[jira] [Created] (KNOX-3460) Audit all token-exchange flows including minted token fields

["Sandor Molnar (Jira)" <ji...@apache.org>]

Sandor Molnar created KNOX-3460:
-----------------------------------

             Summary: Audit all token-exchange flows including minted token fields
                 Key: KNOX-3460
                 URL: https://issues.apache.org/jira/browse/KNOX-3460
             Project: Apache Knox
          Issue Type: Sub-task
          Components: Server
    Affects Versions: 3.1.0
            Reporter: Sandor Molnar
            Assignee: Sandor Molnar
             Fix For: 3.1.0


Only the delegation policy decision is audited today (TokenExchangeHandler success/failure inside the delegation branch). The same-subject exchange path emits no TOKEN_EXCHANGE audit record at all (only the generic AUTHENTICATION audit from the shared {{{}continueWithEstablishedSecurityContext{}}}). Minted-token fields — jti, expiry, issued_subject — are unauditable from the filter because they only exist after TokenResource mints the token, and TokenResource has no auditing whatsoever today.

*Scope:*
 # Audit all three exchange paths in the handler with the fields known pre-mint (incl. same-subject).
 # Add a TOKEN_EXCHANGE mint-time audit in TokenResource.getJWT() for exchange-originated mints, emitting jti/expiry/issued_subject

*Explicitly out of scope:* auditing ordinary (non-exchange) token issuance.



--
This message was sent by Atlassian Jira
(v8.20.10#820010)