You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@knox.apache.org by "ASF GitHub Bot (Jira)" <ji...@apache.org> on 2022/05/18 11:51:00 UTC
[jira] [Work logged] (KNOX-2726) Impersonation Params Declared by Service Definitions
[ https://issues.apache.org/jira/browse/KNOX-2726?focusedWorklogId=771829&page=com.atlassian.jira.plugin.system.issuetabpanels:worklog-tabpanel#worklog-771829 ]
ASF GitHub Bot logged work on KNOX-2726:
----------------------------------------
Author: ASF GitHub Bot
Created on: 18/May/22 11:50
Start Date: 18/May/22 11:50
Worklog Time Spent: 10m
Work Description: moresandeep opened a new pull request, #579:
URL: https://github.com/apache/knox/pull/579
## What changes were proposed in this pull request?
Impersonation Params should be configurable so that Knox can scrub these params before sending it out to the backend services. There could be cases where some services might use their own impersonation params (similar to doAs used by Knox). Including these parameters in request could have unknown side effects. In order to prevent these issue, Impersonation Params should be configurable.
The PR proposes adding `impersonation.params` parameter to the `identity-assertion` provider. e.g.
```
<provider>
<role>identity-assertion</role>
<name>Default</name>
<enabled>true</enabled>
<param>
<name>impersonation.params</name>
<value>customID</value>
</param>
</provider>
```
Adding this parameter tells Knox to scrub this parameter from the dispatched request.
e.g.
```
2022-05-18 07:06:12,733 cde0df3d-5fc8-4b7a-8b96-0f828f4e524e WARN knox.gateway (IdentityAsserterHttpServletRequestWrapper.java:scrubOfExistingPrincipalParams(212)) - Possible identity spoofing attempt - impersonation parameter removed: customID
```
## How was this patch tested?
This patch was tested locally
Logs without `impersonation.params`
```
2022-05-18 07:11:02,332 aadcfc0f-5159-4c50-bacb-0308a496ad32 DEBUG knox.gateway (UrlRewriteProcessor.java:rewrite(162)) - Rewrote URL: https://localhost:8443/gateway/sandbox/weather/data/2.5/forecast/city?id=524901&APPID=54557732afcfe106bfc955b9da04fb14&customID=somerandomestring, direction: IN via implicit rule: WEATHER/weather/inbound to URL: http://api.openweathermap.org:80/data/2.5/forecast/city?id=524901&APPID=54557732afcfe106bfc955b9da04fb14&customID=somerandomestring
2022-05-18 07:11:02,333 aadcfc0f-5159-4c50-bacb-0308a496ad32 DEBUG knox.gateway (DefaultDispatch.java:executeOutboundRequest(157)) - Dispatch request: GET http://api.openweathermap.org:80/data/2.5/forecast/city?id=524901&APPID=54557732afcfe106bfc955b9da04fb14&customID=somerandomestring&user.name=guest
```
Logs with `impersonation.params`
```
557732afcfe106bfc955b9da04fb14&customID=somerandomestring, direction: IN via implicit rule: WEATHER/weather/inbound to URL: http://api.openweathermap.org:80/data/2.5/forecast/city?id=524901&APPID=54557732afcfe106bfc955b9da04fb14&customID=somerandomestring
2022-05-18 07:06:12,733 cde0df3d-5fc8-4b7a-8b96-0f828f4e524e WARN knox.gateway (IdentityAsserterHttpServletRequestWrapper.java:scrubOfExistingPrincipalParams(212)) - Possible identity spoofing attempt - impersonation parameter removed: customID
2022-05-18 07:06:12,738 cde0df3d-5fc8-4b7a-8b96-0f828f4e524e DEBUG knox.gateway (DefaultDispatch.java:executeOutboundRequest(157)) - Dispatch request: GET http://api.openweathermap.org:80/data/2.5/forecast/city?id=524901&APPID=54557732afcfe106bfc955b9da04fb14&user.name=guest
```
Issue Time Tracking
-------------------
Worklog Id: (was: 771829)
Remaining Estimate: 0h
Time Spent: 10m
> Impersonation Params Declared by Service Definitions
> ----------------------------------------------------
>
> Key: KNOX-2726
> URL: https://issues.apache.org/jira/browse/KNOX-2726
> Project: Apache Knox
> Issue Type: Improvement
> Components: Server
> Affects Versions: 1.6.0
> Reporter: Philip Zampino
> Assignee: Sandeep More
> Priority: Major
> Time Spent: 10m
> Remaining Estimate: 0h
>
> _org.apache.knox.gateway.identityasserter.common.filter.IdentityAsserterHttpServletRequestWrapper#getImpersonationParamNames()_ has the following comment:
> {noformat}
> // TODO: let's have service definitions register their impersonation
> // params in a future release and get this list from a central registry.
> // This will provide better coverage of protection by removing any
> // pre-populated impersonation params.{noformat}
> Currently, Knox excludes some well-known impersonation request parameters from proxied requests. Rather than maintaining a hard-coded list of these params, service definitions should be able to declare them such that they would be available at runtime to {_}org.apache.knox.gateway.identityasserter.common.filter.IdentityAsserterHttpServletRequestWrapper{_}.
> This will allow service-specific impersonation parameter details to be defined by the service definitions, and eliminate the need for Knox runtime code changes when new impersonation params need to be handled.
--
This message was sent by Atlassian Jira
(v8.20.7#820007)