[
https://issues.apache.org/jira/browse/KNOX-3564?focusedWorklogId=1053982&page=com.atlassian.jira.plugin.system.issuetabpanels:worklog-tabpanel#worklog-1053982
]
ASF GitHub Bot logged work on KNOX-3564:
----------------------------------------
Author: ASF GitHub Bot
Created on: 11/Nov/26 08:10
Start Date: 11/Nov/26 08:10
Worklog Time Spent: 10m
Work Description: smolnar82 opened a new pull request, #1505:
URL: https://github.com/apache/knox/pull/1505
[KNOX-3564](https://issues.apache.org/jira/browse/KNOX-3564) - Increase
DELEGATION_POLICY_USERS.username column size to 2048 to support SPIFFE IDs
## What changes were proposed in this pull request?
The SPIFFE specification allows SPIFFE IDs of up to 2048 bytes ([SPIFFE ID
spec, section
2.3](https://spiffe.io/docs/latest/spiffe-specs/spiffe-id/#23-maximum-spiffe-id-length)),
but `DELEGATION_POLICY_USERS.username` was `VARCHAR(1023)`, so longer SPIFFE
IDs could not be stored as permitted users on a delegation policy.
- `createKnoxIDFDelegationPolicyTables.sql`:
`DELEGATION_POLICY_USERS.username` changed from `VARCHAR(1023)` to
`VARCHAR(2048)`
- `createKnoxIDFDelegationPolicyTablesOracle.sql`:
`DELEGATION_POLICY_USERS.username` changed from `VARCHAR2(1023)` to
`VARCHAR2(2048)`
This also aligns the column with `DELEGATION_POLICIES.actor_id`, which is
already 2048.
## How was this patch tested?
- Added `DelegationPolicySchemaTest.testUsernameAcceptsMaxLengthSpiffeId`,
which stores and reads back a 2048-character SPIFFE ID in
`DELEGATION_POLICY_USERS` (H2) and verifies that a 2049-character value is
rejected
- Ran `DelegationPolicySchemaTest` and `JdbcDelegationPolicyServiceTest`:
all tests pass
## Integration Tests
No integration test was added: this is a schema column size change, covered
by the unit test above.
Issue Time Tracking
-------------------
Worklog Id: (was: 1053982)
Remaining Estimate: 0h
Time Spent: 10m
> KnoxIDF: Increase DELEGATION_POLICY_USERS.username column size to 2048 to
> support SPIFFE IDs
> --------------------------------------------------------------------------------------------
>
> Key: KNOX-3564
> URL: https://issues.apache.org/jira/browse/KNOX-3564
> Project: Apache Knox
> Issue Type: Bug
> Components: JWT, KnoxIDF
> Reporter: Sandor Molnar
> Assignee: Sandor Molnar
> Priority: Major
> Fix For: 3.1.0
>
> Time Spent: 10m
> Remaining Estimate: 0h
>
> The {{username}} column of the {{DELEGATION_POLICY_USERS}} table is currently
> {{VARCHAR(1023)}} ({{{}VARCHAR2(1023){}}} on Oracle). The SPIFFE
> specification allows a SPIFFE ID to be up to 2048 bytes long ([SPIFFE ID
> spec, section
> 2.3|https://spiffe.io/docs/latest/spiffe-specs/spiffe-id/#23-maximum-spiffe-id-length]).
> Any SPIFFE ID longer than 1023 characters therefore can't be stored as a
> permitted user on a delegation policy.
> Integrating consumers have agreed to align with the spec maximum, so Knox
> should do the same. The column would then also match
> {{{}DELEGATION_POLICIES.actor_id{}}}, which is already {{{}VARCHAR(2048){}}}.
> *Proposed changes:*
> * {{{}createKnoxIDFDelegationPolicyTables.sql{}}}: change
> {{DELEGATION_POLICY_USERS.username}} from {{VARCHAR(1023)}} to
> {{VARCHAR(2048)}}
> * {{{}createKnoxIDFDelegationPolicyTablesOracle.sql{}}}: change
> {{DELEGATION_POLICY_USERS.username}} from {{VARCHAR2(1023)}} to
> {{VARCHAR2(2048)}}
> * Check that the composite primary key {{(registration_id, username)}} still
> fits the index key size limit of each supported database (36 + 2048 bytes)
> * Add or extend a test that saves and reads back a delegation policy whose
> username is 2048 characters long
> *Notes:*
> * The tables are created with {{{}CREATE TABLE IF NOT EXISTS{}}}, so a
> deployment that already has the table will keep the old column size. That
> shouldn't matter because KnoxIDF is unreleased (3.1.0-SNAPSHOT).
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
