[jira] [Commented] (KNOX-3476) CI Gate - Cross-Subject Delegation Exchange with Policy Enforcement Tests Pass in CI

["ASF subversion and git services (Jira)" <ji...@apache.org>]

    [ https://issues.apache.org/jira/browse/KNOX-3476?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18116966#comment-18116966 ] 

ASF subversion and git services commented on KNOX-3476:
-------------------------------------------------------

Commit b0fc823bfadfca30eb582cbfaa66a5ac62dd05cf in knox's branch refs/heads/master from Sandor Molnar
[ https://gitbox.apache.org/repos/asf?p=knox.git;h=b0fc823bf ]

KNOX-3476: add RFC 8693 delegation-path integration tests (policy lookup, act/aud minting, TTL cap, headless) (#1416)

> CI Gate - Cross-Subject Delegation Exchange with Policy Enforcement Tests Pass in CI
> ------------------------------------------------------------------------------------
>
>                 Key: KNOX-3476
>                 URL: https://issues.apache.org/jira/browse/KNOX-3476
>             Project: Apache Knox
>          Issue Type: Task
>          Components: CI
>    Affects Versions: 3.1.0
>            Reporter: Sandor Molnar
>            Assignee: Sandor Molnar
>            Priority: Major
>             Fix For: 3.1.0
>
>          Time Spent: 0.5h
>  Remaining Estimate: 0h
>
> As a KnoxIDF client, I want CI evidence that the full delegation path including policy evaluation, LDAP group lookup, act chain, per-policy TTL, and headless delegation gating works end-to-end through a running Knox gateway.
> *ACCEPTANCE CRITERIA:*
>  # A new integration test file for delegation tests is added and runs in the default CI build.
>  # A successful delegation exchange with a user-based policy produces an issued token with correct sub, act, aud, iss (scope is deferred now) values.
>  # A delegation exchange where the subject user is in an allowed LDAP group succeeds
>  # When multiple delegation policies are registered for different actors, each actor can only access the resources in its own policy. Attempting to use one actor's policy for another actor's resource fails.
>  # A delegation exchange where the subject user is not in the required LDAP group returns invalid_request.
>  # An exchange by an actor with no registered policy returns invalid_request.
>  # An exchange requesting a resource not in the policy returns invalid_request.
>  # An exchange where the policy max token TTL is shorter than the service-level TTL produces an issued token with a lifetime at or below the policy max.
>  # A headless delegation exchange succeeds when the policy allows it and fails with invalid_request when the policy does not.
>  # Deferred: An exchange requesting a scope not allowed for the requested resource returns invalid_request.



--
This message was sent by Atlassian Jira
(v8.20.10#820010)