Harrison Sheinblatt created KNOX-3534:
-----------------------------------------
Summary: Add k8s request audience validator bypass for JWTs from
an ingress
Key: KNOX-3534
URL: https://issues.apache.org/jira/browse/KNOX-3534
Project: Apache Knox
Issue Type: Sub-task
Components: JWT
Reporter: Harrison Sheinblatt
The existing K8sDestinationAudienceValidator feature focus on service to
service audience validation. Enable using the validator for the use case where
a single topology is to validate all jwts, both service to service and ingress
traffic JWTs.
Add flags to enable a feature to match JWTs coming from an ingress gateway and
treat them differently: either validate the audience against the same static
whitelist used for the rest of the traffic, or skip audience validation. This
path would be split and evaluated first. Delegation tokens are not allowed on
that path, so even if they come from an ingress, still treat them as they are
now.
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
