KNOX-3424: Complete RFC 8707/8693 dynamic resource/audience handling in KNOXTOKEN and token exchange - #1373
Merged
Merged
Conversation
Contributor
Author
|
Cc. @hsheinblatt |
Test Results 5 files 5 suites 17s ⏱️ Results for commit 13f57b2. ♻️ This comment has been updated with latest results. |
lmccay
requested changes
Sep 2, 2026
hanicz
approved these changes
Sep 3, 2026
lmccay
approved these changes
Sep 3, 2026
…urce param The KNOXTOKEN service now takes the requested token audience via the RFC 8707 `resource` query parameter instead of `audience`. Per RFC 8707 section 2 (and RFC 3986 section 4.3) each `resource` value must be an absolute URI without a fragment component; a query component is allowed. Invalid values are rejected with 400 (new ErrorCode.INVALID_RESOURCE). The pluggable audience validators (static/whitelist/passthrough) are unchanged and still resolve the `aud` claim; only their input source changed. Docs and tests updated accordingly. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
…hange The JWTProvider's TokenExchangeHandler now reads the optional RFC 8693 section 2.1 resource/audience body parameters from the token-exchange request and conveys them to the downstream KNOXTOKEN service, which mints the token and resolves the aud claim through its configured audience validator. - resource values are validated as absolute URIs without a fragment (RFC 8707 section 2 / RFC 3986 section 4.3); a malformed value is rejected with the invalid_target error code. - audience values are logical service names and are taken verbatim. - Both parameters may be repeated and may carry comma-separated lists. - The parsed values are stashed on the request via the new CommonTokenConstants.REQUESTED_AUDIENCES_REQUEST_ATTR attribute; when present they take precedence over the resource query parameter that KNOXTOKEN would otherwise honor. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
…n error body
The token-issuance error for a rejected resource/audience echoed the
caller-supplied resource value back inside a hand-concatenated JSON body,
so a value containing a double quote (or other JSON metacharacter) could
break out of the JSON string and corrupt the response.
Render the {"error": ..., "code": ...} body through JsonUtils instead of
string concatenation, which escapes the embedded value the same way the
KNOX-3423 (apache#1354) filter-layer error path does. The {error, code} shape
and ErrorCode contract used by the token lifecycle responses are kept.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
…urce docs Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
…t exchange-specific Address review feedback: the KNOXTOKEN service should be about issuing tokens and not know about RFC 8693 token exchange. Rename the cross-layer request attribute value from 'knox.token.exchange.requested.audiences' to 'knox.token.requested.audiences' and reword the CommonTokenConstants javadoc and the TokenResource comment so the token service only knows that an upstream component may pre-resolve the requested audiences (taking precedence over the resource query param). The RFC 8693 specifics stay entirely within TokenExchangeHandler, the producer of the attribute. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
KNOX-3424 - Complete RFC 8707/8693 dynamic
resource/audiencehandling in KNOXTOKEN and token exchangeWhat changes were proposed in this pull request?
Follow-up to #1356, finishing the dynamic-audience work so Knox implements both RFC 8707 (Resource Indicators) and RFC 8693 (Token Exchange) end to end. Three self-contained commits:
Replace the
audiencequery param with a URL-validatedresourceparam.The KNOXTOKEN service now reads the per-request target via
resourceinstead ofaudience. Each value must be an absolute URI without a fragment (RFC 8707 §2 / RFC 3986 §4.3); a value that is not a valid absolute URI, or that carries a fragment, is rejected with400 Bad Request/INVALID_RESOURCE. Repeated and comma-separated values are supported; whitespace is trimmed. The pluggable audience validators (static/whitelist/passthrough) are unchanged in behavior.Wire the RFC 8693
resource/audiencebody parameters into token exchange.The JWTProvider's
TokenExchangeHandlernow parses the optionalresource/audiencebody params from the exchange request and conveys them to the downstream KNOXTOKEN service via a new shared request attribute (CommonTokenConstants.REQUESTED_AUDIENCES_REQUEST_ATTR), so they land in the minted token'saudclaim.resourcevalues are URI-validated (malformed →invalid_target);audiencevalues are logical service names taken verbatim. When present, the body values take precedence over theresourcequery parameter.JSON-escape the caller-supplied
resourcevalue in the token error body.The token-issuance error echoed the caller-supplied value back in a hand-concatenated JSON body, so a value containing a
"could break out of the JSON string. The{"error": ..., "code": ...}body is now rendered throughJsonUtils(the same escaping the KNOX-3423/KNOX-3423: Switch to JSON error messages in Knox token validation paths #1354 filter-layer error path uses), keeping the existing{error, code}/ErrorCodeshape.Documentation in
knox-site/docs/config_knox_token.mdis updated to describe theresourceparameter, the absolute-URI requirement, and the RFC 8707 mapping into theaudclaim.How was this patch tested?
Automated unit tests (all green, offline Maven build):
TokenExchangeHandlerTest— 21 tests, including 8 new ones coveringresource/audiencebody-param parsing, comma-splitting, invalid-URI and fragment rejection asinvalid_target, empty-value rejection, and the no-param case leaving the request attribute unset.TokenServiceResourceTest— 101 tests, including new coverage for theresourcequery param, invalid-URI/fragment rejection, exchange-attribute precedence over the query param, and a regression test asserting aresourcevalue containing double quotes yields a well-formed, parseable JSON error body with the value round-tripped intact.JWTFederationFilterTokenExchangeTest— 56 tests, re-run to confirm no regression on the broader exchange path.Checkstyle passes with 0 violations across
gateway-spi,gateway-provider-security-jwt, andgateway-service-knoxtoken.Integration Tests
No new integration test was added: the change is an extension of the existing token-exchange / dynamic-audience paths, which are covered comprehensively at the unit level, and the KnoxIDF federation broker flow (
test_knoxidf.py/test_knoxidf_federation.py) already exercises the token-exchange handler this PR modifies. Because commit 2 touches the JWTProvider federation broker path, adding thetest-federationlabel here before pushing, so the Keycloak-backed E2E federation suite runs against these changes.