[PR] KNOX-3408 - Allow no actor token in JWTFederationFilter.handleTokenExchange [knox]

["hsheinblatt (via GitHub)" <gi...@apache.org>]

hsheinblatt opened a new pull request, #1339:
URL: https://github.com/apache/knox/pull/1339

   KNOX-3408 - Allow no actor token in JWTFederationFilter.handleTokenExchange
   
   ## What changes were proposed in this pull request?
   
   RFC 8693 requires that the actor token be optional for token exchange.
   Change the handleTokenExchange method to allow a missing actor token.
   When actor_token is absent, the Subject has the subject from the subject token
   as PrimaryPrincipal with no TokenExchangePrincipal. Note that headless
   delegation using ImpersonatedPrincipal is currently not represented in this path.
   
   ## How was this patch tested?
   
   A unit test for the new path is added. Regression tests for subject handling in
   JWTFederationFilter.handleTokenExchange and TokenExchangePrincipal handling in AbstractIdentityAssertionFilter.continueChainAsPrincipal handling were also
   added and run before the feature change to show no regression.
   
   ## Integration Tests
   N/A
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: dev-unsubscribe@knox.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] KNOX-3408 - Allow no actor token in JWTFederationFilter.handleTokenExchange [knox]

["pzampino (via GitHub)" <gi...@apache.org>]

pzampino merged PR #1339:
URL: https://github.com/apache/knox/pull/1339


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: dev-unsubscribe@knox.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org