[
https://issues.apache.org/jira/browse/KNOX-3509?focusedWorklogId=1046286&page=com.atlassian.jira.plugin.system.issuetabpanels:worklog-tabpanel#worklog-1046286
]
ASF GitHub Bot logged work on KNOX-3509:
----------------------------------------
Author: ASF GitHub Bot
Created on: 08/Oct/26 00:04
Start Date: 08/Oct/26 00:04
Worklog Time Spent: 10m
Work Description: hsheinblatt opened a new pull request, #1448:
URL: https://github.com/apache/knox/pull/1448
KNOX-3509 - Add k8s service DNS audience form, non-delegation audience
validation, any-path matching, and actor-subject binding to the k8s destination
audience validator
## What changes were proposed in this pull request?
Extends K8sDestinationAudienceValidator with a second accepted aud
format, extends destination validation to tokens with no act claim,
allows an empty path to mean service-only matching (any destination
path), and adds an opt-in check binding a delegation token's actor
to the service account presenting it. Also adds a parameter to
disable the new format for a deployment that cannot use it safely.
A second accepted aud entry shape, the "DNS form", is
https://<service>[.<namespace>[.svc[.<cluster-domain>]]][:port]
[/resource-path]
Issue Time Tracking
-------------------
Worklog Id: (was: 1046286)
Remaining Estimate: 0h
Time Spent: 10m
> Extend RequestAudienceValidator for non-delegation, dns form, service-only
> matching, and for act source validation
> ------------------------------------------------------------------------------------------------------------------
>
> Key: KNOX-3509
> URL: https://issues.apache.org/jira/browse/KNOX-3509
> Project: Apache Knox
> Issue Type: Sub-task
> Components: JWT
> Reporter: Harrison Sheinblatt
> Priority: Major
> Time Spent: 10m
> Remaining Estimate: 0h
>
> Extend the RequestAudienceValidator:
> # Enable audience validation of non-delegation tokens
> # Allow audiences in dns service form, for use when there is one trust domain
> # Allow audiences with no path to match all paths: this indicates that the
> audience is intended to show only the allowed service destination, not the
> particular endpoints. When used, the capabilities of the service allowed can
> be specified otherwise, such as with scopes in the future.
> # Allow an opt in check for service account actors to validate that the most
> recent act sub service account matches the source spiffe id from a trusted
> header. This shows that the service account for which the token was issued is
> the one using it, and prevents a leaked token from being used by a different
> source.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
