[jira] [Resolved] (KNOX-3414) KnoxIDF (OIDC Provider): security hardening, correctness fixes, and documentation

["Sandor Molnar (Jira)" <ji...@apache.org>]

     [ https://issues.apache.org/jira/browse/KNOX-3414?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Sandor Molnar resolved KNOX-3414.
---------------------------------
    Resolution: Fixed

> KnoxIDF (OIDC Provider): security hardening, correctness fixes, and documentation
> ---------------------------------------------------------------------------------
>
>                 Key: KNOX-3414
>                 URL: https://issues.apache.org/jira/browse/KNOX-3414
>             Project: Apache Knox
>          Issue Type: Improvement
>          Components: KnoxIDF
>            Reporter: Sandor Molnar
>            Assignee: Sandor Molnar
>            Priority: Critical
>             Fix For: 3.1.0
>
>
> Follow-up work on the KnoxIDF OAuth2/OIDC Authorization Server. Items to fix:
> Client authentication & flow security
> - Authenticate the client on the refresh_token grant.
> - Authenticate the client on the authorization_code grant (PKCE S256 or constant-time client_secret).
> - Reject PKCE plain; accept only S256, and advertise only S256 in discovery.
> - Require and validate state/nonce; bind the federated id_token to the request via nonce.
> - Atomically consume authorization codes and refresh tokens before issuance (close replay windows).
> Federation
> - Fully validate the federated OP id_token (signature/JWKS, issuer, audience, exp/nbf, sub) before trusting any claim.
> - Reject a federated id_token missing sub with a 4xx, not a 500.
> - Fail closed when a federated-OP client-secret alias is unresolvable.
> - Stop persisting federated OP access tokens at rest; store only ID-token-derived identity data.
> - Activate federated-identity persistence (was silently disabled) with self-provisioning embedded Derby default.
> Redirect-URI / registration
> - Normalize redirect_uri path before wildcard matching; match on parsed URI components (fix open redirect).
> - Build a well-formed success redirect when redirect_uri already carries a query.
> - Require HTTPS for registered redirect URIs (loopback HTTP excepted, RFC 8252).
> - Make anonymous dynamic client registration an explicit, secure-by-default opt-in.
> Correctness / robustness
> - Fix SCOPE_ATTRIBUTE always resolving to null (double getClaim).
> - Fix iat=1970 regression on non-KnoxIDF tokens (default issue time to now).
> - /userinfo returns 401 invalid_token, not 500, for a bad bearer token.
> - Fix broken double-checked locking in service init paths.
> - Escape LDAP username input; remove hardcoded LDAP system-password fallback (fail fast).
> - Per-request claim map (fix cross-user claim leakage in the shared singleton).
> Persistence
> - Fix TOCTOU on federated-identity insert (unique constraint as arbiter).
> - Write identity + attributes in a single transaction.
> - Align Derby schema (NOT NULL / unique index) with other dialects.
> Key management & auditing
> - Publish multiple JWKs and select the verification key by kid (enables zero-downtime signing-key rotation).
> - Emit structured audit records across the OAuth2/OIDC endpoints.
> OIDC discovery / docs
> - Complete OIDC discovery metadata for OAuth/MCP client integration.
> - Add opt-in Keycloak federation E2E test; extend existing E2E suite to cover the fixes above.
> - Add the Identity Federation (OIDC Provider) documentation book.



--
This message was sent by Atlassian Jira
(v8.20.10#820010)