Harrison Sheinblatt created KNOX-3509:
-----------------------------------------
Summary: Extend RequestAudienceValidator for non-delegation, dns
form, service-only matching, and for act source validation
Key: KNOX-3509
URL: https://issues.apache.org/jira/browse/KNOX-3509
Project: Apache Knox
Issue Type: Sub-task
Components: JWT
Reporter: Harrison Sheinblatt
Extend the RequestAudienceValidator:
# Enable audience validation of non-delegation tokens
# Allow audiences in dns service form, for use when there is one trust domain
# Allow audiences with no path to match all paths: this indicates that the
audience is intended to show only the allowed service destination, not the
particular endpoints. When used, the capabilities of the service allowed can be
specified otherwise, such as with scopes in the future.
# Allow an opt in check for service account actors to validate that the most
recent act sub service account matches the source spiffe id from a trusted
header. This shows that the service account for which the token was issued is
the one using it, and prevents a leaked token from being used by a different
source.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
