[jira] [Resolved] (KNOX-3432) In knoxidf, advertise token exchange in grant_types_supported

["Sandor Molnar (Jira)" <ji...@apache.org>]

     [ https://issues.apache.org/jira/browse/KNOX-3432?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Sandor Molnar resolved KNOX-3432.
---------------------------------
    Fix Version/s: 3.1.0
       Resolution: Fixed

> In knoxidf, advertise token exchange in grant_types_supported
> -------------------------------------------------------------
>
>                 Key: KNOX-3432
>                 URL: https://issues.apache.org/jira/browse/KNOX-3432
>             Project: Apache Knox
>          Issue Type: Task
>            Reporter: Harrison Sheinblatt
>            Assignee: Sandor Molnar
>            Priority: Major
>             Fix For: 3.1.0
>
>          Time Spent: 50m
>  Remaining Estimate: 0h
>
> RFC 8693 defines the grant type for token exchange, urn:ietf:params:oauth:grant-type:token-exchange, in section 2.1. RFC 8414 defines the grant_types_supported fields in the metadata in section 2.
> Knoxidf currently sets this value in gateway-service-knoxidf/src/main/java/org/apache/knox/gateway/service/knoxidf/DiscoveryResource.java as
> ```
> config.put("grant_types_supported", new String[]\{KnoxIDFConstants.AUTH_CODE, KnoxIDFConstants.REFRESH_TOKEN});
> ```
> It does not list token exchange, and hence a reader of the metadata would believe that knoxidf does not support it, based on the spec.
> Given knoxidf does support it, the token exchange type should be added there. 
> The value to add is "urn:ietf:params:oauth:grant-type:token-exchange".
> RFC 6749 §4.5 (Extension Grants) explains that extension grants need the full name, not the short name. RFC 8693 §2.1 defines the constant to use. It's registered in IANA OAuth Parameters registry. RFC 8414 §2 says the field is "a list of the OAuth 2.0 grant type values that this authorization server supports" — i.e., the same values used in the grant_type request parameter. 
> The value is already in a constant in JWTFederationFilter. We must decide to duplicate it in KnoxIDFConstants for use here or reuse the constant. It's probably best to duplicate it – it's a standard so won't likely change.
>  



--
This message was sent by Atlassian Jira
(v8.20.10#820010)