[jira] [Resolved] (KNOX-3052) Allow Multiple Issuers and JWTs with no Audience in same Topology as Others

["Sandor Molnar (Jira)" <ji...@apache.org>]

     [ https://issues.apache.org/jira/browse/KNOX-3052?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Sandor Molnar resolved KNOX-3052.
---------------------------------
    Resolution: Fixed

> Allow Multiple Issuers and JWTs with no Audience in same Topology as Others
> ---------------------------------------------------------------------------
>
>                 Key: KNOX-3052
>                 URL: https://issues.apache.org/jira/browse/KNOX-3052
>             Project: Apache Knox
>          Issue Type: Improvement
>          Components: JWT
>            Reporter: Larry McCay
>            Assignee: Larry McCay
>            Priority: Major
>             Fix For: 2.1.0
>
>          Time Spent: 1h 10m
>  Remaining Estimate: 0h
>
> While we have a change to introduce the ability to use multiple JWKS Urls to verify a token signature, without this change any tokens would need to have the same Issuer. This isn't ideal and limits the flexibility that we are looking for.
> This change is only an iteration beyond that approach but still not ideal. We will want to have a better isolation of the expected claims, algorithms, etc - per token. This will suffice for now but we will revisit it in the near future for better isolation.
> Here we will simply change the expectedIssuers param to be a List of Strings from a comma separated list and introduce a keyword "NONE" to indicate even though there are expected audiences for some tokens, it is also possible to accept a token with no audience as well. This is an opt-in only feature that requires the admin to configure "NONE" as an acceptable audience claim. This will pass when there are no audiences in the token or even if there is one called "NONE". Again, this will be revisited in the future and done better.



--
This message was sent by Atlassian Jira
(v8.20.10#820010)