smolnar82 opened a new pull request, #1490: URL: https://github.com/apache/knox/pull/1490
[KNOX-3551](https://issues.apache.org/jira/browse/KNOX-3551) - KnoxIDF: accepting consent fails with an NPE because the consent state form field is lost ## What changes were proposed in this pull request? Clicking **Accept** on the KnoxIDF consent page returned HTTP 500 (an NPE in `KnoxIDFArtifactStore.get`). The consent page sends `state` as a form POST field. On topologies with an identity-assertion provider, `IdentityAsserterHttpServletRequestWrapper` reads and re-encodes the form body in `getInputStream()`, and after that `request.getParameter("state")` returns `null`, even on the unwrapped request. That `null` then went to the Caffeine-backed state store, which throws on null keys. - `AuthorizeResource.consentAccepted` now binds `state` with `@FormParam` (`@Consumes(APPLICATION_FORM_URLENCODED)`), so it reads the re-encoded body that Jersey receives. - A missing or blank `state` now returns 400 `invalid_request`, with an audit event (`reason=missing_state`), instead of a 500. - `KnoxIDFArtifactStore.get()` and `remove()` now treat a `null` key as a miss. ## How was this patch tested? - New unit test `AuthorizeResourceConsentStateParamTest` checks that a null or blank `state` gets a 400 `invalid_request`. - `KnoxIDFArtifactStoreTest` has a new case checking that a null key is a miss and doesn't throw. - Manual test on a local gateway: an SSO topology with the `Default` identity-assertion provider and `knoxidf.auto.consent.enabled=false`. Run `/authorize`, then click **Accept** on the consent page. The browser should be redirected to the `redirect_uri` with `code` and `state`, and the audit log should show `event=consent ... success`. ## Integration Tests None added. The existing KnoxIDF compose tests run with `knoxidf.auto.consent.enabled=true`, so they never reach the consent page. Covering this path would mean driving the HTML consent form through SSO. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
