[jira] [Created] (KNOX-3399) RFC 8693 token exchange (handleTokenExchange) unreachable for x-www-form-urlencoded POSTs

["Sandor Molnar (Jira)" <ji...@apache.org>]

Sandor Molnar created KNOX-3399:
-----------------------------------

             Summary: RFC 8693 token exchange (handleTokenExchange) unreachable for x-www-form-urlencoded POSTs
                 Key: KNOX-3399
                 URL: https://issues.apache.org/jira/browse/KNOX-3399
             Project: Apache Knox
          Issue Type: Bug
          Components: Server
    Affects Versions: 3.0.0
            Reporter: Sandor Molnar
            Assignee: Sandor Molnar
             Fix For: 3.0.0


{{JWTFederationFilter.doFilter}} reads {{grant_type}} via {{getParameter}} on the wrapped request. Form-encoded requests are wrapped in {{UrlEncodedFormRequest}}, whose {{getParameter}} returns query-string values only and ignores the body (by design). So for a standard RFC 8693 POST (grant + tokens in the body), {{grant_type}} reads back {{null}}, the {{handleTokenExchange}} branch is skipped, and the request falls through to the single-token path - which validates only {{subject_token}} and silently ignores {{actor_token}}.

*Impact:* the two-token OBO flow never runs over the normal content type. A POST with *no* {{actor_token}} still returns 200:

{code}
$ curl -k -X POST "https://localhost:8443/gateway/tokenexchange/knoxtoken/api/v2/token" -H "Content-Type: application/x-www-form-urlencoded" -d "grant_type=urn:ietf:params:oauth:grant-type:token-exchange&subject_token=$SUBJECT_TOKEN"
{"access_token":"eyJqa3UiOi...","token_id":"e313ffbc-b27e-468e-a684-192b8939ca87","managed":"true","endpoint_public_cert":"MIIDZDE...ETTA="
{code}

*Evidence (remote debugger, on v3.0.0 branch):* {{httpRequest.getParameter("grant_type") → null}} whereas {{ServletRequestUtils.unwrapHttpServletRequest(request).getParameter("grant_type") → the expected URN}}.

*Fix direction:* in {{doFilter}}, read {{grant_type}} from the unwrapped request (guard on absent Authorization header so proxied bodies aren't consumed); read subject_token/actor_token from the unwrapped request in {{handleTokenExchange}}; keep passing the wrapped request downstream. Add a regression test in {{OAuthFlowsFederationFilterTest}} posting grant + both tokens in the body (wrapped in {{UrlEncodedFormRequest}}).



--
This message was sent by Atlassian Jira
(v8.20.10#820010)