[jira] [Updated] (KNOX-3411) Improve getUserToken method

["Tamás Hanicz (Jira)" <ji...@apache.org>]

     [ https://issues.apache.org/jira/browse/KNOX-3411?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Tamás Hanicz updated KNOX-3411:
-------------------------------
    Description:     (was: Reported by Andrew Rukin

 

Apache Knox lets an authenticated user list another user's JWT, API_KEY, and CLIENT_ID token records and metadata. The same user can disable or re-enable another user's managed tokens by token ID. Knox already enforces ownership checks for token revoke. A low-privileged user cannot revoke another user's token and receives HTTP 403. The same user can still call disable or enable with another user's token ID, receive HTTP 200, and change that token's enabled state. I confirmed direct operational impact on official Apache Knox 2.1.0. After one low-privileged user disabled another user's managed token, the same bearer token immediately stopped working against a JWT-protected REST endpoint and returned HTTP 401 "Token ... is disabled".)

> Improve getUserToken method
> ---------------------------
>
>                 Key: KNOX-3411
>                 URL: https://issues.apache.org/jira/browse/KNOX-3411
>             Project: Apache Knox
>          Issue Type: Bug
>          Components: Server
>    Affects Versions: 2.1.0, 3.0.0
>            Reporter: Tamás Hanicz
>            Assignee: Tamás Hanicz
>            Priority: Blocker
>             Fix For: 3.0.0, 2.1.1
>
>          Time Spent: 0.5h
>  Remaining Estimate: 0h
>




--
This message was sent by Atlassian Jira
(v8.20.10#820010)