[
https://issues.apache.org/jira/browse/KNOX-3564?focusedWorklogId=1053988&page=com.atlassian.jira.plugin.system.issuetabpanels:worklog-tabpanel#worklog-1053988
]
ASF GitHub Bot logged work on KNOX-3564:
----------------------------------------
Author: ASF GitHub Bot
Created on: 11/Nov/26 08:24
Start Date: 11/Nov/26 08:24
Worklog Time Spent: 10m
Work Description: github-actions[bot] commented on PR #1505:
URL: https://github.com/apache/knox/pull/1505#issuecomment-6790931888
## Test Results
5 files 5 suites 1m 34s ⏱️
212 tests 210 ✅ 2 💤 0 ❌
253 runs 251 ✅ 2 💤 0 ❌
Results for commit e2bbeab9.
[test-results]:data:application/gzip;base64,H4sIAEwm9GoC/02Myw7CIBQFf6Vh7YJHrwF/xgDlJsS2GB4r479LSYUuZ87JfAj61SXymOA2kVR87rCUqLMPe0U1V65LPjbO+J+eqVjbFB3q5d+H6gK1X6sYDxdjiKeJZW9NECf0JLBuRrHxJdj42rNh23yuQBw3xmmjuEA0jM5aIigK8g5CaVyYtNZZRoF8f6uf2HsEAQAA
Issue Time Tracking
-------------------
Worklog Id: (was: 1053988)
Time Spent: 0.5h (was: 20m)
> KnoxIDF: Increase DELEGATION_POLICY_USERS.username column size to 2048 to
> support SPIFFE IDs
> --------------------------------------------------------------------------------------------
>
> Key: KNOX-3564
> URL: https://issues.apache.org/jira/browse/KNOX-3564
> Project: Apache Knox
> Issue Type: Bug
> Components: JWT, KnoxIDF
> Reporter: Sandor Molnar
> Assignee: Sandor Molnar
> Priority: Major
> Fix For: 3.1.0
>
> Time Spent: 0.5h
> Remaining Estimate: 0h
>
> The {{username}} column of the {{DELEGATION_POLICY_USERS}} table is currently
> {{VARCHAR(1023)}} ({{{}VARCHAR2(1023){}}} on Oracle). The SPIFFE
> specification allows a SPIFFE ID to be up to 2048 bytes long ([SPIFFE ID
> spec, section
> 2.3|https://spiffe.io/docs/latest/spiffe-specs/spiffe-id/#23-maximum-spiffe-id-length]).
> Any SPIFFE ID longer than 1023 characters therefore can't be stored as a
> permitted user on a delegation policy.
> Integrating consumers have agreed to align with the spec maximum, so Knox
> should do the same. The column would then also match
> {{{}DELEGATION_POLICIES.actor_id{}}}, which is already {{{}VARCHAR(2048){}}}.
> *Proposed changes:*
> * {{{}createKnoxIDFDelegationPolicyTables.sql{}}}: change
> {{DELEGATION_POLICY_USERS.username}} from {{VARCHAR(1023)}} to
> {{VARCHAR(2048)}}
> * {{{}createKnoxIDFDelegationPolicyTablesOracle.sql{}}}: change
> {{DELEGATION_POLICY_USERS.username}} from {{VARCHAR2(1023)}} to
> {{VARCHAR2(2048)}}
> * Check that the composite primary key {{(registration_id, username)}} still
> fits the index key size limit of each supported database (36 + 2048 bytes)
> * Add or extend a test that saves and reads back a delegation policy whose
> username is 2048 characters long
> *Notes:*
> * The tables are created with {{{}CREATE TABLE IF NOT EXISTS{}}}, so a
> deployment that already has the table will keep the old column size. That
> shouldn't matter because KnoxIDF is unreleased (3.1.0-SNAPSHOT).
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
