Re: [PR] fix(auth): bind internal JWTs to principal secret generation [polaris]

["flyingImer (via GitHub)" <gi...@apache.org>]

flyingImer commented on code in PR #5053:
URL: https://github.com/apache/polaris/pull/5053#discussion_r3909421348


##########
runtime/service/src/test/java/org/apache/polaris/service/auth/internal/broker/JWTBrokerCredentialsBindingTest.java:
##########
@@ -0,0 +1,375 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.polaris.service.auth.internal.broker;
+
+import static org.assertj.core.api.Assertions.assertThat;
+import static org.assertj.core.api.Assertions.assertThatThrownBy;
+import static org.mockito.Mockito.when;
+
+import com.auth0.jwt.JWT;
+import com.auth0.jwt.algorithms.Algorithm;
+import com.auth0.jwt.interfaces.DecodedJWT;
+import java.util.Optional;
+import org.apache.iceberg.exceptions.NotAuthorizedException;
+import org.apache.polaris.core.DigestUtils;
+import org.apache.polaris.core.PolarisCallContext;
+import org.apache.polaris.core.entity.PolarisPrincipalSecrets;
+import org.apache.polaris.core.entity.PrincipalEntity;
+import org.apache.polaris.core.exceptions.PolarisServiceUnavailableException;
+import org.apache.polaris.core.persistence.PolarisMetaStoreManager;
+import org.apache.polaris.core.persistence.dao.entity.BaseResult;
+import org.apache.polaris.core.persistence.dao.entity.PrincipalSecretsResult;
+import org.apache.polaris.service.auth.internal.service.OAuthError;
+import org.apache.polaris.service.types.TokenType;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
+import org.mockito.Mockito;
+
+/**
+ * Internal JWTs are bound to the salted credentials-version fingerprint of the secret generation
+ * they were minted with (main or secondary). One rotate keeps the previous main hash as secondary
+ * so client secrets and their bound tokens remain valid for that grace generation; a further
+ * rotate/reset invalidates both. Tokens without the claim stay valid on bearer verify until expiry
+ * for upgrade compatibility, but token exchange rejects them.
+ */
+public class JWTBrokerCredentialsBindingTest {
+
+  private static final long PRINCIPAL_ID = 99L;
+  private static final String CLIENT_ID = "client-abc";
+  private static final String MAIN_SECRET = "main-secret-value";
+  private static final String SECONDARY_SECRET = "secondary-secret-value";
+  private static final String SCOPE = "PRINCIPAL_ROLE:ALL";
+
+  private PolarisCallContext callContext;
+  private PolarisMetaStoreManager metaStore;
+  private Algorithm algorithm;
+  private JWTBroker broker;
+  private PolarisPrincipalSecrets secrets;
+
+  @BeforeEach
+  void setUp() {
+    callContext = Mockito.mock(PolarisCallContext.class);
+    metaStore = Mockito.mock(PolarisMetaStoreManager.class);
+    algorithm = Algorithm.HMAC256("test-hmac-key");
+    secrets = new PolarisPrincipalSecrets(PRINCIPAL_ID, CLIENT_ID, MAIN_SECRET, SECONDARY_SECRET);
+    broker =
+        new JWTBroker(metaStore, callContext, 3600, algorithm, JWTBroker.buildVerifier(algorithm));
+
+    when(metaStore.loadPrincipalSecrets(callContext, CLIENT_ID))
+        .thenReturn(new PrincipalSecretsResult(secrets));
+    when(metaStore.findPrincipalById(callContext, PRINCIPAL_ID))
+        .thenReturn(
+            Optional.of(
+                new PrincipalEntity.Builder().setId(PRINCIPAL_ID).setName("alice").build()));
+  }
+
+  @Test
+  void mintedTokenCarriesSaltedCredentialsVersion() {
+    TokenResponse response =
+        broker.generateFromClientSecrets(
+            CLIENT_ID,
+            MAIN_SECRET,
+            TokenRequestValidator.CLIENT_CREDENTIALS,
+            SCOPE,
+            TokenType.ACCESS_TOKEN);
+    assertThat(response.getError()).isNull();
+    DecodedJWT jwt = JWT.decode(response.getAccessToken());
+    String claim = jwt.getClaim(JWTBroker.CLAIM_KEY_CREDENTIALS_VERSION).asString();
+    assertThat(claim).isEqualTo(secrets.getCredentialsVersion());
+    // Must not expose the raw secret-verification hash, nor an unsalted hash of it.
+    assertThat(claim).isNotEqualTo(secrets.getMainSecretHash());
+    assertThat(claim).isNotEqualTo(DigestUtils.sha256Hex(secrets.getMainSecretHash()));
+    assertThat(secrets.matchesCredentialsVersion(claim)).isTrue();
+  }
+
+  @Test
+  void verifySucceedsForTokenBoundToCurrentSecrets() {
+    TokenResponse response =
+        broker.generateFromClientSecrets(
+            CLIENT_ID,
+            MAIN_SECRET,
+            TokenRequestValidator.CLIENT_CREDENTIALS,
+            SCOPE,
+            TokenType.ACCESS_TOKEN);
+    assertThat(broker.verify(response.getAccessToken()).getPrincipalId()).isEqualTo(PRINCIPAL_ID);
+  }
+
+  @Test
+  void verifyStillSucceedsAfterOneRotateViaSecondaryGrace() {
+    TokenResponse response =
+        broker.generateFromClientSecrets(
+            CLIENT_ID,
+            MAIN_SECRET,
+            TokenRequestValidator.CLIENT_CREDENTIALS,
+            SCOPE,
+            TokenType.ACCESS_TOKEN);
+    String accessToken = response.getAccessToken();
+
+    // After one rotate, previous main becomes secondary; dual-secret grace keeps the JWT valid.
+    secrets.rotateSecrets(secrets.getMainSecretHash());
+    when(metaStore.loadPrincipalSecrets(callContext, CLIENT_ID))
+        .thenReturn(new PrincipalSecretsResult(secrets));
+
+    assertThat(broker.verify(accessToken).getPrincipalId()).isEqualTo(PRINCIPAL_ID);
+  }
+
+  @Test
+  void verifyFailsAfterSecondRotate() {
+    TokenResponse response =
+        broker.generateFromClientSecrets(
+            CLIENT_ID,
+            MAIN_SECRET,
+            TokenRequestValidator.CLIENT_CREDENTIALS,
+            SCOPE,
+            TokenType.ACCESS_TOKEN);
+    String accessToken = response.getAccessToken();
+
+    secrets.rotateSecrets(secrets.getMainSecretHash());
+    secrets.rotateSecrets(secrets.getMainSecretHash());
+    when(metaStore.loadPrincipalSecrets(callContext, CLIENT_ID))
+        .thenReturn(new PrincipalSecretsResult(secrets));
+
+    assertThatThrownBy(() -> broker.verify(accessToken))
+        .isInstanceOf(NotAuthorizedException.class)
+        .hasMessageContaining("Failed to verify the token");
+  }
+
+  @Test
+  void tokenExchangeFailsAfterSecondRotate() {
+    TokenResponse original =
+        broker.generateFromClientSecrets(
+            CLIENT_ID,
+            MAIN_SECRET,
+            TokenRequestValidator.CLIENT_CREDENTIALS,
+            SCOPE,
+            TokenType.ACCESS_TOKEN);
+
+    secrets.rotateSecrets(secrets.getMainSecretHash());
+    secrets.rotateSecrets(secrets.getMainSecretHash());
+    when(metaStore.loadPrincipalSecrets(callContext, CLIENT_ID))
+        .thenReturn(new PrincipalSecretsResult(secrets));
+
+    TokenResponse exchanged =
+        broker.generateFromToken(
+            TokenType.ACCESS_TOKEN,
+            original.getAccessToken(),
+            TokenRequestValidator.TOKEN_EXCHANGE,
+            SCOPE,
+            TokenType.ACCESS_TOKEN);
+    assertThat(exchanged.getError()).isEqualTo(OAuthError.invalid_client);

Review Comment:
   IIUC, token exchange should return invalid_request for both claim-less and stale-generation subject tokens. Today, a stale cred version causes validateCredentialsVersion to throw NotAuthorizedException, which generateFromToken maps to invalid_client, incorrectly describing a rejected subject token as failed client authentication. [RFC 8693](https://datatracker.ietf.org/doc/html/rfc8693#section-2.2.2) specifically requires invalid_request when a subject_token is invalid or unacceptable. Could we update both branches and adjust tokenExchangeFailsAfterSecondRotate accordingly?
   



-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: issues-unsubscribe@polaris.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org