[jira] [Resolved] (KNOX-3493) k8s delegation E2E: policy-enforced SA actor-token delegation and headless SA-subject requested_subject exchange

["Sandor Molnar (Jira)" <ji...@apache.org>]

     [ https://issues.apache.org/jira/browse/KNOX-3493?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Sandor Molnar resolved KNOX-3493.
---------------------------------
    Resolution: Fixed

> k8s delegation E2E: policy-enforced SA actor-token delegation and headless SA-subject requested_subject exchange
> ----------------------------------------------------------------------------------------------------------------
>
>                 Key: KNOX-3493
>                 URL: https://issues.apache.org/jira/browse/KNOX-3493
>             Project: Apache Knox
>          Issue Type: Bug
>          Components: Server
>    Affects Versions: 3.1.0
>            Reporter: Sandor Molnar
>            Assignee: Sandor Molnar
>            Priority: Critical
>             Fix For: 3.1.0
>
>          Time Spent: 40m
>  Remaining Estimate: 0h
>
> *Description*
> Add the two token-exchange E2E scenarios that depend on delegation-policy enforcement in the exchange path - actor-token (on-behalf-of) delegation and headless (requested_subject) exchange. These cannot be tested against the currently-merged backend: TokenExchangeHandler builds a delegation Subject but performs no DelegationPolicyService.evaluate check, and there is no requested_subject/headless handling at all. This sub-task lands once that backend work merges, reusing the harness delivered by the sibling ticket.
> *In scope*
> Extend test_k8s_delegation.py (harness from the sibling ticket) with the delegation + headless scenarios below, including both the policy-allows (200) and policy-denies (400) cases.
> Seed delegation policies as part of test setup via the admin API (or the compose bootstrap) so the allow/deny paths are deterministic.
> *Out of scope*
> Harness, CA/issuer export, KNOXIDF_ADMIN topology, same-subject exchange, and negative-path tests — all delivered by the sibling ticket.
> The backend enforcement + requested_subject/headless implementation itself — tracked under the in-flight backend work (see Dependencies); this ticket is tests only.
> *Acceptance criteria*
>  * (AC4) A delegation exchange with an SA actor_token + a Knox-user subject_token succeeds with HTTP 200 when a matching delegation policy exists, and is rejected with HTTP 400 when no policy matches.
>  * (AC5) A headless exchange with an SA subject_token + requested_subject succeeds with HTTP 200 when policy allows headless delegation, and is rejected when it does not.



--
This message was sent by Atlassian Jira
(v8.20.10#820010)