(token.getIssuer())) {
> // static list: provider-configured PEM/JWKS/instance-key chain
> return doFullTokenValidation(..., Set.of());
> }
> final Set<URI> registeredIssuerJwks =
> resolveRegisteredIssuerJwks(token.getIssuer(), request);
> if (!registeredIssuerJwks.isEmpty()) {
> return doFullTokenValidation(..., registeredIssuerJwks);
> }
> handleValidationError(request, response, SC_UNAUTHORIZED, null);
> ```
> As a result any issuer named in `jwt.expected.issuer` never reaches the
> trusted issuer registry, even if it is registered there with `dynamicJwks`.
> `resolveRegisteredIssuerJwks` is not consulted at all for that issuer.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
