You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@knox.apache.org by "smolnar82 (via GitHub)" <gi...@apache.org> on 2026/09/16 12:25:28 UTC
[PR] KNOX-3465: add CI integration tests for RFC 8693 token exchange (same-subject and delegation gating) [knox]
smolnar82 opened a new pull request, #1406:
URL: https://github.com/apache/knox/pull/1406
[KNOX-3465](https://issues.apache.org/jira/browse/KNOX-3465) - Add CI integration tests for RFC 8693 token exchange (same-subject and delegation gating)
## What changes were proposed in this pull request?
Adds end-to-end CI evidence that RFC 8693 token exchange works through a running Knox gateway, covering the "Bucket 1" acceptance criteria of the "master" list KNOX-3455 (the subset backed by product code already on `master`; the requested-audience-vs-subject-aud cases wait on KNOX-3461 and the requested-scope cases wait on scope support landing).
- **`test_token_exchange.py`** — new suite of 6 tests. The subject token is a genuine Knox JWT minted via the KNOXIDF token endpoint on `knoxidf-ldap` (a request with no `grant_type` falls through to the base KNOXTOKEN minting path); because it is Knox-signed, it verifies on the exchange path with no trusted-issuer registration. Covers:
- same-subject exchange preserves `sub`/`iss` and advertises `issued_token_type` = `...:jwt`;
- a same-subject exchange whose subject token carries no `act` claim succeeds and adds none;
- a delegation exchange with a missing audience → `400 invalid_request`;
- a delegation exchange with more than one audience → `400 invalid_request`;
- a delegation exchange against a delegation-disabled topology → `400 invalid_request` "Delegation is not enabled for this topology";
- a same-subject exchange against a delegation-enabled topology still succeeds.
- **`conf/topologies/knoxidf-token-delegation.xml`** — new delegation-enabled topology (`delegation.server.enabled=true` plus both requested-audience enforcement flags); the existing `knoxidf-token.xml` serves as the delegation-disabled counterpart.
- **`build/Dockerfile`** — ADD the new topology into the CI knox image.
Runs in the default Docker Compose build — no separate stack.
## How was this patch tested?
Ran the full Docker Compose integration job locally (`.github/workflows/tests`): **86 passed**, including all 6 new `test_token_exchange.py` cases. `py_compile` clean and `pylint` 10.00/10 on the new file; no regression in the existing suites:
```
tests-1 | ============================= test session starts ==============================
tests-1 | platform linux -- Python 3.10.20, pytest-9.0.3, pluggy-1.6.0
tests-1 | rootdir: /tests
tests-1 | collected 86 items
tests-1 |
tests-1 | test_health.py ..... [ 5%]
tests-1 | test_k8s_delegation.py ... [ 9%]
tests-1 | test_k8s_serviceaccount_validation.py ...... [ 16%]
tests-1 | test_knox_admin_path_traversal.py ... [ 19%]
tests-1 | test_knox_auth_service_and_ldap.py ... [ 23%]
tests-1 | test_knox_configs.py . [ 24%]
tests-1 | test_knox_ldap_cache.py ... [ 27%]
tests-1 | test_knox_ldap_injection.py ....... [ 36%]
tests-1 | test_knox_ldap_proxy_search.py ......... [ 46%]
tests-1 | test_knoxauth_preauth_and_paths.py ...... [ 53%]
tests-1 | test_knoxidf.py ...... [ 60%]
tests-1 | test_knoxsso_redirect.py . [ 61%]
tests-1 | test_knoxtoken_jwt.py .................... [ 84%]
tests-1 | test_remote_auth.py ... [ 88%]
tests-1 | test_remoteauth_extauthz_additional_path.py .... [ 93%]
tests-1 | test_token_exchange.py ...... [100%]
tests-1 |
tests-1 | =============================== warnings summary ===============================
tests-1 | ../usr/local/lib/python3.10/site-packages/ldap3/utils/asn1.py:50
...
tests-1 | -- Docs: https://docs.pytest.org/en/stable/how-to/capture-warnings.html
tests-1 | ----------------- generated xml file: /tests/test-results.xml ------------------
tests-1 | ======================= 86 passed, 78 warnings in 15.47s =======================
tests-1 exited with code 0
Aborting on container exit...
Container compose-tests-1 Stopping
Container compose-tests-1 Stopped Config w Enable Watch d Detach
```
## Integration Tests
This PR *is* the integration tests — see `.github/workflows/tests/test_token_exchange.py`. No opt-in label required; the suite runs in the default job.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@knox.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] KNOX-3465: add CI integration tests for RFC 8693 token exchange (same-subject and delegation gating) [knox]
Posted by "github-actions[bot] (via GitHub)" <gi...@apache.org>.
github-actions[bot] commented on PR #1406:
URL: https://github.com/apache/knox/pull/1406#issuecomment-5697675650
## Test Results
5 files 5 suites 31s ⏱️
96 tests 96 ✅ 0 💤 0 ❌
114 runs 114 ✅ 0 💤 0 ❌
Results for commit 24e219c5.
[test-results]:data:application/gzip;base64,H4sIAAqQqmoC/13MSw6CMBSF4a2Qjh30IoXWzZjbV3IjUFPakXHvFgJYHX7/Sc6LeRrdwm6NuDRsyZRO2BwxUZgLr1BclrRuqj9wX7Ixf+VBz1L4GTzS+BNcjCHuJeZ5fQTodhyPdfk+bq4ON9d/JkwTpQLWdq4FZcSAwFGgdtrJQXppQLseJLeg0Cvr2fsDwcU35wIBAAA=
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@knox.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] KNOX-3465: add CI integration tests for RFC 8693 token exchange (same-subject and delegation gating) [knox]
Posted by "smolnar82 (via GitHub)" <gi...@apache.org>.
smolnar82 commented on PR #1406:
URL: https://github.com/apache/knox/pull/1406#issuecomment-5697383754
Cc. @hsheinblatt
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@knox.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] KNOX-3465: add CI integration tests for RFC 8693 token exchange (same-subject and delegation gating) [knox]
Posted by "smolnar82 (via GitHub)" <gi...@apache.org>.
smolnar82 merged PR #1406:
URL: https://github.com/apache/knox/pull/1406
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@knox.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org