[jira] [Created] (KNOX-3509) Extend RequestAudienceValidator for non-delegation, dns form, service-only matching, and for act source validation

["Harrison Sheinblatt (Jira)" <ji...@apache.org>]

Harrison Sheinblatt created KNOX-3509:
-----------------------------------------

             Summary: Extend RequestAudienceValidator for non-delegation, dns form, service-only matching, and for act source validation
                 Key: KNOX-3509
                 URL: https://issues.apache.org/jira/browse/KNOX-3509
             Project: Apache Knox
          Issue Type: Sub-task
          Components: JWT
            Reporter: Harrison Sheinblatt


Extend the RequestAudienceValidator:
 # Enable audience validation of non-delegation tokens
 # Allow audiences in dns service form, for use when there is one trust domain
 # Allow audiences with no path to match all paths: this indicates that the audience is intended to show only the allowed service destination, not the particular endpoints. When used, the capabilities of the service allowed can be specified otherwise, such as with scopes in the future.
 # Allow an opt in check for service account actors to validate that the most recent act sub service account matches the source spiffe id from a trusted header. This shows that the service account for which the token was issued is the one using it, and prevents a leaked token from being used by a different source.



--
This message was sent by Atlassian Jira
(v8.20.10#820010)