"
diff --git a/gateway-provider-identity-assertion-common/src/test/java/org/apache/knox/gateway/identityasserter/common/filter/AbstractIdentityAssertionFilterTokenExchangeTest.java b/gateway-provider-identity-assertion-common/src/test/java/org/apache/knox/gateway/identityasserter/common/filter/AbstractIdentityAssertionFilterTokenExchangeTest.java
new file mode 100644
index 0000000000..f74ddd55f1
--- /dev/null
+++ b/gateway-provider-identity-assertion-common/src/test/java/org/apache/knox/gateway/identityasserter/common/filter/AbstractIdentityAssertionFilterTokenExchangeTest.java
@@ -0,0 +1,279 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with this
+ * work for additional information regarding copyright ownership. The ASF
+ * licenses this file to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+ * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+ * License for the specific language governing permissions and limitations under
+ * the License.
+ */
+package org.apache.knox.gateway.identityasserter.common.filter;
+
+import org.apache.knox.gateway.audit.log4j.audit.Log4jAuditService;
+import org.apache.knox.gateway.context.ContextAttributes;
+import org.apache.knox.gateway.security.ActorChainPrincipal;
+import org.apache.knox.gateway.security.ActorChainPrincipalImpl;
+import org.apache.knox.gateway.security.ImpersonatedPrincipal;
+import org.apache.knox.gateway.security.PrimaryPrincipal;
+import org.apache.knox.gateway.security.SubjectUtils;
+import org.apache.knox.gateway.security.TokenExchangePrincipalImpl;
+import org.apache.knox.gateway.services.GatewayServices;
+import org.apache.logging.log4j.ThreadContext;
+import org.easymock.EasyMock;
+import org.junit.Assert;
+import org.junit.Before;
+import org.junit.Test;
+
+import javax.security.auth.Subject;
+import javax.servlet.FilterChain;
+import javax.servlet.FilterConfig;
+import javax.servlet.ServletContext;
+import javax.servlet.ServletRequest;
+import javax.servlet.ServletResponse;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+import java.security.PrivilegedExceptionAction;
+import java.util.Collections;
+import java.util.List;
+import java.util.Map;
+import java.util.Set;
+
+/**
+ * Regression tests for the RFC 8693 token-exchange processing pipeline:
+ * {@link AbstractIdentityAssertionFilter#continueChainAsPrincipal} handling of
+ * {@code TokenExchangePrincipal} (TEP) and {@code ActorChainPrincipal}.
+ *
+ *
Each test constructs a Subject directly (bypassing the JWT filter) and runs it through
+ * a minimal anonymous subclass of {@link CommonIdentityAssertionFilter} with identity
+ * {@code mapUserPrincipal} (returns input unchanged) and null {@code mapGroupPrincipals}
+ * (no group mapping). A {@link SubjectCapturingChain} captures the Subject visible to
+ * downstream filters inside whatever doAs context is active at chain invocation time.
+ *
+ *
Abbreviations used: AIAF for AbstractIdentityAssertionFilter and
+ * TEP for TokenExchangePrincipal.
+ *
+ */
+public class AbstractIdentityAssertionFilterTokenExchangeTest {
+
+ private CommonIdentityAssertionFilter filter;
+ private FilterConfig filterConfig;
+
+ @Before
+ public void setUp() throws Exception {
+ filter = new CommonIdentityAssertionFilter() {
+ @Override
+ public String mapUserPrincipal(String principalName) {
+ return principalName;
+ }
+
+ @Override
+ public String[] mapGroupPrincipals(String name, Subject subject,
+ ServletRequest request) {
+ return null;
+ }
+ };
+
+ ServletContext ctx = EasyMock.createNiceMock(ServletContext.class);
+ EasyMock.expect(ctx.getAttribute(GatewayServices.GATEWAY_CLUSTER_ATTRIBUTE))
+ .andReturn("test-topology").anyTimes();
+ ctx.setAttribute(
+ EasyMock.eq(ContextAttributes.IMPERSONATION_ENABLED_ATTRIBUTE),
+ EasyMock.anyObject());
+ EasyMock.expectLastCall().anyTimes();
+ EasyMock.replay(ctx);
+
+ filterConfig = EasyMock.createNiceMock(FilterConfig.class);
+ EasyMock.expect(filterConfig.getServletContext()).andReturn(ctx).anyTimes();
+ EasyMock.expect(filterConfig.getInitParameter(
+ CommonIdentityAssertionFilter.PRINCIPAL_MAPPING)).andReturn(null).anyTimes();
+ EasyMock.expect(filterConfig.getInitParameter(
+ CommonIdentityAssertionFilter.GROUP_PRINCIPAL_MAPPING)).andReturn(null).anyTimes();
+ EasyMock.expect(filterConfig.getInitParameter(
+ CommonIdentityAssertionFilter.ADVANCED_PRINCIPAL_MAPPING))
+ .andReturn("username").anyTimes();
+ EasyMock.expect(filterConfig.getInitParameterNames())
+ .andReturn(Collections.emptyEnumeration()).anyTimes();
+ EasyMock.replay(filterConfig);
+
+ filter.init(filterConfig);
+ ThreadContext.put(Log4jAuditService.MDC_AUDIT_CONTEXT_KEY, "dummy");
+ }
+
+ /**
+ * When TEP identifies different actor and subject, AIAF creates a new doAs Subject with an
+ * ImpersonatedPrincipal set to the subject identity and PrimaryPrincipal preserved as the actor.
+ */
+ @Test
+ public void testTEPWithDifferentActorAndSubjectSetsUpImpersonation() throws Exception {
+ Subject subject = buildSubject(
+ new PrimaryPrincipal("sa-actor"),
+ new TokenExchangePrincipalImpl("end-user", null, "sa-actor", null));
+
+ SubjectCapturingChain chain = runFilterWithSubject(subject);
+
+ Assert.assertTrue("chain should have been called", chain.called);
+ Set impersonated = chain.subject.getPrincipals(ImpersonatedPrincipal.class);
+ Assert.assertEquals("Expected exactly one ImpersonatedPrincipal", 1, impersonated.size());
+ Assert.assertEquals("ImpersonatedPrincipal should be end-user", "end-user",
+ impersonated.iterator().next().getName());
+ Set primary = chain.subject.getPrincipals(PrimaryPrincipal.class);
+ Assert.assertEquals("Expected exactly one PrimaryPrincipal", 1, primary.size());
+ Assert.assertEquals("PrimaryPrincipal should be sa-actor", "sa-actor",
+ primary.iterator().next().getName());
+ }
+
+ /**
+ * When TEP actor and subject are the same identity, no impersonation is needed and AIAF
+ * proceeds without adding an ImpersonatedPrincipal to the downstream Subject.
+ */
+ @Test
+ public void testTEPWithSameActorAndSubjectSkipsImpersonation() throws Exception {
+ Subject subject = buildSubject(
+ new PrimaryPrincipal("alice"),
+ new TokenExchangePrincipalImpl("alice", null, "alice", null));
+
+ SubjectCapturingChain chain = runFilterWithSubject(subject);
+
+ Assert.assertTrue("chain should have been called", chain.called);
+ Assert.assertTrue("ImpersonatedPrincipal set should be empty",
+ chain.subject.getPrincipals(ImpersonatedPrincipal.class).isEmpty());
+ }
+
+ /**
+ * When no TEP is present, AIAF proceeds normally without creating an ImpersonatedPrincipal
+ * and the downstream Subject contains no TokenExchangePrincipal.
+ */
+ @Test
+ public void testNoTEPProceedsNormally() throws Exception {
+ Subject subject = buildSubject(new PrimaryPrincipal("alice"));
+
+ SubjectCapturingChain chain = runFilterWithSubject(subject);
+
+ Assert.assertTrue("chain should have been called", chain.called);
+ Assert.assertTrue("ImpersonatedPrincipal set should be empty",
+ chain.subject.getPrincipals(ImpersonatedPrincipal.class).isEmpty());
+ Assert.assertNull("No TokenExchangePrincipal expected",
+ SubjectUtils.getTokenExchangePrincipal(chain.subject));
+ }
+
+ /**
+ * Principal mapping is applied to the subject identity from TEP (not to the actor identity).
+ * AIAF calls {@code mapUserPrincipal} on {@code tep.getSubjectPrincipalName()} and uses the
+ * mapped result as the ImpersonatedPrincipal; the actor (PrimaryPrincipal) is unchanged.
+ */
+ @Test
+ public void testTEPAppliesPrincipalMappingToSubjectNotActor() throws Exception {
+ CommonIdentityAssertionFilter mappingFilter = new CommonIdentityAssertionFilter() {
+ @Override
+ public String mapUserPrincipal(String principalName) {
+ return "user@external".equals(principalName) ? "localuser" : principalName;
+ }
+
+ @Override
+ public String[] mapGroupPrincipals(String name, Subject subject,
+ ServletRequest request) {
+ return null;
+ }
+ };
+ mappingFilter.init(filterConfig);
+
+ Subject subject = buildSubject(
+ new PrimaryPrincipal("sa-actor"),
+ new TokenExchangePrincipalImpl("user@external", null, "sa-actor", null));
+
+ SubjectCapturingChain chain = runFilterWithSubject(subject, mappingFilter);
+
+ Set impersonated = chain.subject.getPrincipals(ImpersonatedPrincipal.class);
+ Assert.assertEquals("Expected exactly one ImpersonatedPrincipal", 1, impersonated.size());
+ Assert.assertEquals("ImpersonatedPrincipal should be mapped value", "localuser",
+ impersonated.iterator().next().getName());
+ Set primary = chain.subject.getPrincipals(PrimaryPrincipal.class);
+ Assert.assertEquals("Expected exactly one PrimaryPrincipal", 1, primary.size());
+ Assert.assertEquals("PrimaryPrincipal should be actor (unmapped)", "sa-actor",
+ primary.iterator().next().getName());
+ }
+
+ /**
+ * The TokenExchangePrincipal is preserved in the new doAs Subject built by AIAF when
+ * impersonation is needed, so downstream filters can still read the delegation metadata.
+ */
+ @Test
+ public void testTEPPreservedInDoAsSubject() throws Exception {
+ Subject subject = buildSubject(
+ new PrimaryPrincipal("sa-actor"),
+ new TokenExchangePrincipalImpl("end-user", null, "sa-actor", null));
+
+ SubjectCapturingChain chain = runFilterWithSubject(subject);
+
+ Assert.assertNotNull("TokenExchangePrincipal should be preserved in downstream Subject",
+ SubjectUtils.getTokenExchangePrincipal(chain.subject));
+ }
+
+ /**
+ * The ActorChainPrincipal is preserved in the new doAs Subject built by AIAF when
+ * impersonation is needed, so the full delegation chain history is available downstream.
+ */
+ @Test
+ public void testActorChainPrincipalPreservedInDoAsSubject() throws Exception {
+ List> chain = List.of(Map.of("sub", "prior-actor"));
+ Subject subject = buildSubject(
+ new PrimaryPrincipal("sa-actor"),
+ new TokenExchangePrincipalImpl("end-user", null, "sa-actor", null),
+ new ActorChainPrincipalImpl(chain));
+
+ SubjectCapturingChain capturingChain = runFilterWithSubject(subject);
+
+ Set actorChainPrincipals =
+ capturingChain.subject.getPrincipals(ActorChainPrincipal.class);
+ Assert.assertFalse("ActorChainPrincipal should be preserved", actorChainPrincipals.isEmpty());
+ Assert.assertEquals("getCurrentActor should be prior-actor", "prior-actor",
+ actorChainPrincipals.iterator().next().getCurrentActor());
+ }
+
+ // ---- Helpers ----
+
+ private static Subject buildSubject(java.security.Principal... principals) {
+ Subject s = new Subject();
+ for (java.security.Principal p : principals) {
+ s.getPrincipals().add(p);
+ }
+ return s;
+ }
+
+ /** Runs the filter inside {@code Subject.doAs(subjectToRun, ...)} using the default filter. */
+ private SubjectCapturingChain runFilterWithSubject(Subject subjectToRun) throws Exception {
+ return runFilterWithSubject(subjectToRun, filter);
+ }
+
+ /** Runs the filter inside {@code Subject.doAs(subjectToRun, ...)} using the given filter. */
+ private SubjectCapturingChain runFilterWithSubject(Subject subjectToRun,
+ CommonIdentityAssertionFilter f) throws Exception {
+ SubjectCapturingChain chain = new SubjectCapturingChain();
+ HttpServletRequest request = EasyMock.createNiceMock(HttpServletRequest.class);
+ HttpServletResponse response = EasyMock.createNiceMock(HttpServletResponse.class);
+ EasyMock.replay(request, response);
+ Subject.doAs(subjectToRun, (PrivilegedExceptionAction) () -> {
+ f.doFilter(request, response, chain);
+ return null;
+ });
+ return chain;
+ }
+
+ private static class SubjectCapturingChain implements FilterChain {
+ Subject subject;
+ boolean called;
+
+ @Override
+ public void doFilter(ServletRequest req, ServletResponse resp) {
+ called = true;
+ subject = SubjectUtils.getCurrentSubject();
+ }
+ }
+}
diff --git a/gateway-provider-security-hadoopauth/src/test/java/org/apache/knox/gateway/hadoopauth/filter/HadoopAuthFilterTest.java b/gateway-provider-security-hadoopauth/src/test/java/org/apache/knox/gateway/hadoopauth/filter/HadoopAuthFilterTest.java
index 352c3c9ef6..5e3cf4dfca 100644
--- a/gateway-provider-security-hadoopauth/src/test/java/org/apache/knox/gateway/hadoopauth/filter/HadoopAuthFilterTest.java
+++ b/gateway-provider-security-hadoopauth/src/test/java/org/apache/knox/gateway/hadoopauth/filter/HadoopAuthFilterTest.java
@@ -587,6 +587,7 @@ private HadoopAuthFilter testIfJwtSupported(String supportJwt) throws Exception
expect(filterConfig.getInitParameter(JWTFederationFilter.JWKS_URLS)).andReturn(null).anyTimes();
expect(filterConfig.getInitParameter(JWTFederationFilter.TOKEN_PRINCIPAL_CLAIM)).andReturn(null).anyTimes();
expect(filterConfig.getInitParameter(JWTFederationFilter.TOKEN_VERIFICATION_PEM)).andReturn(null).anyTimes();
+ expect(filterConfig.getInitParameter(JWTFederationFilter.TOKEN_EXCHANGE_DYNAMIC_JWKS_ALLOW_HTTP)).andReturn(null).anyTimes();
expect(filterConfig.getInitParameter(JWTFederationFilter.JWT_UNAUTHENTICATED_PATHS_PARAM)).andReturn(null).anyTimes();
expect(filterConfig.getInitParameter(AbstractJWTFilter.JWT_EXPECTED_ISSUER)).andReturn(null).anyTimes();
expect(filterConfig.getInitParameter(AbstractJWTFilter.JWT_EXPECTED_SIGALG)).andReturn(null).anyTimes();
diff --git a/gateway-provider-security-jwt/pom.xml b/gateway-provider-security-jwt/pom.xml
index 4b729d39b2..9f6a7d2642 100644
--- a/gateway-provider-security-jwt/pom.xml
+++ b/gateway-provider-security-jwt/pom.xml
@@ -78,11 +78,6 @@
commons-lang3
-
- org.jline
- jline
-
-
org.apache.knox
gateway-test-utils
diff --git a/gateway-provider-security-jwt/src/main/java/org/apache/knox/gateway/provider/federation/jwt/JWTMessages.java b/gateway-provider-security-jwt/src/main/java/org/apache/knox/gateway/provider/federation/jwt/JWTMessages.java
index c8c4f3781e..b25b35a4cc 100644
--- a/gateway-provider-security-jwt/src/main/java/org/apache/knox/gateway/provider/federation/jwt/JWTMessages.java
+++ b/gateway-provider-security-jwt/src/main/java/org/apache/knox/gateway/provider/federation/jwt/JWTMessages.java
@@ -127,6 +127,9 @@ public interface JWTMessages {
@Message(level = MessageLevel.ERROR, text = "Invalid URL ignored. Not a valid JWKS url {0}")
void invalidJwksUrl(String jwksUrl);
+ @Message(level = MessageLevel.WARN, text = "Rejected insecure (non-HTTPS) dynamic JWKS URI {0} resolved for issuer {1}. Set knox.token.exchange.dynamic.jwks.allow.http=true on the provider to permit it.")
+ void rejectedInsecureDynamicJwksUri(String jwksUri, String issuer);
+
@Message(level = MessageLevel.ERROR, text = "Original redirect URL is not in the whitelist {0}")
void invalidOriginalUrlDomain(String originalMainDomain);
diff --git a/gateway-provider-security-jwt/src/main/java/org/apache/knox/gateway/provider/federation/jwt/filter/AbstractJWTFilter.java b/gateway-provider-security-jwt/src/main/java/org/apache/knox/gateway/provider/federation/jwt/filter/AbstractJWTFilter.java
index de4987caa1..bbf396dd6a 100644
--- a/gateway-provider-security-jwt/src/main/java/org/apache/knox/gateway/provider/federation/jwt/filter/AbstractJWTFilter.java
+++ b/gateway-provider-security-jwt/src/main/java/org/apache/knox/gateway/provider/federation/jwt/filter/AbstractJWTFilter.java
@@ -469,67 +469,132 @@ protected boolean validateToken(final HttpServletRequest request, final HttpServ
final String tokenId = TokenUtils.getTokenId(token);
final String displayableTokenId = Tokens.getTokenIDDisplayText(tokenId);
final String displayableToken = Tokens.getTokenDisplayText(token.toString());
- // confirm that issuer matches the intended target
if (expectedIssuers.contains(token.getIssuer())) {
- // if there is no expiration data then the lifecycle is tied entirely to
- // the cookie validity - otherwise ensure that the current time is before
- // the designated expiration time
- try {
- if (tokenIsStillValid(token)) {
- boolean audValid = validateAudiences(token);
- if (audValid) {
- Date nbf = token.getNotBeforeDate();
- if (nbf == null || new Date().after(nbf)) {
- final TokenMetadata tokenMetadata = tokenStateService == null ? null : tokenStateService.getTokenMetadata(tokenId);
- if (isTokenEnabled(tokenMetadata)) {
- if (isIdleTimeoutLimitNotExceeded(tokenMetadata)) {
- if (verifyTokenSignature(token)) {
- markLastUsedAt(tokenId, tokenMetadata);
- return true;
- } else {
- log.failedToVerifyTokenSignature(displayableToken, displayableTokenId);
- handleValidationError(request, response, HttpServletResponse.SC_UNAUTHORIZED, null);
- }
+ // Issuer in the static trusted list: full validation using the provider-configured
+ // PEM/JWKS/instance-key chain. An empty set signals "use verifyTokenSignature()".
+ return doFullTokenValidation(request, response, token, tokenId,
+ displayableToken, displayableTokenId, Set.of());
+ }
+ // For issuers not in the static list, subclasses may resolve JWKS for a runtime-registered issuer.
+ // An empty result means "not applicable for this request" and the token is rejected.
+ // All other validation checks (expiry, audiences, nbf, token state) run identically to the static path.
+ final Set registeredIssuerJwks = resolveRegisteredIssuerJwks(token.getIssuer(), request);
+ if (!registeredIssuerJwks.isEmpty()) {
+ return doFullTokenValidation(request, response, token, tokenId,
+ displayableToken, displayableTokenId, registeredIssuerJwks);
+ }
+ handleValidationError(request, response, HttpServletResponse.SC_UNAUTHORIZED, null);
+ return false;
+ }
+
+ /**
+ * Extension point for subclasses to resolve JWKS for an issuer that is registered at runtime
+ * (e.g., in {@code TrustedOidcIssuerService}) but is not in the static
+ * {@code jwt.expected.issuer} topology parameter.
+ *
+ * Return semantics:
+ *
+ * - Non-empty set — caller runs full token validation using only these JWKS for signature
+ * verification; the provider-configured PEM/JWKS/instance-key chain is not consulted.
+ * - Empty set — not applicable for this request; caller rejects with 401.
+ *
+ *
+ * The default implementation always returns an empty set. Subclasses that support a runtime
+ * issuer registry should override this method, applying any request-context checks themselves,
+ * and return a non-empty set only when the issuer is found in the registry and
+ * its JWKS URI has been successfully resolved.
+ */
+ protected Set resolveRegisteredIssuerJwks(String issuer, HttpServletRequest request) {
+ return Set.of();
+ }
+
+ /**
+ * Runs the full token validation sequence (expiry, audiences, nbf, token state, signature)
+ * used by both the static-issuer path and the registered-issuer path.
+ *
+ * @param registeredIssuerJwks if non-empty, the signature is verified exclusively against these
+ * JWKS URIs (resolved for the issuer from the runtime registry); if empty,
+ * {@link #verifyTokenSignature(JWT)} is used instead (provider-configured PEM / JWKS /
+ * instance-key chain).
+ */
+ private boolean doFullTokenValidation(final HttpServletRequest request, final HttpServletResponse response,
+ final JWT token, final String tokenId, final String displayableToken,
+ final String displayableTokenId, final Set registeredIssuerJwks)
+ throws IOException, ServletException {
+ try {
+ if (tokenIsStillValid(token)) {
+ if (validateAudiences(token)) {
+ Date nbf = token.getNotBeforeDate();
+ if (nbf == null || new Date().after(nbf)) {
+ final TokenMetadata tokenMetadata = tokenStateService == null ? null : tokenStateService.getTokenMetadata(tokenId);
+ if (isTokenEnabled(tokenMetadata)) {
+ if (isIdleTimeoutLimitNotExceeded(tokenMetadata)) {
+ final boolean sigOk = registeredIssuerJwks.isEmpty()
+ ? verifyTokenSignature(token)
+ : verifyTokenSignatureWithJwks(token, registeredIssuerJwks);
+ if (sigOk) {
+ markLastUsedAt(tokenId, tokenMetadata);
+ return true;
} else {
- log.idleTimoutExceeded(token.getSubject(), displayableTokenId, idleTimeoutSeconds);
- handleValidationError(request, response, HttpServletResponse.SC_UNAUTHORIZED, TOKEN_PREFIX + displayableTokenId + IDLE_TIMEOUT_POSTFIX);
+ log.failedToVerifyTokenSignature(displayableToken, displayableTokenId);
+ handleValidationError(request, response, HttpServletResponse.SC_UNAUTHORIZED, null);
}
} else {
- log.disabledToken(displayableTokenId);
- handleValidationError(request, response, HttpServletResponse.SC_UNAUTHORIZED, TOKEN_PREFIX + displayableTokenId + DISABLED_POSTFIX);
+ log.idleTimoutExceeded(token.getSubject(), displayableTokenId, idleTimeoutSeconds);
+ handleValidationError(request, response, HttpServletResponse.SC_UNAUTHORIZED,
+ TOKEN_PREFIX + displayableTokenId + IDLE_TIMEOUT_POSTFIX);
}
} else {
- log.notBeforeCheckFailed();
- handleValidationError(request, response, HttpServletResponse.SC_BAD_REQUEST,
- "Bad request: the NotBefore check failed");
+ log.disabledToken(displayableTokenId);
+ handleValidationError(request, response, HttpServletResponse.SC_UNAUTHORIZED,
+ TOKEN_PREFIX + displayableTokenId + DISABLED_POSTFIX);
}
} else {
- log.failedToValidateAudience(displayableToken, displayableTokenId);
+ log.notBeforeCheckFailed();
handleValidationError(request, response, HttpServletResponse.SC_BAD_REQUEST,
- "Bad request: missing required token audience");
+ "Bad request: the NotBefore check failed");
}
} else {
- log.tokenHasExpired(displayableToken, displayableTokenId);
-
- // Explicitly evict the record of this token's signature verification (if present).
- // There is no value in keeping this record for expired tokens, and explicitly removing them may prevent
- // records for other valid tokens from being prematurely evicted from the cache.
- removeSignatureVerificationRecord(token.toString());
-
- handleValidationError(request, response, HttpServletResponse.SC_UNAUTHORIZED, "Token has expired");
-
+ log.failedToValidateAudience(displayableToken, displayableTokenId);
+ handleValidationError(request, response, HttpServletResponse.SC_BAD_REQUEST,
+ "Bad request: missing required token audience");
}
- } catch (UnknownTokenException e) {
- log.unableToVerifyExpiration(e);
- handleValidationError(request, response, HttpServletResponse.SC_UNAUTHORIZED, e.getMessage());
+ } else {
+ log.tokenHasExpired(displayableToken, displayableTokenId);
+ // Explicitly evict the record of this token's signature verification (if present).
+ // There is no value in keeping this record for expired tokens, and explicitly removing them
+ // may prevent records for other valid tokens from being prematurely evicted from the cache.
+ removeSignatureVerificationRecord(token.toString());
+ handleValidationError(request, response, HttpServletResponse.SC_UNAUTHORIZED, "Token has expired");
}
- } else {
- handleValidationError(request, response, HttpServletResponse.SC_UNAUTHORIZED, null);
+ } catch (UnknownTokenException e) {
+ log.unableToVerifyExpiration(e);
+ handleValidationError(request, response, HttpServletResponse.SC_UNAUTHORIZED, e.getMessage());
}
-
return false;
}
+ /**
+ * Verifies the token's signature against the given JWKS URIs.
+ * Uses the filter's configured signature algorithm and JWS type verifier.
+ */
+ private boolean verifyTokenSignatureWithJwks(final JWT token, final Set jwksUrls) {
+ final String serializedJWT = token.toString();
+ if (hasSignatureBeenVerified(serializedJWT)) {
+ return true;
+ }
+ try {
+ final boolean verified = authority.verifyToken(token, jwksUrls, expectedSigAlg, typeVerifier);
+ if (verified) {
+ recordSignatureVerification(serializedJWT);
+ }
+ return verified;
+ } catch (TokenServiceException e) {
+ log.unableToVerifyToken(e);
+ return false;
+ }
+ }
+
private boolean isTokenEnabled(TokenMetadata tokenMetadata) throws UnknownTokenException {
return tokenMetadata == null ? true : tokenMetadata.isEnabled();
}
@@ -568,7 +633,7 @@ protected boolean validateToken(final HttpServletRequest request,
final TokenMetadata tokenMetadata = tokenStateService == null ? null : tokenStateService.getTokenMetadata(tokenId);
if (isTokenEnabled(tokenMetadata)) {
if (isIdleTimeoutLimitNotExceeded(tokenMetadata)) {
- if (hasSignatureBeenVerified(passcode) || validatePasscode(tokenId, passcode)) {
+ if (hasSignatureBeenVerified(passcodeVerificationCacheKey(tokenId, passcode)) || validatePasscode(tokenId, passcode)) {
markLastUsedAt(tokenId, tokenMetadata);
return true;
} else {
@@ -589,7 +654,7 @@ protected boolean validateToken(final HttpServletRequest request,
// Explicitly evict the record of this token's signature verification (if present).
// There is no value in keeping this record for expired tokens, and explicitly removing them may prevent
// records for other valid tokens from being prematurely evicted from the cache.
- removeSignatureVerificationRecord(passcode);
+ removeSignatureVerificationRecord(passcodeVerificationCacheKey(tokenId, passcode));
handleValidationError(request, response, HttpServletResponse.SC_UNAUTHORIZED, "Token has expired");
}
} else {
@@ -615,7 +680,7 @@ private boolean validatePasscode(String tokenId, String passcode) throws Unknown
final byte[] storedPasscode = tokenMetadata == null ? null : tokenMetadata.getPasscode().getBytes(UTF_8);
final boolean validPasscode = Arrays.equals(tokenMAC.hash(tokenId, issueTime, userName, passcode).getBytes(UTF_8), storedPasscode);
if (validPasscode) {
- recordSignatureVerification(passcode);
+ recordSignatureVerification(passcodeVerificationCacheKey(tokenId, passcode));
}
return validPasscode;
}
@@ -707,4 +772,7 @@ protected void removeSignatureVerificationRecord(final String token) {
protected abstract void handleValidationError(HttpServletRequest request, HttpServletResponse response, int status,
String error) throws IOException;
+ private String passcodeVerificationCacheKey(final String tokenId, final String passcode) {
+ return tokenId + "::" + passcode;
+ }
}
diff --git a/gateway-provider-security-jwt/src/main/java/org/apache/knox/gateway/provider/federation/jwt/filter/JWTFederationFilter.java b/gateway-provider-security-jwt/src/main/java/org/apache/knox/gateway/provider/federation/jwt/filter/JWTFederationFilter.java
index 557e815710..2c1af9835c 100644
--- a/gateway-provider-security-jwt/src/main/java/org/apache/knox/gateway/provider/federation/jwt/filter/JWTFederationFilter.java
+++ b/gateway-provider-security-jwt/src/main/java/org/apache/knox/gateway/provider/federation/jwt/filter/JWTFederationFilter.java
@@ -21,10 +21,10 @@
import org.apache.commons.lang3.tuple.Pair;
import org.apache.knox.gateway.i18n.messages.MessagesFactory;
import org.apache.knox.gateway.provider.federation.jwt.JWTMessages;
-import org.apache.knox.gateway.security.ActorChainPrincipalImpl;
import org.apache.knox.gateway.security.PrimaryPrincipal;
-import org.apache.knox.gateway.security.TokenExchangePrincipal;
-import org.apache.knox.gateway.security.TokenExchangePrincipalImpl;
+import org.apache.knox.gateway.services.GatewayServices;
+import org.apache.knox.gateway.services.ServiceType;
+import org.apache.knox.gateway.services.knoxidf.trustedoidcissuer.TrustedOidcIssuerService;
import org.apache.knox.gateway.services.security.token.TokenUtils;
import org.apache.knox.gateway.services.security.token.UnknownTokenException;
import org.apache.knox.gateway.services.security.token.impl.JWT;
@@ -33,6 +33,7 @@
import org.apache.knox.gateway.util.CertificateUtils;
import org.apache.knox.gateway.util.CookieUtils;
import org.apache.knox.gateway.util.ServletRequestUtils;
+import org.apache.knox.gateway.util.knoxidf.KnoxIDFConstants;
import javax.security.auth.Subject;
import javax.servlet.FilterChain;
@@ -44,24 +45,25 @@
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import java.io.IOException;
-import java.security.Principal;
+import java.net.URI;
+import java.net.URISyntaxException;
import java.text.ParseException;
import java.util.Base64;
import java.util.HashSet;
import java.util.List;
import java.util.Locale;
-import java.util.Map;
+import java.util.Optional;
import java.util.Set;
import static java.nio.charset.StandardCharsets.UTF_8;
-import static org.apache.knox.gateway.security.CommonTokenConstants.GRANT_TYPE;
+import static org.apache.knox.gateway.security.CommonTokenConstants.AUTH_CODE;
import static org.apache.knox.gateway.security.CommonTokenConstants.CLIENT_CREDENTIALS;
import static org.apache.knox.gateway.security.CommonTokenConstants.CLIENT_ID;
import static org.apache.knox.gateway.security.CommonTokenConstants.CLIENT_SECRET;
+import static org.apache.knox.gateway.security.CommonTokenConstants.GRANT_TYPE;
import static org.apache.knox.gateway.util.AuthFilterUtils.DEFAULT_AUTH_UNAUTHENTICATED_PATHS_PARAM;
public class JWTFederationFilter extends AbstractJWTFilter {
-
private static final JWTMessages LOGGER = MessagesFactory.get( JWTMessages.class );
/* A semicolon separated list of paths that need to bypass authentication */
public static final String JWT_UNAUTHENTICATED_PATHS_PARAM = "jwt.unauthenticated.path.list";
@@ -69,15 +71,35 @@ public class JWTFederationFilter extends AbstractJWTFilter {
public static final String MISMATCHING_CLIENT_ID_AND_CLIENT_SECRET = "Client credentials flow with mismatching client_id and client_secret";
public static final String REFRESH_TOKEN = "refresh_token";
public static final String REFRESH_TOKEN_PARAM = "refresh_token";
- public static final String TOKEN_EXCHANGE = "urn:ietf:params:oauth:grant-type:token-exchange";
- public static final String SUBJECT_TOKEN = "subject_token";
- public static final String ACTOR_TOKEN = "actor_token";
public static final String CLIENT_ASSERTION_JWT_BEARER = "urn:ietf:params:oauth:client-assertion-type:jwt-bearer";
public static final String CLIENT_ASSERTION_TYPE = "client_assertion_type";
public static final String CLIENT_ASSERTION = "client_assertion";
+ // RFC 8693 constants
+ public static final String TOKEN_EXCHANGE = "urn:ietf:params:oauth:grant-type:token-exchange";
+ public static final String SUBJECT_TOKEN = "subject_token";
+ public static final String ACTOR_TOKEN = "actor_token";
+ public static final String SUBJECT_TOKEN_TYPE = "subject_token_type";
+ public static final String ACTOR_TOKEN_TYPE = "actor_token_type";
+
+ // Set by doFilter only when it dispatches a genuine RFC 8693 token-exchange request (identified by
+ // getWireToken from the body-only grant_type). resolveRegisteredIssuerJwks trusts a runtime-registered
+ // external issuer's JWKS only when this attribute is present, binding that decision to the actual
+ // dispatched code path rather than to request.getParameter(GRANT_TYPE) -- which the Servlet API also
+ // populates from the URL query string, letting a plain Bearer request spoof it with ?grant_type=...
+ static final String TOKEN_EXCHANGE_REQUEST_ATTR = "knox.jwt.token.exchange.request";
+ // RFC 8693 section 3 token type identifiers. Only JWT-family types are supported for exchange;
+ // Knox issues JWT access tokens, so the access_token URN is accepted as an alias for jwt.
+ public static final String TOKEN_TYPE_JWT = "urn:ietf:params:oauth:token-type:jwt";
+ public static final String TOKEN_TYPE_ACCESS_TOKEN = "urn:ietf:params:oauth:token-type:access_token";
+
+ // Topology provider param. OOTB the JWKS URI resolved via dynamic OIDC discovery for a
+ // runtime-registered external issuer MUST be HTTPS: fetching a token issuer's signing keys over
+ // cleartext would let an on-path attacker substitute their own keys and forge subject tokens.
+ // Set this to "true" on the provider to permit an http:// jwks_uri (e.g. an internal test OP).
+ public static final String TOKEN_EXCHANGE_DYNAMIC_JWKS_ALLOW_HTTP = "knox.token.exchange.dynamic.jwks.allow.http";
public enum TokenType {
- JWT, Passcode;
+ JWT, Passcode, TokenExchange, AuthCode;
}
public static final String KNOX_TOKEN_AUDIENCES = "knox.token.audiences";
@@ -99,8 +121,14 @@ public enum TokenType {
private String cookieName;
private String paramName;
+ // OOTB false: a non-HTTPS dynamic-discovery JWKS URI is rejected. Only an explicit
+ // TOKEN_EXCHANGE_DYNAMIC_JWKS_ALLOW_HTTP="true" flips this, so a typo fails safe (secure).
+ private boolean allowInsecureDynamicJwks;
private Set unAuthenticatedPaths = new HashSet<>(20);
+ // Handles RFC 8693 token exchange requests (see doFilter).
+ private TokenExchangeHandler tokenExchangeHandler = new TokenExchangeHandler(this);
+
@Override
public void init( FilterConfig filterConfig ) throws ServletException {
super.init(filterConfig);
@@ -142,6 +170,12 @@ public void init( FilterConfig filterConfig ) throws ServletException {
publicKey = CertificateUtils.parseRSAPublicKey(verificationPEM);
}
+ // Topology toggle for permitting a non-HTTPS dynamic-discovery JWKS URI. Parsed with
+ // Boolean.parseBoolean so anything other than an explicit "true" (including a typo) keeps
+ // HTTPS enforcement on -- the fail-safe direction for a security control.
+ allowInsecureDynamicJwks = Boolean.parseBoolean(
+ filterConfig.getInitParameter(TOKEN_EXCHANGE_DYNAMIC_JWKS_ALLOW_HTTP));
+
final String unAuthPathString = filterConfig
.getInitParameter(JWT_UNAUTHENTICATED_PATHS_PARAM);
/* prepare a list of allowed unauthenticated paths */
@@ -179,15 +213,6 @@ public void doFilter(ServletRequest request, ServletResponse response, FilterCha
}
}
- // RFC 8693: Check if this is a token exchange request
- HttpServletRequest httpRequest = (HttpServletRequest) request;
- String grantType = httpRequest.getParameter(GRANT_TYPE);
- if (TOKEN_EXCHANGE.equals(grantType)) {
- // Handle RFC 8693 token exchange with subject_token and actor_token
- handleTokenExchange(httpRequest, (HttpServletResponse) response, chain);
- return;
- }
-
Pair wireToken = null;
try {
wireToken = getWireToken(request);
@@ -196,6 +221,29 @@ public void doFilter(ServletRequest request, ServletResponse response, FilterCha
throw e;
}
+ // RFC 8693 token exchange: getWireToken flags this via TokenType.TokenExchange when the
+ // grant_type is in the request body. The subject_token/actor_token are read from the unwrapped
+ // request by the handler. Reading the body only happens on this (header-less) grant-flow path,
+ // so a proxied backend's body is never consumed by the header-authenticated path.
+ if (wireToken != null && TokenType.TokenExchange.equals(wireToken.getLeft())) {
+ // Bind the "this is token exchange" decision to the dispatched path so that only the
+ // subject_token/actor_token validated inside the handler can unlock registered-issuer JWKS.
+ request.setAttribute(TOKEN_EXCHANGE_REQUEST_ATTR, Boolean.TRUE);
+ tokenExchangeHandler.handle((HttpServletRequest) request, (HttpServletResponse) response, chain);
+ return;
+ }
+
+ // authorization_code grant: the KnoxIDF token endpoint (TokenResource) authenticates the client
+ // itself -- a PKCE code_verifier for public clients, or a client_secret for confidential clients
+ // -- and binds the code to its client_id and redirect_uri. getWireToken flags this via
+ // TokenType.AuthCode when the grant_type is in the request body and no Bearer/Basic credentials
+ // were presented. Forward to the service without a gateway-established token so that public PKCE
+ // clients (no secret) are not rejected here.
+ if (wireToken != null && TokenType.AuthCode.equals(wireToken.getLeft())) {
+ continueWithAuthorizationCodeGrant(request, response, chain);
+ return;
+ }
+
if (wireToken != null && wireToken.getLeft() != null && wireToken.getRight() != null) {
TokenType tokenType = wireToken.getLeft();
String tokenValue = wireToken.getRight();
@@ -205,6 +253,7 @@ public void doFilter(ServletRequest request, ServletResponse response, FilterCha
JWT token = parseAndValidateJWT((HttpServletRequest) request, (HttpServletResponse) response, chain, tokenValue);
if (token != null) {
Subject subject = createSubjectFromToken(token);
+ addKnoxIDFAttributes(request, token);
continueWithEstablishedSecurityContext(subject, (HttpServletRequest) request, (HttpServletResponse) response, chain);
}
} catch (ParseException | UnknownTokenException ex) {
@@ -226,7 +275,8 @@ public void doFilter(ServletRequest request, ServletResponse response, FilterCha
}
if (validateToken((HttpServletRequest) request, (HttpServletResponse) response, chain, tokenId, passcode)) {
try {
- Subject subject = createSubjectFromTokenIdentifier(tokenId);
+ final Subject subject = createSubjectFromTokenIdentifier(tokenId);
+ request.setAttribute(KnoxIDFConstants.TOKEN_ID_ATTRIBUTE, tokenId);
continueWithEstablishedSecurityContext(subject, (HttpServletRequest) request, (HttpServletResponse) response, chain);
} catch (UnknownTokenException e) {
((HttpServletResponse) response).sendError(HttpServletResponse.SC_UNAUTHORIZED);
@@ -240,6 +290,18 @@ public void doFilter(ServletRequest request, ServletResponse response, FilterCha
}
}
+ private static void addKnoxIDFAttributes(ServletRequest request, JWT token) {
+ request.setAttribute(KnoxIDFConstants.TOKEN_ID_ATTRIBUTE, TokenUtils.getTokenId(token));
+ final String scope = token.getClaim(KnoxIDFConstants.SCOPE);
+ if (scope != null) {
+ request.setAttribute(KnoxIDFConstants.SCOPE_ATTRIBUTE, scope);
+ }
+ final String issuer = token.getIssuer();
+ if (issuer != null) {
+ request.setAttribute(KnoxIDFConstants.TOKEN_ISS_ATTRIBUTE, issuer);
+ }
+ }
+
private void validateClientID(HttpServletRequest request, String tokenValue) {
final String clientID = request.getParameter(CLIENT_ID);
validateClientID(clientID, tokenValue);
@@ -338,8 +400,12 @@ private Pair getTokenFromRequestBody(ServletRequest request)
HttpServletRequest unwrappedRequest = ServletRequestUtils.unwrapHttpServletRequest(request);
final String grantType = unwrappedRequest.getParameter(GRANT_TYPE);
final String clientAssertionType = unwrappedRequest.getParameter(CLIENT_ASSERTION_TYPE);
- if (CLIENT_CREDENTIALS.equals(grantType)) {
- if (clientAssertionType != null && CLIENT_ASSERTION_JWT_BEARER.equals(clientAssertionType)) {
+ if (AUTH_CODE.equals(grantType)) {
+ // no client_secret parsed here; the KnoxIDF token endpoint authenticates the client
+ // (see the TokenType.AuthCode handling in doFilter)
+ return Pair.of(TokenType.AuthCode, null);
+ } else if (CLIENT_CREDENTIALS.equals(grantType)) {
+ if (CLIENT_ASSERTION_JWT_BEARER.equals(clientAssertionType)) {
// short lived client assertion token expected
return getClientTokenFromParams(unwrappedRequest, CLIENT_ASSERTION);
}
@@ -352,8 +418,9 @@ private Pair getTokenFromRequestBody(ServletRequest request)
// refresh_token flow: the refresh_token parameter contains the actual token
return getClientTokenFromParams(unwrappedRequest, REFRESH_TOKEN_PARAM);
} else if (TOKEN_EXCHANGE.equals(grantType)) {
- // token_exchange flow: the subject_token parameter contains the token to be exchanged
- return getClientTokenFromParams(unwrappedRequest, SUBJECT_TOKEN);
+ // RFC 8693 token exchange: signal it via the token type. doFilter routes this to
+ // TokenExchangeHandler, which reads subject_token/actor_token from the unwrapped request.
+ return Pair.of(TokenType.TokenExchange, null);
}
return null;
}
@@ -421,67 +488,6 @@ private boolean authenticateWithCookies(HttpServletRequest request, HttpServletR
return false;
}
- /**
- * Handle RFC 8693 token exchange flow.
- *
- * This method validates both the subject_token and actor_token parameters,
- * creates a TokenExchangePrincipal with the identity information from both tokens,
- * and establishes a Subject with the actor as the PrimaryPrincipal.
- *
- * The TokenExchangePrincipal signals to the identity assertion layer that
- * impersonation should be established with the subject as the ImpersonatedPrincipal.
- *
- * @param request the HTTP request containing subject_token and actor_token parameters
- * @param response the HTTP response
- * @param chain the filter chain
- * @throws IOException if an I/O error occurs
- * @throws ServletException if a servlet error occurs
- */
- private void handleTokenExchange(HttpServletRequest request, HttpServletResponse response, FilterChain chain)
- throws IOException, ServletException {
- // Extract subject_token (required)
- String subjectTokenValue = request.getParameter(SUBJECT_TOKEN);
- if (subjectTokenValue == null || subjectTokenValue.isEmpty()) {
- handleValidationError(request, response, HttpServletResponse.SC_BAD_REQUEST,
- "RFC 8693 token exchange requires subject_token parameter");
- return;
- }
-
- // Extract actor_token (required for proper token exchange)
- String actorTokenValue = request.getParameter(ACTOR_TOKEN);
- if (actorTokenValue == null || actorTokenValue.isEmpty()) {
- handleValidationError(request, response, HttpServletResponse.SC_BAD_REQUEST,
- "RFC 8693 token exchange requires actor_token parameter");
- return;
- }
-
- try {
- // Parse and validate subject_token
- JWT subjectToken = parseAndValidateJWT(request, response, chain, subjectTokenValue);
- if (subjectToken == null) {
- // Validation failed, error response already sent
- return;
- }
-
- // Parse and validate actor_token
- JWT actorToken = parseAndValidateJWT(request, response, chain, actorTokenValue);
- if (actorToken == null) {
- // Validation failed, error response already sent
- return;
- }
-
- // Create Subject with actor as PrimaryPrincipal and TokenExchangePrincipal
- Subject subject = createSubjectForTokenExchange(subjectToken, actorToken);
-
- continueWithEstablishedSecurityContext(subject, request, response, chain);
-
- } catch (ParseException e) {
- LOGGER.failedToParsePasscodeToken(e);
- handleValidationError(request, response, HttpServletResponse.SC_UNAUTHORIZED,
- "Failed to parse token in token exchange: " + e.getMessage());
- }
- }
-
/**
* Parse and validate a JWT token.
*
@@ -494,7 +500,8 @@ private void handleTokenExchange(HttpServletRequest request, HttpServletResponse
* @throws IOException if an I/O error occurs during validation
* @throws ServletException if a servlet error occurs during validation
*/
- private JWT parseAndValidateJWT(HttpServletRequest request, HttpServletResponse response,
+ // package-private: also invoked by TokenExchangeHandler
+ JWT parseAndValidateJWT(HttpServletRequest request, HttpServletResponse response,
FilterChain chain, String tokenValue)
throws ParseException, IOException, ServletException {
JWT token = new JWTToken(tokenValue);
@@ -505,46 +512,42 @@ private JWT parseAndValidateJWT(HttpServletRequest request, HttpServletResponse
return null;
}
- /**
- * Create a Subject for RFC 8693 token exchange with proper principal setup.
- *
- * @param subjectToken the validated subject token
- * @param actorToken the validated actor token
- * @return a Subject configured for token exchange
- */
- private Subject createSubjectForTokenExchange(JWT subjectToken, JWT actorToken) {
- // Extract identities from the tokens
- String subjectPrincipalName = subjectToken.getSubject();
- String subjectIssuer = subjectToken.getIssuer();
- String actorPrincipalName = actorToken.getSubject();
- String actorIssuer = actorToken.getIssuer();
- // Create principals for the Subject
- // PrimaryPrincipal is the ACTOR (the authenticated party)
- PrimaryPrincipal primaryPrincipal =
- new PrimaryPrincipal(actorPrincipalName);
-
- // TokenExchangePrincipal carries metadata for identity assertion layer
- TokenExchangePrincipal tokenExchangePrincipal =
- new TokenExchangePrincipalImpl(
- subjectPrincipalName, subjectIssuer, actorPrincipalName, actorIssuer);
-
- // Extract actor chain from subject_token (if present) using existing logic
- List> actorChain =
- TokenUtils.extractActorChain(subjectToken);
-
- // Create Subject with all necessary principals
- Set principals = new HashSet<>();
- principals.add(primaryPrincipal);
- principals.add(tokenExchangePrincipal);
-
- // Add ActorChainPrincipal if actor chain exists in subject_token
- if (!actorChain.isEmpty()) {
- principals.add(new ActorChainPrincipalImpl(actorChain));
+ @Override
+ protected Set resolveRegisteredIssuerJwks(String issuer, HttpServletRequest request) {
+ // Only a genuine token-exchange dispatch (see doFilter) may trust a runtime-registered external
+ // issuer's JWKS. Reading the request attribute -- not getParameter(GRANT_TYPE) -- prevents a
+ // ?grant_type= query param on a plain Bearer request from unlocking this path.
+ if (!Boolean.TRUE.equals(request.getAttribute(TOKEN_EXCHANGE_REQUEST_ATTR))) {
+ return Set.of();
}
-
- @SuppressWarnings("rawtypes")
- HashSet emptySet = new HashSet();
- return new Subject(true, principals, emptySet, emptySet);
+ final GatewayServices gws = (GatewayServices)
+ request.getServletContext().getAttribute(GatewayServices.GATEWAY_SERVICES_ATTRIBUTE);
+ if (gws != null) {
+ final TrustedOidcIssuerService issuerSvc = gws.getService(ServiceType.TRUSTED_OIDC_ISSUER_SERVICE);
+ // isDynamicJwks() is the combined guard: true only if the issuer is both registered as
+ // trusted AND configured for dynamic JWKS discovery. If the issuer is not registered, or
+ // registered without dynamic JWKS, it is not actionable through this path.
+ if (issuerSvc != null && issuerSvc.isDynamicJwks(issuer)) {
+ // resolveJwksUri() performs OIDC discovery
+ final Optional jwksUri = issuerSvc.resolveJwksUri(issuer);
+ if (jwksUri.isPresent()) {
+ try {
+ final URI uri = new URI(jwksUri.get());
+ // OOTB the discovered JWKS URI must be HTTPS (see TOKEN_EXCHANGE_DYNAMIC_JWKS_ALLOW_HTTP):
+ // signing keys fetched over cleartext could be swapped by an on-path attacker to forge
+ // subject tokens. Reject anything non-HTTPS unless the operator opted in.
+ if (!allowInsecureDynamicJwks && !"https".equalsIgnoreCase(uri.getScheme())) {
+ LOGGER.rejectedInsecureDynamicJwksUri(jwksUri.get(), issuer);
+ return Set.of();
+ }
+ return Set.of(uri);
+ } catch (URISyntaxException e) {
+ LOGGER.unableToVerifyToken(e);
+ }
+ }
+ }
+ }
+ return Set.of();
}
@Override
@@ -586,6 +589,22 @@ private void continueWithAnonymousSubject(final ServletRequest request,
}
}
+ /**
+ * Forwards an {@code authorization_code} token request to the KnoxIDF token endpoint without a
+ * gateway-established token. The token endpoint ({@code TokenResource.validateAuthCode})
+ * independently authenticates the client -- a PKCE {@code code_verifier} for public clients, or a
+ * {@code client_secret} for confidential clients -- and binds the code to its {@code client_id}
+ * and {@code redirect_uri}, so this filter only needs to let the request through with an anonymous
+ * subject. The principal of the issued token is derived from the authorization code's stored
+ * metadata, not from this subject.
+ */
+ private void continueWithAuthorizationCodeGrant(final ServletRequest request, final ServletResponse response, final FilterChain chain)
+ throws ServletException, IOException {
+ final Subject subject = new Subject();
+ subject.getPrincipals().add(new PrimaryPrincipal("anonymous"));
+ continueWithEstablishedSecurityContext(subject, (HttpServletRequest) request, (HttpServletResponse) response, chain);
+ }
+
/**
* An exception indicating that cookies are present, but none of them contain a
* valid JWT.
@@ -595,4 +614,9 @@ private static class NoValidCookiesException extends Exception {
super("None of the presented cookies are valid.");
}
}
+
+ // Test seam: allows a mock/recording handler to be injected.
+ void setTokenExchangeHandler(TokenExchangeHandler tokenExchangeHandler) {
+ this.tokenExchangeHandler = tokenExchangeHandler;
+ }
}
diff --git a/gateway-provider-security-jwt/src/main/java/org/apache/knox/gateway/provider/federation/jwt/filter/SSOCookieFederationFilter.java b/gateway-provider-security-jwt/src/main/java/org/apache/knox/gateway/provider/federation/jwt/filter/SSOCookieFederationFilter.java
index a8e7b8f8de..3c3e072334 100644
--- a/gateway-provider-security-jwt/src/main/java/org/apache/knox/gateway/provider/federation/jwt/filter/SSOCookieFederationFilter.java
+++ b/gateway-provider-security-jwt/src/main/java/org/apache/knox/gateway/provider/federation/jwt/filter/SSOCookieFederationFilter.java
@@ -31,6 +31,10 @@
import org.apache.knox.gateway.util.CertificateUtils;
import org.apache.knox.gateway.util.CookieUtils;
import org.apache.knox.gateway.util.Urls;
+import org.apache.knox.gateway.util.knoxidf.AuthorizeRequestMetadataStore;
+import org.apache.knox.gateway.util.knoxidf.FederatedOpConfiguration;
+import org.apache.knox.gateway.util.knoxidf.FederatedOpConfigurationStore;
+import org.apache.knox.gateway.util.knoxidf.KnoxIDFUtils;
import org.eclipse.jetty.http.MimeTypes;
import javax.security.auth.Subject;
@@ -45,12 +49,16 @@
import java.io.IOException;
import java.net.MalformedURLException;
import java.net.URL;
+import java.net.URLEncoder;
import java.nio.charset.StandardCharsets;
import java.text.ParseException;
import java.util.ArrayList;
+import java.util.Comparator;
import java.util.HashSet;
import java.util.List;
import java.util.Set;
+import java.util.UUID;
+import java.util.stream.Collectors;
public class SSOCookieFederationFilter extends AbstractJWTFilter {
private static final JWTMessages LOGGER = MessagesFactory.get( JWTMessages.class );
@@ -103,6 +111,8 @@ public class SSOCookieFederationFilter extends AbstractJWTFilter {
private boolean shouldUseOriginalUrlFromHeader = DEFAULT_SHOULD_USE_ORIGINAL_URL_FROM_HEADER;
private boolean verifyOriginalUrlFromHeaderDomain = DEFAULT_VERIFY_ORIGINAL_URL_FROM_HEADER_DOMAIN;
private final List verifyOriginalUrlFromHeaderDomainWhitelist = new ArrayList<>();
+ private final AuthorizeRequestMetadataStore authorizeRequestMetadataStore = AuthorizeRequestMetadataStore.getInstance(120000L);
+ private final FederatedOpConfigurationStore federatedOpConfigurationStore = FederatedOpConfigurationStore.getInstance(120000L);
private String originalUrlHeaderName;
@Override
@@ -337,6 +347,28 @@ protected String constructLoginURL(HttpServletRequest request) {
delimiter = "&";
}
+ final Set enabledFederatedOpConfigs = KnoxIDFUtils.fetchEnabledFederatedOpConfigs(request);
+ if (!enabledFederatedOpConfigs.isEmpty()) {
+ // A fresh random id per authorization flow. This value becomes the OIDC 'state' sent to the
+ // external OP and the key for the in-flight authorize/OP-config/nonce stores, so it must NOT be
+ // the HTTP session id: reusing JSESSIONID would (a) collide across concurrent flows in the same
+ // browser session (last-writer-wins on the shared stores) and (b) leak the session id to the OP
+ // via the state parameter (OP logs, URL bar, Referer). A per-flow UUID is unpredictable and
+ // unique, which is what 'state' is meant to be.
+ final String loginSessionId = UUID.randomUUID().toString();
+ authorizeRequestMetadataStore.put(loginSessionId, KnoxIDFUtils.buildAuthRequestMetadata(request));
+ federatedOpConfigurationStore.put(loginSessionId, enabledFederatedOpConfigs);
+ final List opNames = enabledFederatedOpConfigs.stream()
+ .sorted(Comparator.comparing(FederatedOpConfiguration::getName))
+ .map(FederatedOpConfiguration::getName)
+ .collect(Collectors.toList());
+ providerURL += delimiter
+ + "federatedOpLoginSession=" + URLEncoder.encode(loginSessionId, StandardCharsets.UTF_8)
+ + "&federatedOpNames=" + URLEncoder.encode(String.join(",", opNames), StandardCharsets.UTF_8);
+
+ delimiter = "&";
+ }
+
if(shouldUseOriginalUrlFromHeader && (request.getHeader(originalUrlHeaderName) != null) && !request.getHeader(originalUrlHeaderName).trim().isEmpty()) {
final String originalUrlFromHeader = request.getHeader(originalUrlHeaderName);
LOGGER.usingOriginalUrlFromHeader(originalUrlFromHeader);
diff --git a/gateway-provider-security-jwt/src/main/java/org/apache/knox/gateway/provider/federation/jwt/filter/TokenExchangeHandler.java b/gateway-provider-security-jwt/src/main/java/org/apache/knox/gateway/provider/federation/jwt/filter/TokenExchangeHandler.java
new file mode 100644
index 0000000000..9fe7558f07
--- /dev/null
+++ b/gateway-provider-security-jwt/src/main/java/org/apache/knox/gateway/provider/federation/jwt/filter/TokenExchangeHandler.java
@@ -0,0 +1,202 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.knox.gateway.provider.federation.jwt.filter;
+
+import org.apache.knox.gateway.security.ActorChainPrincipalImpl;
+import org.apache.knox.gateway.security.PrimaryPrincipal;
+import org.apache.knox.gateway.security.TokenExchangePrincipal;
+import org.apache.knox.gateway.security.TokenExchangePrincipalImpl;
+import org.apache.knox.gateway.services.security.token.TokenUtils;
+import org.apache.knox.gateway.services.security.token.UnknownTokenException;
+import org.apache.knox.gateway.services.security.token.impl.JWT;
+import org.apache.knox.gateway.util.ServletRequestUtils;
+
+import javax.security.auth.Subject;
+import javax.servlet.FilterChain;
+import javax.servlet.ServletException;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+
+import java.io.IOException;
+import java.security.Principal;
+import java.text.ParseException;
+import java.util.HashSet;
+import java.util.List;
+import java.util.Map;
+import java.util.Set;
+
+import static org.apache.knox.gateway.provider.federation.jwt.filter.JWTFederationFilter.ACTOR_TOKEN_TYPE;
+import static org.apache.knox.gateway.provider.federation.jwt.filter.JWTFederationFilter.SUBJECT_TOKEN_TYPE;
+import static org.apache.knox.gateway.provider.federation.jwt.filter.JWTFederationFilter.TOKEN_TYPE_ACCESS_TOKEN;
+import static org.apache.knox.gateway.provider.federation.jwt.filter.JWTFederationFilter.TOKEN_TYPE_JWT;
+/**
+ * Handles RFC 8693 (OAuth 2.0 Token Exchange) requests on behalf of {@link JWTFederationFilter}.
+ *
+ * The exchange parameters are sent in the {@code application/x-www-form-urlencoded} body and are
+ * therefore read from the unwrapped request (the filter chain wraps the request in a form
+ * that hides the body from {@code getParameter()}). The owning filter is used for JWT validation
+ * and for establishing the resulting security context.
+ *
+ * Per RFC 8693 section 2.1: {@code subject_token} and {@code subject_token_type} are required;
+ * {@code actor_token} is optional, and {@code actor_token_type} is required when {@code actor_token}
+ * is present and must not be present otherwise. Only JWT-family token types are supported. When an
+ * {@code actor_token} is present the request is treated as delegation (on-behalf-of): the actor is
+ * the authenticated party and the subject is the impersonated party; otherwise the subject_token is
+ * simply exchanged for a token representing the subject.
+ */
+class TokenExchangeHandler {
+
+ private final JWTFederationFilter filter;
+
+ TokenExchangeHandler(JWTFederationFilter filter) {
+ this.filter = filter;
+ }
+
+ /**
+ * Handle a token-exchange request that has already been identified by its grant type.
+ *
+ * @param request the HTTP request (wrapped; passed through to downstream processing)
+ * @param response the HTTP response
+ * @param chain the filter chain
+ * @throws IOException if an I/O error occurs
+ * @throws ServletException if a servlet error occurs
+ */
+ void handle(HttpServletRequest request, HttpServletResponse response, FilterChain chain)
+ throws IOException, ServletException {
+ // The parameters live in the x-www-form-urlencoded body, which is only readable on the
+ // unwrapped request. The wrapped request is still used below so downstream processing is
+ // unchanged.
+ final HttpServletRequest bodyRequest = ServletRequestUtils.unwrapHttpServletRequest(request);
+
+ final String subjectTokenValue = bodyRequest.getParameter(JWTFederationFilter.SUBJECT_TOKEN);
+ final String subjectTokenType = bodyRequest.getParameter(SUBJECT_TOKEN_TYPE);
+ final String actorTokenValue = bodyRequest.getParameter(JWTFederationFilter.ACTOR_TOKEN);
+ final String actorTokenType = bodyRequest.getParameter(ACTOR_TOKEN_TYPE);
+ final boolean hasActorToken = actorTokenValue != null && !actorTokenValue.isEmpty();
+ final boolean hasActorTokenType = actorTokenType != null && !actorTokenType.isEmpty();
+
+ // RFC 8693 section 2.1: subject_token and subject_token_type are REQUIRED.
+ if (subjectTokenValue == null || subjectTokenValue.isEmpty()) {
+ filter.handleValidationError(request, response, HttpServletResponse.SC_BAD_REQUEST,
+ "invalid_request: the subject_token parameter is required");
+ return;
+ }
+ if (subjectTokenType == null || subjectTokenType.isEmpty()) {
+ filter.handleValidationError(request, response, HttpServletResponse.SC_BAD_REQUEST,
+ "invalid_request: the subject_token_type parameter is required");
+ return;
+ }
+ // RFC 8693 section 2.1: actor_token_type is REQUIRED when actor_token is present and MUST NOT
+ // be present otherwise.
+ if (hasActorToken && !hasActorTokenType) {
+ filter.handleValidationError(request, response, HttpServletResponse.SC_BAD_REQUEST,
+ "invalid_request: actor_token_type is required when actor_token is present");
+ return;
+ }
+ if (!hasActorToken && hasActorTokenType) {
+ filter.handleValidationError(request, response, HttpServletResponse.SC_BAD_REQUEST,
+ "invalid_request: actor_token_type must not be present without actor_token");
+ return;
+ }
+ // Only JWT-family token types are supported.
+ if (isNotSupportedTokenType(subjectTokenType)) {
+ filter.handleValidationError(request, response, HttpServletResponse.SC_BAD_REQUEST,
+ "unsupported_token_type: unsupported subject_token_type " + subjectTokenType);
+ return;
+ }
+ if (hasActorToken && isNotSupportedTokenType(actorTokenType)) {
+ filter.handleValidationError(request, response, HttpServletResponse.SC_BAD_REQUEST,
+ "unsupported_token_type: unsupported actor_token_type " + actorTokenType);
+ return;
+ }
+
+ try {
+ final JWT subjectToken = filter.parseAndValidateJWT(request, response, chain, subjectTokenValue);
+ if (subjectToken == null) {
+ // Validation failed, error response already sent
+ return;
+ }
+
+ final Subject subject;
+ if (hasActorToken) {
+ final JWT actorToken = filter.parseAndValidateJWT(request, response, chain, actorTokenValue);
+ if (actorToken == null) {
+ // Validation failed, error response already sent
+ return;
+ }
+ // Delegation (OBO): actor as PrimaryPrincipal, subject as the impersonated party
+ subject = createSubjectForTokenExchange(subjectToken, actorToken);
+ } else {
+ // No actor_token: exchange the subject_token for a token representing the subject itself
+ subject = filter.createSubjectFromToken(subjectToken);
+ }
+
+ filter.continueWithEstablishedSecurityContext(subject, request, response, chain);
+ } catch (ParseException | UnknownTokenException e) {
+ filter.handleValidationError(request, response, HttpServletResponse.SC_UNAUTHORIZED,
+ "Failed to parse token in token exchange: " + e.getMessage());
+ }
+ }
+
+ /**
+ * Token exchange only supports JWT-family token types. The access_token URN is accepted as an
+ * alias for jwt because Knox labels its issued (JWT) access tokens with that type.
+ *
+ * @param tokenType the RFC 8693 token type identifier
+ * @return true if the type does NOT map to a Knox JWT
+ */
+ private boolean isNotSupportedTokenType(String tokenType) {
+ return !TOKEN_TYPE_JWT.equals(tokenType) && !TOKEN_TYPE_ACCESS_TOKEN.equals(tokenType);
+ }
+
+ /**
+ * Create a Subject for a delegation (on-behalf-of) token exchange: the actor is the primary
+ * (authenticated) principal, and the subject is carried for the identity assertion layer, along
+ * with any pre-existing actor chain from the subject_token.
+ *
+ * @param subjectToken the validated subject token
+ * @param actorToken the validated actor token
+ * @return a Subject configured for token exchange
+ */
+ private Subject createSubjectForTokenExchange(JWT subjectToken, JWT actorToken) {
+ final String subjectPrincipalName = subjectToken.getSubject();
+ final String subjectIssuer = subjectToken.getIssuer();
+ final String actorPrincipalName = actorToken.getSubject();
+ final String actorIssuer = actorToken.getIssuer();
+
+ // PrimaryPrincipal is the ACTOR (the authenticated party)
+ final PrimaryPrincipal primaryPrincipal = new PrimaryPrincipal(actorPrincipalName);
+
+ // TokenExchangePrincipal carries metadata for the identity assertion layer
+ final TokenExchangePrincipal tokenExchangePrincipal =
+ new TokenExchangePrincipalImpl(subjectPrincipalName, subjectIssuer, actorPrincipalName, actorIssuer);
+
+ // Extract actor chain from subject_token (if present) using existing logic
+ final List> actorChain = TokenUtils.extractActorChain(subjectToken);
+
+ final Set principals = new HashSet<>();
+ principals.add(primaryPrincipal);
+ principals.add(tokenExchangePrincipal);
+ if (!actorChain.isEmpty()) {
+ principals.add(new ActorChainPrincipalImpl(actorChain));
+ }
+
+ @SuppressWarnings("rawtypes")
+ final HashSet emptySet = new HashSet();
+ return new Subject(true, principals, emptySet, emptySet);
+ }
+}
diff --git a/gateway-provider-security-jwt/src/test/java/org/apache/knox/gateway/provider/federation/AbstractJWTFilterTest.java b/gateway-provider-security-jwt/src/test/java/org/apache/knox/gateway/provider/federation/AbstractJWTFilterTest.java
index f025aa2773..16f71d959f 100644
--- a/gateway-provider-security-jwt/src/test/java/org/apache/knox/gateway/provider/federation/AbstractJWTFilterTest.java
+++ b/gateway-provider-security-jwt/src/test/java/org/apache/knox/gateway/provider/federation/AbstractJWTFilterTest.java
@@ -1520,4 +1520,7 @@ public byte[] getData() {
}
}
+ protected String passcodeVerificationCacheKey(final String tokenId, final String passcode) {
+ return tokenId + "::" + passcode;
+ }
}
diff --git a/gateway-provider-security-jwt/src/test/java/org/apache/knox/gateway/provider/federation/JWTFederationFilterTest.java b/gateway-provider-security-jwt/src/test/java/org/apache/knox/gateway/provider/federation/JWTFederationFilterTest.java
index 2ea5524b9e..6c66d44a35 100644
--- a/gateway-provider-security-jwt/src/test/java/org/apache/knox/gateway/provider/federation/JWTFederationFilterTest.java
+++ b/gateway-provider-security-jwt/src/test/java/org/apache/knox/gateway/provider/federation/JWTFederationFilterTest.java
@@ -195,7 +195,7 @@ private void testVerifyPasscodeTokens(String authTokenType, boolean tssEnabled)
}
EasyMock.replay(tokenStateService, tokenMetadata, request, response);
- SignatureVerificationCache.getInstance(topologyName, filterConfig).recordSignatureVerification(passcode);
+ SignatureVerificationCache.getInstance(topologyName, filterConfig).recordSignatureVerification(passcodeVerificationCacheKey(tokenId, passcode));
final TestFilterChain chain = new TestFilterChain();
handler.doFilter(request, response, chain);
diff --git a/gateway-provider-security-jwt/src/test/java/org/apache/knox/gateway/provider/federation/JWTFederationFilterTokenExchangeTest.java b/gateway-provider-security-jwt/src/test/java/org/apache/knox/gateway/provider/federation/JWTFederationFilterTokenExchangeTest.java
new file mode 100644
index 0000000000..81e6249c85
--- /dev/null
+++ b/gateway-provider-security-jwt/src/test/java/org/apache/knox/gateway/provider/federation/JWTFederationFilterTokenExchangeTest.java
@@ -0,0 +1,879 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with this
+ * work for additional information regarding copyright ownership. The ASF
+ * licenses this file to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+ * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+ * License for the specific language governing permissions and limitations under
+ * the License.
+ */
+package org.apache.knox.gateway.provider.federation;
+
+import com.nimbusds.jose.proc.JOSEObjectTypeVerifier;
+import com.nimbusds.jwt.SignedJWT;
+import org.apache.knox.gateway.provider.federation.jwt.filter.AbstractJWTFilter;
+import org.apache.knox.gateway.provider.federation.jwt.filter.JWTFederationFilter;
+
+import org.apache.knox.gateway.services.GatewayServices;
+import org.apache.knox.gateway.services.ServiceType;
+import org.apache.knox.gateway.services.knoxidf.trustedoidcissuer.TrustedOidcIssuerService;
+import org.apache.knox.gateway.services.security.token.JWTokenAuthority;
+import org.apache.knox.gateway.services.security.token.impl.JWT;
+import org.apache.knox.gateway.util.knoxidf.KnoxIDFConstants;
+import org.easymock.Capture;
+import org.easymock.EasyMock;
+import org.junit.Assert;
+import org.junit.Before;
+import org.junit.Test;
+
+import javax.servlet.ServletContext;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletRequestWrapper;
+import javax.servlet.http.HttpServletResponse;
+import java.net.URI;
+import java.util.Date;
+import java.util.HashMap;
+import java.util.Map;
+import java.util.Optional;
+import java.util.Properties;
+import java.util.Set;
+
+import static org.apache.knox.gateway.security.CommonTokenConstants.GRANT_TYPE;
+
+/**
+ * Tests for two JWTFederationFilter extensions added for Knox IDF delegation.
+ *
+ *
Change 1 — TOKEN_ISS_ATTRIBUTE ({@link #testIssAttributeSetAfterValidation}):
+ * After successful Bearer JWT validation the token's {@code iss} claim is stored as a request
+ * attribute for use by admin endpoint handlers (per-cluster scope limiting).
+ *
+ *
Change 2 — Dynamic JWKS for token-exchange: If a token's issuer is absent from
+ * the static {@code jwt.expected.issuer} list, the filter consults
+ * {@code TrustedOidcIssuerService} via {@code resolveRegisteredIssuerJwks}.
+ * If the issuer is registered with {@code isDynamicJwks=true}, the dynamically resolved JWKS
+ * URI is used exclusively for signature verification. All other validation (expiry, audiences,
+ * nbf, token state) runs via the same {@code doFullTokenValidation} helper as the static path.
+ *
+ *
NOTE: Tests are simplified to single-token form (subject_token only) wherever
+ * actor_token was not the subject of the test. Only two tests retain both tokens:
+ * {@link #testDynamicIssuerAllowedActorExternal}, which specifically tests the actor_token
+ * dynamic JWKS path, and {@link #testDynamicPathUsesRegistryJwksNotStaticJwks}, which
+ * verifies that both tokens are validated against the correct JWKS source independently.
+ *
+ *
NOTE: We do not test the specific failure modes {@code isTokenEnabled} or
+ * {@code isIdleTimeoutLimitNotExceeded} in the dynamic JWKS path. It would require more complex
+ * {@code TokenStateService} setup; without TSS they return true
+ * trivially for both paths, same as the static-issuer path covered by the Knox TSS suite.
+ *
+ *
Filter configuration: the default {@link TestFilterConfig} sets
+ * {@code jwt.expected.issuer} to {@value AbstractJWTFilter#JWT_DEFAULT_ISSUER} only. No static
+ * JWKS URLs are configured unless a test explicitly sets {@link JWTFederationFilter#JWKS_URL}.
+ */
+public class JWTFederationFilterTokenExchangeTest extends AbstractJWTFilterTest {
+
+ static final String EXTERNAL_ISSUER = "https://external.oidc.example.com";
+ static final String KNOX_ISSUER = AbstractJWTFilter.JWT_DEFAULT_ISSUER;
+ static final String DYNAMIC_JWKS_URI = "https://external.oidc.example.com/.well-known/jwks.json";
+
+ @Before
+ public void setUp() {
+ handler = new TestJWTFederationFilter();
+ ((TestJWTFederationFilter) handler).setTokenService(new TestJWTokenAuthority(publicKey));
+ }
+
+ @Override
+ protected String getAudienceProperty() {
+ return JWTFederationFilter.KNOX_TOKEN_AUDIENCES;
+ }
+
+ @Override
+ protected String getVerificationPemProperty() {
+ return JWTFederationFilter.TOKEN_VERIFICATION_PEM;
+ }
+
+ @Override
+ protected void setTokenOnRequest(HttpServletRequest request, SignedJWT jwt) {
+ EasyMock.expect(request.getHeader("Authorization"))
+ .andReturn(JWTFederationFilter.BEARER + " " + jwt.serialize());
+ }
+
+ @Override
+ protected void setGarbledTokenOnRequest(HttpServletRequest request, SignedJWT jwt) {
+ EasyMock.expect(request.getHeader("Authorization"))
+ .andReturn(JWTFederationFilter.BEARER + " ljm" + jwt.serialize());
+ }
+
+ // ---------------------------------------------------------------------------
+ // Dynamic registry path — success
+ // ---------------------------------------------------------------------------
+
+ /**
+ * Subject token from EXTERNAL_ISSUER (not in static list); no actor token. The authority mock
+ * verifies the dynamic path calls verifyToken with the resolved JWKS URI, configured sig-alg,
+ * and type-verifier.
+ */
+ @Test
+ public void testDynamicIssuerAllowedSubjectExternal() throws Exception {
+ handler.init(new TestFilterConfig(getProperties()));
+
+ final SignedJWT subjectJwt = getJWT(EXTERNAL_ISSUER, "k8s-sa",
+ new Date(System.currentTimeMillis() + 60000));
+
+ final Capture capturedDynamicJwt = EasyMock.newCapture();
+
+ final JWTokenAuthority mockAuth = EasyMock.createMock(JWTokenAuthority.class);
+ EasyMock.expect(mockAuth.verifyToken(
+ EasyMock.capture(capturedDynamicJwt),
+ EasyMock.eq(Set.of(new URI(DYNAMIC_JWKS_URI))),
+ EasyMock.eq(AbstractJWTFilter.JWT_DEFAULT_SIGALG),
+ EasyMock.isA(JOSEObjectTypeVerifier.class)))
+ .andReturn(true).once();
+ EasyMock.replay(mockAuth);
+ ((TestJWTFederationFilter) handler).setTokenService(mockAuth);
+
+ final TrustedOidcIssuerService issuerSvc = EasyMock.createMock(TrustedOidcIssuerService.class);
+ EasyMock.expect(issuerSvc.isDynamicJwks(EXTERNAL_ISSUER)).andReturn(true).once();
+ EasyMock.expect(issuerSvc.resolveJwksUri(EXTERNAL_ISSUER)).andReturn(Optional.of(DYNAMIC_JWKS_URI)).once();
+
+ final HttpServletRequest request = buildTokenExchangeRequest(
+ subjectJwt.serialize(), buildContextWithIssuerService(issuerSvc));
+ final HttpServletResponse response = EasyMock.createNiceMock(HttpServletResponse.class);
+ EasyMock.replay(request, response, issuerSvc);
+
+ final TestFilterChain chain = new TestFilterChain();
+ handler.doFilter(request, response, chain);
+
+ Assert.assertTrue("Filter chain should proceed", chain.doFilterCalled);
+ Assert.assertEquals(EXTERNAL_ISSUER, capturedDynamicJwt.getValue().getIssuer());
+ EasyMock.verify(mockAuth, issuerSvc);
+ }
+
+ /**
+ * Actor token from EXTERNAL_ISSUER (dynamic path); subject token from KNOX_ISSUER (static
+ * path). This is the primary K8s SA delegation scenario: the acting service carries a
+ * projected SA token with a dynamically registered issuer; the subject carries a Knox-issued
+ * token. The authority mock verifies the same argument contract as the previous test.
+ */
+ @Test
+ public void testDynamicIssuerAllowedActorExternal() throws Exception {
+ handler.init(new TestFilterConfig(getProperties()));
+
+ final SignedJWT subjectJwt = getJWT(KNOX_ISSUER, "end-user",
+ new Date(System.currentTimeMillis() + 60000));
+ final SignedJWT actorJwt = getJWT(EXTERNAL_ISSUER, "k8s-sa",
+ new Date(System.currentTimeMillis() + 60000));
+
+ final Capture capturedDynamicJwt = EasyMock.newCapture();
+ final Capture capturedStaticJwt = EasyMock.newCapture();
+
+ final JWTokenAuthority mockAuth = EasyMock.createMock(JWTokenAuthority.class);
+ EasyMock.expect(mockAuth.verifyToken(EasyMock.capture(capturedStaticJwt))).andReturn(true).once();
+ EasyMock.expect(mockAuth.verifyToken(
+ EasyMock.capture(capturedDynamicJwt),
+ EasyMock.eq(Set.of(new URI(DYNAMIC_JWKS_URI))),
+ EasyMock.eq(AbstractJWTFilter.JWT_DEFAULT_SIGALG), // configured sig-alg
+ EasyMock.isA(JOSEObjectTypeVerifier.class))) // filter-configured type verifier
+ .andReturn(true).once();
+ EasyMock.replay(mockAuth);
+ ((TestJWTFederationFilter) handler).setTokenService(mockAuth);
+
+ final TrustedOidcIssuerService issuerSvc = EasyMock.createMock(TrustedOidcIssuerService.class);
+ EasyMock.expect(issuerSvc.isDynamicJwks(EXTERNAL_ISSUER)).andReturn(true).once();
+ EasyMock.expect(issuerSvc.resolveJwksUri(EXTERNAL_ISSUER)).andReturn(Optional.of(DYNAMIC_JWKS_URI)).once();
+
+ final HttpServletRequest request = buildTokenExchangeRequest(
+ subjectJwt.serialize(), actorJwt.serialize(), buildContextWithIssuerService(issuerSvc));
+ final HttpServletResponse response = EasyMock.createNiceMock(HttpServletResponse.class);
+ EasyMock.replay(request, response, issuerSvc);
+
+ final TestFilterChain chain = new TestFilterChain();
+ handler.doFilter(request, response, chain);
+
+ Assert.assertTrue("Filter chain should proceed", chain.doFilterCalled);
+ Assert.assertEquals(EXTERNAL_ISSUER, capturedDynamicJwt.getValue().getIssuer());
+ Assert.assertEquals(KNOX_ISSUER, capturedStaticJwt.getValue().getIssuer());
+ EasyMock.verify(mockAuth, issuerSvc);
+ }
+
+ // ---------------------------------------------------------------------------
+ // Dynamic registry path — signature, expiry, nbf, audience failures
+ // ---------------------------------------------------------------------------
+
+ /**
+ * Dynamic JWKS resolved; authority.verifyToken returns false for that URI. The authority
+ * mock verifies the exact JWKS URI, configured sig-alg ("RS256"), and JOSEObjectTypeVerifier
+ * type were passed to authority.verifyToken. Any other authority call (static JWKS, instance
+ * key) would fail the strict mock.
+ */
+ @Test
+ public void testSignatureVerificationFails() throws Exception {
+ handler.init(new TestFilterConfig(getProperties()));
+
+ final SignedJWT subjectJwt = getJWT(EXTERNAL_ISSUER, "some-subject",
+ new Date(System.currentTimeMillis() + 60000));
+
+ final JWTokenAuthority mockAuth = EasyMock.createMock(JWTokenAuthority.class);
+ EasyMock.expect(mockAuth.verifyToken(
+ EasyMock.anyObject(JWT.class),
+ EasyMock.eq(Set.of(new URI(DYNAMIC_JWKS_URI))),
+ EasyMock.eq(AbstractJWTFilter.JWT_DEFAULT_SIGALG),
+ EasyMock.isA(JOSEObjectTypeVerifier.class)))
+ .andReturn(false).once();
+ EasyMock.replay(mockAuth);
+ ((TestJWTFederationFilter) handler).setTokenService(mockAuth);
+
+ final TrustedOidcIssuerService issuerSvc = EasyMock.createMock(TrustedOidcIssuerService.class);
+ EasyMock.expect(issuerSvc.isDynamicJwks(EXTERNAL_ISSUER)).andReturn(true).once();
+ EasyMock.expect(issuerSvc.resolveJwksUri(EXTERNAL_ISSUER)).andReturn(Optional.of(DYNAMIC_JWKS_URI)).once();
+
+ final HttpServletRequest request = buildTokenExchangeRequest(
+ subjectJwt.serialize(), buildContextWithIssuerService(issuerSvc));
+ final HttpServletResponse response = EasyMock.createNiceMock(HttpServletResponse.class);
+ response.sendError(HttpServletResponse.SC_UNAUTHORIZED);
+ EasyMock.expectLastCall().once();
+ EasyMock.replay(request, response, issuerSvc);
+
+ final TestFilterChain chain = new TestFilterChain();
+ handler.doFilter(request, response, chain);
+
+ Assert.assertFalse(chain.doFilterCalled);
+ EasyMock.verify(mockAuth, issuerSvc, response);
+ }
+
+ /**
+ * Dynamic JWKS resolved, but the token is expired. The strict mock with {@code .times(0, 1)}
+ * allows JWKS signature verification to happen 0 or 1 times (validation order is not
+ * guaranteed), so the "Token has expired" rejection is the guaranteed outcome. If the JWKS
+ * call occurs, the captured JWT must have EXTERNAL_ISSUER. {@code verify(issuerSvc)} confirms
+ * the dynamic path was entered before the expiry check.
+ */
+ @Test
+ public void testExpiredTokenRejectedOnDynamicPath() throws Exception {
+ handler.init(new TestFilterConfig(getProperties()));
+
+ final SignedJWT expiredJwt = getJWT(EXTERNAL_ISSUER, "k8s-sa",
+ new Date(System.currentTimeMillis() - 60000));
+
+ final Capture capturedJwt = EasyMock.newCapture();
+ final JWTokenAuthority mockAuth = EasyMock.createMock(JWTokenAuthority.class);
+ EasyMock.expect(mockAuth.verifyToken(
+ EasyMock.capture(capturedJwt),
+ EasyMock.eq(Set.of(new URI(DYNAMIC_JWKS_URI))),
+ EasyMock.eq(AbstractJWTFilter.JWT_DEFAULT_SIGALG),
+ EasyMock.isA(JOSEObjectTypeVerifier.class)))
+ .andReturn(true).times(0, 1);
+ EasyMock.replay(mockAuth);
+ ((TestJWTFederationFilter) handler).setTokenService(mockAuth);
+
+ final TrustedOidcIssuerService issuerSvc = EasyMock.createMock(TrustedOidcIssuerService.class);
+ EasyMock.expect(issuerSvc.isDynamicJwks(EXTERNAL_ISSUER)).andReturn(true).once();
+ EasyMock.expect(issuerSvc.resolveJwksUri(EXTERNAL_ISSUER)).andReturn(Optional.of(DYNAMIC_JWKS_URI)).once();
+
+ final HttpServletRequest request = buildTokenExchangeRequest(
+ expiredJwt.serialize(), buildContextWithIssuerService(issuerSvc));
+ final HttpServletResponse response = EasyMock.createNiceMock(HttpServletResponse.class);
+ response.sendError(HttpServletResponse.SC_UNAUTHORIZED, "Token has expired");
+ EasyMock.expectLastCall().once();
+ EasyMock.replay(request, response, issuerSvc);
+
+ final TestFilterChain chain = new TestFilterChain();
+ handler.doFilter(request, response, chain);
+
+ Assert.assertFalse(chain.doFilterCalled);
+ if (capturedJwt.hasCaptured()) {
+ Assert.assertEquals(EXTERNAL_ISSUER, capturedJwt.getValue().getIssuer());
+ }
+ EasyMock.verify(mockAuth, issuerSvc, response);
+ }
+
+ /**
+ * Dynamic JWKS resolved, but the token's NotBefore is in the future. The strict mock with
+ * {@code .times(0, 1)} allows JWKS signature verification to happen 0 or 1 times (validation
+ * order is not guaranteed), so the "NotBefore check failed" rejection is the guaranteed
+ * outcome. If the JWKS call occurs, the captured JWT must have EXTERNAL_ISSUER.
+ */
+ @Test
+ public void testFutureNbfRejectedOnDynamicPath() throws Exception {
+ handler.init(new TestFilterConfig(getProperties()));
+
+ final Date futureNbf = new Date(System.currentTimeMillis() + 300000);
+ final Date futureExpiry = new Date(System.currentTimeMillis() + 600000);
+ final SignedJWT nbfJwt = getJWT(EXTERNAL_ISSUER, "k8s-sa", futureExpiry, futureNbf, privateKey, "RS256");
+
+ final Capture capturedJwt = EasyMock.newCapture();
+ final JWTokenAuthority mockAuth = EasyMock.createMock(JWTokenAuthority.class);
+ EasyMock.expect(mockAuth.verifyToken(
+ EasyMock.capture(capturedJwt),
+ EasyMock.eq(Set.of(new URI(DYNAMIC_JWKS_URI))),
+ EasyMock.eq(AbstractJWTFilter.JWT_DEFAULT_SIGALG),
+ EasyMock.isA(JOSEObjectTypeVerifier.class)))
+ .andReturn(true).times(0, 1);
+ EasyMock.replay(mockAuth);
+ ((TestJWTFederationFilter) handler).setTokenService(mockAuth);
+
+ final TrustedOidcIssuerService issuerSvc = EasyMock.createMock(TrustedOidcIssuerService.class);
+ EasyMock.expect(issuerSvc.isDynamicJwks(EXTERNAL_ISSUER)).andReturn(true).once();
+ EasyMock.expect(issuerSvc.resolveJwksUri(EXTERNAL_ISSUER)).andReturn(Optional.of(DYNAMIC_JWKS_URI)).once();
+
+ final HttpServletRequest request = buildTokenExchangeRequest(
+ nbfJwt.serialize(), buildContextWithIssuerService(issuerSvc));
+ final HttpServletResponse response = EasyMock.createNiceMock(HttpServletResponse.class);
+ response.sendError(HttpServletResponse.SC_BAD_REQUEST, "Bad request: the NotBefore check failed");
+ EasyMock.expectLastCall().once();
+ EasyMock.replay(request, response, issuerSvc);
+
+ final TestFilterChain chain = new TestFilterChain();
+ handler.doFilter(request, response, chain);
+
+ Assert.assertFalse(chain.doFilterCalled);
+ if (capturedJwt.hasCaptured()) {
+ Assert.assertEquals(EXTERNAL_ISSUER, capturedJwt.getValue().getIssuer());
+ }
+ EasyMock.verify(mockAuth, issuerSvc, response);
+ }
+
+ /**
+ * Dynamic JWKS resolved, but the token's audience does not match the required audience. The
+ * strict mock with {@code .times(0, 1)} allows JWKS signature verification to happen 0 or 1
+ * times (validation order is not guaranteed), so the audience rejection is the guaranteed
+ * outcome. If the JWKS call occurs, the captured JWT must have EXTERNAL_ISSUER.
+ */
+ @Test
+ public void testAudienceMismatchRejectedOnDynamicPath() throws Exception {
+ final Properties props = getProperties();
+ props.setProperty(JWTFederationFilter.KNOX_TOKEN_AUDIENCES, "required-audience");
+ handler.init(new TestFilterConfig(props));
+
+ final SignedJWT subjectJwt = getJWT(EXTERNAL_ISSUER, "k8s-sa",
+ new Date(System.currentTimeMillis() + 60000)); // default aud="bar", not "required-audience"
+
+ final Capture capturedJwt = EasyMock.newCapture();
+ final JWTokenAuthority mockAuth = EasyMock.createMock(JWTokenAuthority.class);
+ EasyMock.expect(mockAuth.verifyToken(
+ EasyMock.capture(capturedJwt),
+ EasyMock.eq(Set.of(new URI(DYNAMIC_JWKS_URI))),
+ EasyMock.eq(AbstractJWTFilter.JWT_DEFAULT_SIGALG),
+ EasyMock.isA(JOSEObjectTypeVerifier.class)))
+ .andReturn(true).times(0, 1);
+ EasyMock.replay(mockAuth);
+ ((TestJWTFederationFilter) handler).setTokenService(mockAuth);
+
+ final TrustedOidcIssuerService issuerSvc = EasyMock.createMock(TrustedOidcIssuerService.class);
+ EasyMock.expect(issuerSvc.isDynamicJwks(EXTERNAL_ISSUER)).andReturn(true).once();
+ EasyMock.expect(issuerSvc.resolveJwksUri(EXTERNAL_ISSUER)).andReturn(Optional.of(DYNAMIC_JWKS_URI)).once();
+
+ final HttpServletRequest request = buildTokenExchangeRequest(
+ subjectJwt.serialize(), buildContextWithIssuerService(issuerSvc));
+ final HttpServletResponse response = EasyMock.createNiceMock(HttpServletResponse.class);
+ response.sendError(HttpServletResponse.SC_BAD_REQUEST, "Bad request: missing required token audience");
+ EasyMock.expectLastCall().once();
+ EasyMock.replay(request, response, issuerSvc);
+
+ final TestFilterChain chain = new TestFilterChain();
+ handler.doFilter(request, response, chain);
+
+ Assert.assertFalse(chain.doFilterCalled);
+ if (capturedJwt.hasCaptured()) {
+ Assert.assertEquals(EXTERNAL_ISSUER, capturedJwt.getValue().getIssuer());
+ }
+ EasyMock.verify(mockAuth, issuerSvc, response);
+ }
+
+ // ---------------------------------------------------------------------------
+ // Token rejected — issuer does not qualify for dynamic JWKS verification
+ // ---------------------------------------------------------------------------
+
+ /**
+ * The issuer is not registered in the dynamic registry; isDynamicJwks returns false. The
+ * filter rejects with 401. resolveJwksUri is not expected on the strict mock — any call to
+ * it would fail verify(), proving no HTTP fetch was attempted (SSRF prevention).
+ */
+ @Test
+ public void testUntrustedIssuerRejectedNoHttpCall() throws Exception {
+ handler.init(new TestFilterConfig(getProperties()));
+
+ final SignedJWT subjectJwt = getJWT(EXTERNAL_ISSUER, "some-subject",
+ new Date(System.currentTimeMillis() + 60000));
+
+ final TrustedOidcIssuerService issuerSvc = EasyMock.createMock(TrustedOidcIssuerService.class);
+ EasyMock.expect(issuerSvc.isDynamicJwks(EXTERNAL_ISSUER)).andReturn(false).once();
+ // resolveJwksUri not expected — any call fails verify(), proving no HTTP fetch attempted
+
+ final HttpServletRequest request = buildTokenExchangeRequest(
+ subjectJwt.serialize(), buildContextWithIssuerService(issuerSvc));
+ final HttpServletResponse response = EasyMock.createNiceMock(HttpServletResponse.class);
+ response.sendError(HttpServletResponse.SC_UNAUTHORIZED);
+ EasyMock.expectLastCall().once();
+ EasyMock.replay(request, response, issuerSvc);
+
+ final TestFilterChain chain = new TestFilterChain();
+ handler.doFilter(request, response, chain);
+
+ Assert.assertFalse(chain.doFilterCalled);
+ EasyMock.verify(issuerSvc, response);
+ }
+
+ /**
+ * TrustedOidcIssuerService is null. The hook returns without calling any service method.
+ * EXTERNAL_ISSUER is not in expectedIssuers, so the filter rejects.
+ */
+ @Test
+ public void testServiceUnavailable() throws Exception {
+ handler.init(new TestFilterConfig(getProperties()));
+
+ final SignedJWT subjectJwt = getJWT(EXTERNAL_ISSUER, "some-subject",
+ new Date(System.currentTimeMillis() + 60000));
+
+ final GatewayServices gws = EasyMock.createNiceMock(GatewayServices.class);
+ EasyMock.expect(gws.getService(ServiceType.TRUSTED_OIDC_ISSUER_SERVICE)).andReturn(null).anyTimes();
+ EasyMock.replay(gws);
+
+ final HttpServletRequest request = buildTokenExchangeRequest(
+ subjectJwt.serialize(), buildServletContext(gws));
+ final HttpServletResponse response = EasyMock.createNiceMock(HttpServletResponse.class);
+ response.sendError(HttpServletResponse.SC_UNAUTHORIZED);
+ EasyMock.expectLastCall().once();
+ EasyMock.replay(request, response);
+
+ final TestFilterChain chain = new TestFilterChain();
+ handler.doFilter(request, response, chain);
+
+ Assert.assertFalse(chain.doFilterCalled);
+ EasyMock.verify(response);
+ }
+
+ /**
+ * Bearer JWT from EXTERNAL_ISSUER with no grant_type — not a token-exchange request. Because
+ * doFilter never marked this request as a token-exchange dispatch, resolveRegisteredIssuerJwks
+ * returns empty without consulting the registry. EXTERNAL_ISSUER is not in expectedIssuers, so
+ * the filter rejects. The strict mock proves no service method was called.
+ */
+ @Test
+ public void testNonTokenExchangeRegistryIssuerRejected() throws Exception {
+ handler.init(new TestFilterConfig(getProperties()));
+
+ final SignedJWT jwt = getJWT(EXTERNAL_ISSUER, "k8s-sa",
+ new Date(System.currentTimeMillis() + 60000));
+
+ final TrustedOidcIssuerService strictIssuerSvc = EasyMock.createMock(TrustedOidcIssuerService.class);
+ EasyMock.replay(strictIssuerSvc);
+
+ final HttpServletRequest request = EasyMock.createNiceMock(HttpServletRequest.class);
+ EasyMock.expect(request.getRequestURL()).andReturn(new StringBuffer(SERVICE_URL)).anyTimes();
+ EasyMock.expect(request.getHeader("Authorization"))
+ .andReturn(JWTFederationFilter.BEARER + " " + jwt.serialize()).anyTimes();
+ EasyMock.expect(request.getServletContext())
+ .andReturn(buildContextWithIssuerService(strictIssuerSvc)).anyTimes();
+ final HttpServletResponse response = EasyMock.createNiceMock(HttpServletResponse.class);
+ EasyMock.replay(request, response);
+
+ final TestFilterChain chain = new TestFilterChain();
+ handler.doFilter(request, response, chain);
+
+ Assert.assertFalse(chain.doFilterCalled);
+ EasyMock.verify(strictIssuerSvc);
+ }
+
+ /**
+ * Regression test for the grant_type query-param bypass: a plain Bearer JWT from a
+ * registry-registered dynamic-JWKS issuer, carrying a spoofed {@code grant_type=token-exchange}
+ * request parameter (as HttpServletRequest.getParameter would surface from the URL query string).
+ * Because a Bearer header is present, getWireToken routes this down the JWT branch — not the
+ * token-exchange branch — so doFilter never sets TOKEN_EXCHANGE_REQUEST_ATTR. The old code checked
+ * getParameter(GRANT_TYPE) here and would have resolved the registry JWKS and accepted the token;
+ * the attribute-based guard rejects it. The strict issuer service (no expectations) proves the
+ * registry is never even consulted.
+ */
+ @Test
+ public void testSpoofedGrantTypeQueryParamDoesNotUnlockRegistry() throws Exception {
+ handler.init(new TestFilterConfig(getProperties()));
+
+ final SignedJWT jwt = getJWT(EXTERNAL_ISSUER, "k8s-sa",
+ new Date(System.currentTimeMillis() + 60000));
+
+ final TrustedOidcIssuerService strictIssuerSvc = EasyMock.createMock(TrustedOidcIssuerService.class);
+ EasyMock.replay(strictIssuerSvc);
+
+ final HttpServletRequest request = EasyMock.createNiceMock(HttpServletRequest.class);
+ EasyMock.expect(request.getRequestURL()).andReturn(new StringBuffer(SERVICE_URL)).anyTimes();
+ EasyMock.expect(request.getHeader("Authorization"))
+ .andReturn(JWTFederationFilter.BEARER + " " + jwt.serialize()).anyTimes();
+ // Attacker-controlled query parameter: getParameter merges query string and body, so this is
+ // what a ?grant_type= on the request URL would look like to the filter.
+ EasyMock.expect(request.getParameter(GRANT_TYPE)).andReturn(JWTFederationFilter.TOKEN_EXCHANGE).anyTimes();
+ EasyMock.expect(request.getServletContext())
+ .andReturn(buildContextWithIssuerService(strictIssuerSvc)).anyTimes();
+ final HttpServletResponse response = EasyMock.createNiceMock(HttpServletResponse.class);
+ EasyMock.replay(request, response);
+
+ final TestFilterChain chain = new TestFilterChain();
+ handler.doFilter(request, response, chain);
+
+ Assert.assertFalse("Spoofed grant_type query param must not authenticate the token", chain.doFilterCalled);
+ EasyMock.verify(strictIssuerSvc);
+ }
+
+ // ---------------------------------------------------------------------------
+ // Dynamic registry path — discovered JWKS URI must be HTTPS (OOTB)
+ // ---------------------------------------------------------------------------
+
+ private static final String INSECURE_JWKS_URI = "http://external.oidc.example.com/.well-known/jwks.json";
+
+ /**
+ * OOTB (knox.token.exchange.dynamic.jwks.allow.http unset) a non-HTTPS JWKS URI resolved via
+ * dynamic discovery for a registered issuer must be rejected: fetching signing keys over cleartext
+ * would let an on-path attacker substitute keys and forge subject tokens. The registry is consulted
+ * (isDynamicJwks + resolveJwksUri), but the strict authority mock with no expectations proves
+ * verifyToken is never called against the insecure URI, and the request is rejected (401).
+ */
+ @Test
+ public void testInsecureDynamicJwksUriRejectedByDefault() throws Exception {
+ handler.init(new TestFilterConfig(getProperties()));
+
+ final SignedJWT subjectJwt = getJWT(EXTERNAL_ISSUER, "k8s-sa",
+ new Date(System.currentTimeMillis() + 60000));
+
+ final JWTokenAuthority mockAuth = EasyMock.createMock(JWTokenAuthority.class);
+ EasyMock.replay(mockAuth); // no expectations: verifyToken must never be reached
+ ((TestJWTFederationFilter) handler).setTokenService(mockAuth);
+
+ final TrustedOidcIssuerService issuerSvc = EasyMock.createMock(TrustedOidcIssuerService.class);
+ EasyMock.expect(issuerSvc.isDynamicJwks(EXTERNAL_ISSUER)).andReturn(true).once();
+ EasyMock.expect(issuerSvc.resolveJwksUri(EXTERNAL_ISSUER)).andReturn(Optional.of(INSECURE_JWKS_URI)).once();
+
+ final HttpServletRequest request = buildTokenExchangeRequest(
+ subjectJwt.serialize(), buildContextWithIssuerService(issuerSvc));
+ final HttpServletResponse response = EasyMock.createNiceMock(HttpServletResponse.class);
+ EasyMock.replay(request, response, issuerSvc);
+
+ final TestFilterChain chain = new TestFilterChain();
+ handler.doFilter(request, response, chain);
+
+ Assert.assertFalse("Insecure (non-HTTPS) dynamic JWKS URI must be rejected OOTB", chain.doFilterCalled);
+ EasyMock.verify(mockAuth, issuerSvc);
+ }
+
+ /**
+ * Opt-in bypass: with knox.token.exchange.dynamic.jwks.allow.http=true on the provider, an http
+ * JWKS URI resolved via dynamic discovery is accepted and used exclusively for signature
+ * verification (e.g. an internal test OP). Mirrors testDynamicIssuerAllowedSubjectExternal but with
+ * the insecure URI and the toggle enabled.
+ */
+ @Test
+ public void testInsecureDynamicJwksUriAllowedWhenConfigured() throws Exception {
+ final Properties props = getProperties();
+ props.put(JWTFederationFilter.TOKEN_EXCHANGE_DYNAMIC_JWKS_ALLOW_HTTP, "true");
+ handler.init(new TestFilterConfig(props));
+
+ final SignedJWT subjectJwt = getJWT(EXTERNAL_ISSUER, "k8s-sa",
+ new Date(System.currentTimeMillis() + 60000));
+
+ final Capture capturedDynamicJwt = EasyMock.newCapture();
+
+ final JWTokenAuthority mockAuth = EasyMock.createMock(JWTokenAuthority.class);
+ EasyMock.expect(mockAuth.verifyToken(
+ EasyMock.capture(capturedDynamicJwt),
+ EasyMock.eq(Set.of(new URI(INSECURE_JWKS_URI))),
+ EasyMock.eq(AbstractJWTFilter.JWT_DEFAULT_SIGALG),
+ EasyMock.isA(JOSEObjectTypeVerifier.class)))
+ .andReturn(true).once();
+ EasyMock.replay(mockAuth);
+ ((TestJWTFederationFilter) handler).setTokenService(mockAuth);
+
+ final TrustedOidcIssuerService issuerSvc = EasyMock.createMock(TrustedOidcIssuerService.class);
+ EasyMock.expect(issuerSvc.isDynamicJwks(EXTERNAL_ISSUER)).andReturn(true).once();
+ EasyMock.expect(issuerSvc.resolveJwksUri(EXTERNAL_ISSUER)).andReturn(Optional.of(INSECURE_JWKS_URI)).once();
+
+ final HttpServletRequest request = buildTokenExchangeRequest(
+ subjectJwt.serialize(), buildContextWithIssuerService(issuerSvc));
+ final HttpServletResponse response = EasyMock.createNiceMock(HttpServletResponse.class);
+ EasyMock.replay(request, response, issuerSvc);
+
+ final TestFilterChain chain = new TestFilterChain();
+ handler.doFilter(request, response, chain);
+
+ Assert.assertTrue("allow.http=true must permit the http JWKS URI", chain.doFilterCalled);
+ Assert.assertEquals(EXTERNAL_ISSUER, capturedDynamicJwt.getValue().getIssuer());
+ EasyMock.verify(mockAuth, issuerSvc);
+ }
+
+ // ---------------------------------------------------------------------------
+ // Static-issuer failures do not fall through to the dynamic path
+ // ---------------------------------------------------------------------------
+
+ /**
+ * KNOX_ISSUER is in expectedIssuers. Signature verification on the static path fails.
+ * The strict issuerSvc mock with no expectations proves isDynamicJwks was never called —
+ * the static-issuer failure does not trigger the dynamic registry.
+ */
+ @Test
+ public void testStaticIssuerSignatureFailureDoesNotFallToDynamic() throws Exception {
+ handler.init(new TestFilterConfig(getProperties()));
+
+ final SignedJWT jwt = getJWT(KNOX_ISSUER, "some-user",
+ new Date(System.currentTimeMillis() + 60000));
+
+ final JWTokenAuthority mockAuth = EasyMock.createMock(JWTokenAuthority.class);
+ EasyMock.expect(mockAuth.verifyToken(EasyMock.anyObject(JWT.class))).andReturn(false).once();
+ EasyMock.replay(mockAuth);
+ ((TestJWTFederationFilter) handler).setTokenService(mockAuth);
+
+ final TrustedOidcIssuerService strictIssuerSvc = EasyMock.createMock(TrustedOidcIssuerService.class);
+ EasyMock.replay(strictIssuerSvc);
+
+ final HttpServletRequest request = EasyMock.createNiceMock(HttpServletRequest.class);
+ EasyMock.expect(request.getRequestURL()).andReturn(new StringBuffer(SERVICE_URL)).anyTimes();
+ EasyMock.expect(request.getHeader("Authorization"))
+ .andReturn(JWTFederationFilter.BEARER + " " + jwt.serialize()).anyTimes();
+ EasyMock.expect(request.getServletContext())
+ .andReturn(buildContextWithIssuerService(strictIssuerSvc)).anyTimes();
+ final HttpServletResponse response = EasyMock.createNiceMock(HttpServletResponse.class);
+ response.sendError(HttpServletResponse.SC_UNAUTHORIZED);
+ EasyMock.expectLastCall().once();
+ EasyMock.replay(request, response);
+
+ final TestFilterChain chain = new TestFilterChain();
+ handler.doFilter(request, response, chain);
+
+ Assert.assertFalse(chain.doFilterCalled);
+ EasyMock.verify(mockAuth, strictIssuerSvc, response);
+ }
+
+ // ---------------------------------------------------------------------------
+ // Static JWKS and dynamic registry both configured
+ // ---------------------------------------------------------------------------
+
+ /**
+ * Static JWKS (knox.token.jwks.url) and dynamic registry are both configured. The authority
+ * mock is strict with distinct URI-set expectations per token: the external-issuer token uses
+ * the dynamic JWKS URI exclusively (never the static JWKS), and the KNOX_ISSUER token uses
+ * the static JWKS. The eq() on sig-alg verifies the configured value ("RS256") is passed to
+ * authority.verifyToken on the dynamic path.
+ */
+ @Test
+ public void testDynamicPathUsesRegistryJwksNotStaticJwks() throws Exception {
+ final String staticJwksUrl = "https://static.jwks.example.com/jwks";
+ final String dynamicJwksUrl = "https://dynamic.jwks.example.com/jwks";
+ final Set staticJwks = Set.of(new URI(staticJwksUrl));
+ final Set dynamicJwks = Set.of(new URI(dynamicJwksUrl));
+
+ final Properties props = getProperties();
+ props.setProperty(JWTFederationFilter.JWKS_URL, staticJwksUrl);
+ handler.init(new TestFilterConfig(props));
+
+ final JWTokenAuthority mockAuth = EasyMock.createMock(JWTokenAuthority.class);
+ EasyMock.expect(mockAuth.verifyToken(
+ EasyMock.anyObject(JWT.class), EasyMock.eq(dynamicJwks), // external-issuer token: dynamic JWKS only
+ EasyMock.eq(AbstractJWTFilter.JWT_DEFAULT_SIGALG),
+ EasyMock.isA(JOSEObjectTypeVerifier.class)))
+ .andReturn(true).once();
+ EasyMock.expect(mockAuth.verifyToken(
+ EasyMock.anyObject(JWT.class), EasyMock.eq(staticJwks), // Knox-issuer token: static JWKS
+ EasyMock.eq(AbstractJWTFilter.JWT_DEFAULT_SIGALG),
+ EasyMock.isA(JOSEObjectTypeVerifier.class)))
+ .andReturn(true).once();
+ EasyMock.replay(mockAuth);
+ ((TestJWTFederationFilter) handler).setTokenService(mockAuth);
+
+ final SignedJWT subjectJwt = getJWT(EXTERNAL_ISSUER, "k8s-sa",
+ new Date(System.currentTimeMillis() + 60000));
+ final SignedJWT actorJwt = getJWT(KNOX_ISSUER, "actor-svc",
+ new Date(System.currentTimeMillis() + 60000));
+
+ final TrustedOidcIssuerService issuerSvc = EasyMock.createMock(TrustedOidcIssuerService.class);
+ EasyMock.expect(issuerSvc.isDynamicJwks(EXTERNAL_ISSUER)).andReturn(true).once();
+ EasyMock.expect(issuerSvc.resolveJwksUri(EXTERNAL_ISSUER)).andReturn(Optional.of(dynamicJwksUrl)).once();
+
+ final HttpServletRequest request = buildTokenExchangeRequest(
+ subjectJwt.serialize(), actorJwt.serialize(), buildContextWithIssuerService(issuerSvc));
+ final HttpServletResponse response = EasyMock.createNiceMock(HttpServletResponse.class);
+ EasyMock.replay(request, response, issuerSvc);
+
+ final TestFilterChain chain = new TestFilterChain();
+ handler.doFilter(request, response, chain);
+
+ Assert.assertTrue(chain.doFilterCalled);
+ EasyMock.verify(mockAuth, issuerSvc);
+ }
+
+ // ---------------------------------------------------------------------------
+ // Existing behavior unaffected by the new hook
+ // ---------------------------------------------------------------------------
+
+ /**
+ * Token-exchange request with a Knox-issuer (static) subject token and no actor token. The
+ * strict issuerSvc mock with no expectations proves isDynamicJwks is never called for a
+ * static-issuer token, even in a token-exchange grant.
+ */
+ @Test
+ public void testTokenExchangeWithStaticIssuerSubjectSucceeds() throws Exception {
+ handler.init(new TestFilterConfig(getProperties()));
+
+ final SignedJWT subjectJwt = getJWT(KNOX_ISSUER, "some-user",
+ new Date(System.currentTimeMillis() + 60000));
+
+ final TrustedOidcIssuerService strictIssuerSvc = EasyMock.createMock(TrustedOidcIssuerService.class);
+ EasyMock.replay(strictIssuerSvc);
+
+ final HttpServletRequest request = buildTokenExchangeRequest(
+ subjectJwt.serialize(), buildContextWithIssuerService(strictIssuerSvc));
+ final HttpServletResponse response = EasyMock.createNiceMock(HttpServletResponse.class);
+ EasyMock.replay(request, response);
+
+ final TestFilterChain chain = new TestFilterChain();
+ handler.doFilter(request, response, chain);
+
+ Assert.assertTrue("Filter chain should proceed", chain.doFilterCalled);
+ EasyMock.verify(strictIssuerSvc);
+ }
+
+ /**
+ * Bearer JWT from KNOX_ISSUER (in static expectedIssuers). validateToken() returns from the
+ * static-issuer branch before resolveRegisteredIssuerJwks is reached. The strict issuerSvc
+ * mock with no expectations proves the hook was not called: any service method call would
+ * throw immediately.
+ */
+ @Test
+ public void testNonTokenExchangeGrantUnaffected() throws Exception {
+ handler.init(new TestFilterConfig(getProperties()));
+
+ final SignedJWT jwt = getJWT(KNOX_ISSUER, "some-user",
+ new Date(System.currentTimeMillis() + 60000));
+
+ final TrustedOidcIssuerService strictIssuerSvc = EasyMock.createMock(TrustedOidcIssuerService.class);
+ EasyMock.replay(strictIssuerSvc);
+
+ final HttpServletRequest request = EasyMock.createNiceMock(HttpServletRequest.class);
+ EasyMock.expect(request.getRequestURL()).andReturn(new StringBuffer(SERVICE_URL)).anyTimes();
+ EasyMock.expect(request.getHeader("Authorization"))
+ .andReturn(JWTFederationFilter.BEARER + " " + jwt.serialize()).anyTimes();
+ EasyMock.expect(request.getServletContext())
+ .andReturn(buildContextWithIssuerService(strictIssuerSvc)).anyTimes();
+ final HttpServletResponse response = EasyMock.createNiceMock(HttpServletResponse.class);
+ EasyMock.replay(request, response);
+
+ final TestFilterChain chain = new TestFilterChain();
+ handler.doFilter(request, response, chain);
+
+ Assert.assertTrue(chain.doFilterCalled);
+ EasyMock.verify(strictIssuerSvc);
+ }
+
+ // ---------------------------------------------------------------------------
+ // TOKEN_ISS_ATTRIBUTE — separate concern from JWKS logic
+ // ---------------------------------------------------------------------------
+
+ /**
+ * After successful Bearer JWT validation, addKnoxIDFAttributes() stores TOKEN_ISS_ATTRIBUTE
+ * on the request. Used by admin endpoint handlers for per-cluster scope limiting.
+ */
+ @Test
+ public void testIssAttributeSetAfterValidation() throws Exception {
+ handler.init(new TestFilterConfig(getProperties()));
+
+ final SignedJWT jwt = getJWT(KNOX_ISSUER, "some-user",
+ new Date(System.currentTimeMillis() + 60000));
+
+ final Map capturedAttrs = new HashMap<>();
+ final HttpServletRequest underlying = EasyMock.createNiceMock(HttpServletRequest.class);
+ EasyMock.expect(underlying.getRequestURL()).andReturn(new StringBuffer(SERVICE_URL)).anyTimes();
+ EasyMock.expect(underlying.getHeader("Authorization"))
+ .andReturn(JWTFederationFilter.BEARER + " " + jwt.serialize()).anyTimes();
+ EasyMock.replay(underlying);
+
+ final HttpServletRequest request = new HttpServletRequestWrapper(underlying) {
+ @Override
+ public void setAttribute(String name, Object o) {
+ capturedAttrs.put(name, o);
+ }
+
+ @Override
+ public Object getAttribute(String name) {
+ return capturedAttrs.get(name);
+ }
+ };
+
+ final HttpServletResponse response = EasyMock.createNiceMock(HttpServletResponse.class);
+ EasyMock.replay(response);
+
+ final TestFilterChain chain = new TestFilterChain();
+ handler.doFilter(request, response, chain);
+
+ Assert.assertTrue(chain.doFilterCalled);
+ Assert.assertEquals(KNOX_ISSUER, capturedAttrs.get(KnoxIDFConstants.TOKEN_ISS_ATTRIBUTE));
+ }
+
+ // ---------------------------------------------------------------------------
+ // Helpers
+ // ---------------------------------------------------------------------------
+
+ private ServletContext buildContextWithIssuerService(TrustedOidcIssuerService issuerSvc) {
+ final GatewayServices gws = EasyMock.createNiceMock(GatewayServices.class);
+ EasyMock.expect(gws.getService(ServiceType.TRUSTED_OIDC_ISSUER_SERVICE)).andReturn(issuerSvc).anyTimes();
+ EasyMock.replay(gws);
+ return buildServletContext(gws);
+ }
+
+ private ServletContext buildServletContext(GatewayServices gws) {
+ final ServletContext ctx = EasyMock.createNiceMock(ServletContext.class);
+ EasyMock.expect(ctx.getAttribute(GatewayServices.GATEWAY_SERVICES_ATTRIBUTE)).andReturn(gws).anyTimes();
+ EasyMock.expect(ctx.getAttribute(GatewayServices.GATEWAY_CLUSTER_ATTRIBUTE))
+ .andReturn("jwt-test-topology").anyTimes();
+ EasyMock.replay(ctx);
+ return ctx;
+ }
+
+ private HttpServletRequest buildTokenExchangeRequest(String subjectToken, ServletContext ctx) {
+ final HttpServletRequest request = EasyMock.createNiceMock(HttpServletRequest.class);
+ EasyMock.expect(request.getRequestURL()).andReturn(new StringBuffer(SERVICE_URL)).anyTimes();
+ EasyMock.expect(request.getParameter(GRANT_TYPE)).andReturn(JWTFederationFilter.TOKEN_EXCHANGE).anyTimes();
+ EasyMock.expect(request.getParameter(JWTFederationFilter.SUBJECT_TOKEN)).andReturn(subjectToken).anyTimes();
+ EasyMock.expect(request.getParameter(JWTFederationFilter.SUBJECT_TOKEN_TYPE))
+ .andReturn(JWTFederationFilter.TOKEN_TYPE_JWT).anyTimes();
+ // ACTOR_TOKEN not mocked — niceMock returns null, making actor_token absent
+ EasyMock.expect(request.getServletContext()).andReturn(ctx).anyTimes();
+ mockRequestAttributeStore(request);
+ return request;
+ }
+
+ private HttpServletRequest buildTokenExchangeRequest(String subjectToken, String actorToken,
+ ServletContext ctx) {
+ final HttpServletRequest request = EasyMock.createNiceMock(HttpServletRequest.class);
+ EasyMock.expect(request.getRequestURL()).andReturn(new StringBuffer(SERVICE_URL)).anyTimes();
+ EasyMock.expect(request.getParameter(GRANT_TYPE)).andReturn(JWTFederationFilter.TOKEN_EXCHANGE).anyTimes();
+ EasyMock.expect(request.getParameter(JWTFederationFilter.SUBJECT_TOKEN)).andReturn(subjectToken).anyTimes();
+ EasyMock.expect(request.getParameter(JWTFederationFilter.SUBJECT_TOKEN_TYPE))
+ .andReturn(JWTFederationFilter.TOKEN_TYPE_JWT).anyTimes();
+ EasyMock.expect(request.getParameter(JWTFederationFilter.ACTOR_TOKEN)).andReturn(actorToken).anyTimes();
+ EasyMock.expect(request.getParameter(JWTFederationFilter.ACTOR_TOKEN_TYPE))
+ .andReturn(JWTFederationFilter.TOKEN_TYPE_JWT).anyTimes();
+ EasyMock.expect(request.getServletContext()).andReturn(ctx).anyTimes();
+ mockRequestAttributeStore(request);
+ return request;
+ }
+
+ /**
+ * Makes {@code getAttribute}/{@code setAttribute} behave like a real attribute map on an EasyMock
+ * nice mock. doFilter marks a genuine token-exchange dispatch by setting
+ * {@code TOKEN_EXCHANGE_REQUEST_ATTR}, and resolveRegisteredIssuerJwks now reads that attribute
+ * (rather than the spoofable grant_type request parameter), so the mock must round-trip it.
+ */
+ private static void mockRequestAttributeStore(final HttpServletRequest request) {
+ final Map attrs = new HashMap<>();
+ request.setAttribute(EasyMock.anyString(), EasyMock.anyObject());
+ EasyMock.expectLastCall().andAnswer(() -> {
+ attrs.put((String) EasyMock.getCurrentArguments()[0], EasyMock.getCurrentArguments()[1]);
+ return null;
+ }).anyTimes();
+ EasyMock.expect(request.getAttribute(EasyMock.anyString()))
+ .andAnswer(() -> attrs.get(EasyMock.getCurrentArguments()[0])).anyTimes();
+ }
+
+}
diff --git a/gateway-provider-security-jwt/src/test/java/org/apache/knox/gateway/provider/federation/OAuthFlowsFederationFilterTest.java b/gateway-provider-security-jwt/src/test/java/org/apache/knox/gateway/provider/federation/OAuthFlowsFederationFilterTest.java
index 515d173f3c..3c635d50e0 100644
--- a/gateway-provider-security-jwt/src/test/java/org/apache/knox/gateway/provider/federation/OAuthFlowsFederationFilterTest.java
+++ b/gateway-provider-security-jwt/src/test/java/org/apache/knox/gateway/provider/federation/OAuthFlowsFederationFilterTest.java
@@ -42,9 +42,11 @@
import static org.apache.knox.gateway.security.CommonTokenConstants.CLIENT_CREDENTIALS;
import static org.apache.knox.gateway.security.CommonTokenConstants.CLIENT_ID;
import static org.apache.knox.gateway.security.CommonTokenConstants.CLIENT_SECRET;
+import static org.apache.knox.gateway.security.CommonTokenConstants.AUTH_CODE;
import static org.junit.Assert.assertEquals;
import static org.junit.Assert.assertNotNull;
+import static org.junit.Assert.assertNull;
import static org.junit.Assert.assertTrue;
import javax.servlet.http.HttpServletRequestWrapper;
@@ -278,7 +280,7 @@ public void testVerifyClientCredentialsFlow() throws Exception {
// Wrap the request to simulate real-world scenario where wrappers hide parameter access
final HttpServletRequest request = new TestServletRequestWrapper(mockRequest);
- SignatureVerificationCache.getInstance(topologyName, filterConfig).recordSignatureVerification(passcode);
+ SignatureVerificationCache.getInstance(topologyName, filterConfig).recordSignatureVerification(passcodeVerificationCacheKey(tokenId, passcode));
final TestFilterChain chain = new TestFilterChain();
handler.doFilter(request, response, chain);
@@ -387,16 +389,87 @@ public void testInvalidPasscodeForJWT() throws Exception {
public void testUnableToParseJWT() throws Exception {
}
+ @Override
@Test
- public void testGetWireTokenUsingRefreshTokenFlow() throws Exception {
- final String refreshToken = "WTJ4cFpXNTBMV2xrTFRFeU16UTE6OlkyeHBaVzUwTFhObFkzSmxkQzB4TWpNME5RPT0=";
- testGetWireTokenWithGrant(JWTFederationFilter.REFRESH_TOKEN, JWTFederationFilter.REFRESH_TOKEN_PARAM, refreshToken);
+ public void testPasscodeCannotBeReplayedAgainstDifferentTokenId() {
}
@Test
- public void testGetWireTokenUsingTokenExchangeFlow() throws Exception {
- final String subjectToken = "WTJ4cFpXNTBMV2xrTFRFeU16UTE2OlkyeHBaVzUwTFhObFkzSmxkQzB4TWpNME5RPT0=";
- testGetWireTokenWithGrant(JWTFederationFilter.TOKEN_EXCHANGE, JWTFederationFilter.SUBJECT_TOKEN, subjectToken);
+ public void testGetWireTokenUsingAuthorizationCodeFlowWithoutClientSecret() throws Exception {
+ // A public client redeeming an authorization code with PKCE sends grant_type=authorization_code
+ // with no Authorization header and no client_secret. Unlike client_credentials, the filter must
+ // NOT reject this; it flags TokenType.AuthCode so the request is forwarded to the KnoxIDF token
+ // endpoint, which authenticates the caller via the code_verifier.
+ final HttpServletRequest mockRequest = EasyMock.createNiceMock(HttpServletRequest.class);
+ EasyMock.expect(mockRequest.getHeader("Authorization")).andReturn(null).anyTimes();
+ EasyMock.expect(mockRequest.getQueryString()).andReturn(null).anyTimes();
+ EasyMock.expect(mockRequest.getParameter(GRANT_TYPE)).andReturn(AUTH_CODE).anyTimes();
+ EasyMock.replay(mockRequest);
+
+ // Wrap the request to simulate real-world scenario where wrappers hide parameter access
+ final HttpServletRequest request = new TestServletRequestWrapper(mockRequest);
+
+ handler.init(new TestFilterConfig(getProperties()));
+ final Pair wireToken = ((TestJWTFederationFilter) handler).getWireToken(request);
+
+ EasyMock.verify(mockRequest);
+
+ assertNotNull(wireToken);
+ assertEquals(TokenType.AuthCode, wireToken.getLeft());
+ assertNull(wireToken.getRight());
+ }
+
+ @Test
+ public void testGetWireTokenUsingAuthorizationCodeFlowDoesNotParseClientSecret() throws Exception {
+ // Even when a (confidential) client includes a client_secret on the authorization_code grant,
+ // the filter routes it through the AuthCode pass-through and does NOT try to parse the secret as
+ // a passcode here -- the token endpoint validates it. A non-passcode-formatted secret that would
+ // have triggered INVALID_CLIENT_SECRET on the client_credentials path must not do so here.
+ final HttpServletRequest mockRequest = EasyMock.createNiceMock(HttpServletRequest.class);
+ EasyMock.expect(mockRequest.getHeader("Authorization")).andReturn(null).anyTimes();
+ EasyMock.expect(mockRequest.getQueryString()).andReturn(null).anyTimes();
+ EasyMock.expect(mockRequest.getParameter(GRANT_TYPE)).andReturn(AUTH_CODE).anyTimes();
+ EasyMock.expect(mockRequest.getParameter(CLIENT_SECRET)).andReturn("not-a-passcode").anyTimes();
+ EasyMock.replay(mockRequest);
+
+ // Wrap the request to simulate real-world scenario where wrappers hide parameter access
+ final HttpServletRequest request = new TestServletRequestWrapper(mockRequest);
+
+ handler.init(new TestFilterConfig(getProperties()));
+ final Pair wireToken = ((TestJWTFederationFilter) handler).getWireToken(request);
+
+ assertNotNull(wireToken);
+ assertEquals(TokenType.AuthCode, wireToken.getLeft());
+ assertNull(wireToken.getRight());
+ }
+
+ @Test
+ public void testAuthorizationCodeFlowForwardsToServiceWithoutClientSecret() throws Exception {
+ // End-to-end at the filter level: a public PKCE client's authorization_code request is forwarded
+ // down the chain with an anonymous subject rather than rejected, so the KnoxIDF token endpoint can
+ // validate the code + code_verifier and issue the token.
+ final HttpServletRequest mockRequest = EasyMock.createNiceMock(HttpServletRequest.class);
+ EasyMock.expect(mockRequest.getHeader("Authorization")).andReturn(null).anyTimes();
+ EasyMock.expect(mockRequest.getQueryString()).andReturn(null).anyTimes();
+ EasyMock.expect(mockRequest.getParameter(GRANT_TYPE)).andReturn(AUTH_CODE).anyTimes();
+ final HttpServletResponse response = EasyMock.createNiceMock(HttpServletResponse.class);
+ EasyMock.replay(mockRequest, response);
+
+ // Wrap the request to simulate real-world scenario where wrappers hide parameter access
+ final HttpServletRequest request = new TestServletRequestWrapper(mockRequest);
+
+ handler.init(new TestFilterConfig(getProperties()));
+ final TestFilterChain chain = new TestFilterChain();
+ handler.doFilter(request, response, chain);
+
+ assertTrue(chain.doFilterCalled);
+ Assert.assertNotNull(chain.subject);
+ }
+
+ @Test
+ public void testGetWireTokenUsingRefreshTokenFlow() throws Exception {
+ final String refreshToken = "WTJ4cFpXNTBMV2xrTFRFeU16UTE6OlkyeHBaVzUwTFhObFkzSmxkQzB4TWpNME5RPT0=";
+ testGetWireTokenWithGrant(JWTFederationFilter.REFRESH_TOKEN, JWTFederationFilter.REFRESH_TOKEN_PARAM, refreshToken);
}
@Test
@@ -407,14 +480,6 @@ public void testVerifyRefreshTokenFlow() throws Exception {
testVerifyTokenWithGrant(tokenId, passcode, passcodeToken, JWTFederationFilter.REFRESH_TOKEN, JWTFederationFilter.REFRESH_TOKEN_PARAM);
}
- @Test
- public void testVerifyTokenExchangeFlow() throws Exception {
- final String tokenId = "4e0c548b-6568-4061-a3dc-62908087650c";
- final String passcode = "0138aaed-ca2a-47f1-8ed8-e0c397596f97";
- final String passcodeToken = "TkdVd1l6VTBPR0l0TmpVMk9DMDBNRFl4TFdFelpHTXROakk1TURnd09EYzJOVEJqOjpNREV6T0dGaFpXUXRZMkV5WVMwME4yWXhMVGhsWkRndFpUQmpNemszTlRrMlpqazM=";
- testVerifyTokenWithGrant(tokenId, passcode, passcodeToken, JWTFederationFilter.TOKEN_EXCHANGE, JWTFederationFilter.SUBJECT_TOKEN);
- }
-
private Pair createMockTokenStateService(String tokenId, String passcodeToken) throws UnknownTokenException {
final TokenStateService tokenStateService = EasyMock.createNiceMock(TokenStateService.class);
EasyMock.expect(tokenStateService.getTokenExpiration(tokenId)).andReturn(Long.MAX_VALUE).anyTimes();
@@ -484,7 +549,7 @@ private void testVerifyTokenWithGrant(String tokenId, String passcode, String pa
// Wrap the request to simulate real-world scenario where wrappers hide parameter access
final HttpServletRequest request = new TestServletRequestWrapper(mockRequest);
- SignatureVerificationCache.getInstance("jwt-topology", filterConfig).recordSignatureVerification(passcode);
+ SignatureVerificationCache.getInstance("jwt-topology", filterConfig).recordSignatureVerification(passcodeVerificationCacheKey(tokenId, passcode));
final TestFilterChain chain = new TestFilterChain();
handler.doFilter(request, response, chain);
diff --git a/gateway-provider-security-jwt/src/test/java/org/apache/knox/gateway/provider/federation/SSOCookieProviderTest.java b/gateway-provider-security-jwt/src/test/java/org/apache/knox/gateway/provider/federation/SSOCookieProviderTest.java
index 90c056f2ea..d96b2442ad 100644
--- a/gateway-provider-security-jwt/src/test/java/org/apache/knox/gateway/provider/federation/SSOCookieProviderTest.java
+++ b/gateway-provider-security-jwt/src/test/java/org/apache/knox/gateway/provider/federation/SSOCookieProviderTest.java
@@ -17,23 +17,7 @@
*/
package org.apache.knox.gateway.provider.federation;
-import static org.apache.knox.gateway.provider.federation.jwt.filter.SSOCookieFederationFilter.XHR_HEADER;
-import static org.apache.knox.gateway.provider.federation.jwt.filter.SSOCookieFederationFilter.XHR_VALUE;
-import static org.junit.Assert.fail;
-
-import java.nio.charset.StandardCharsets;
-import java.security.Principal;
-import java.time.Instant;
-import java.util.Properties;
-import java.util.Date;
-import java.util.Set;
-import java.util.concurrent.ThreadLocalRandom;
-
-import javax.servlet.ServletException;
-import javax.servlet.http.Cookie;
-import javax.servlet.http.HttpServletRequest;
-import javax.servlet.http.HttpServletResponse;
-
+import com.nimbusds.jwt.SignedJWT;
import org.apache.knox.gateway.provider.federation.jwt.filter.AbstractJWTFilter;
import org.apache.knox.gateway.provider.federation.jwt.filter.SSOCookieFederationFilter;
import org.apache.knox.gateway.security.PrimaryPrincipal;
@@ -44,11 +28,25 @@
import org.junit.Assert;
import org.junit.Before;
import org.junit.Test;
-
-import com.nimbusds.jwt.SignedJWT;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
+import javax.servlet.ServletException;
+import javax.servlet.http.Cookie;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+import java.nio.charset.StandardCharsets;
+import java.security.Principal;
+import java.time.Instant;
+import java.util.Date;
+import java.util.Properties;
+import java.util.Set;
+import java.util.concurrent.ThreadLocalRandom;
+
+import static org.apache.knox.gateway.provider.federation.jwt.filter.SSOCookieFederationFilter.XHR_HEADER;
+import static org.apache.knox.gateway.provider.federation.jwt.filter.SSOCookieFederationFilter.XHR_VALUE;
+import static org.junit.Assert.fail;
+
public class SSOCookieProviderTest extends AbstractJWTFilterTest {
private static final Logger LOGGER = LoggerFactory.getLogger(SSOCookieProviderTest.class);
diff --git a/gateway-provider-security-jwt/src/test/java/org/apache/knox/gateway/provider/federation/TokenIDAsHTTPBasicCredsFederationFilterTest.java b/gateway-provider-security-jwt/src/test/java/org/apache/knox/gateway/provider/federation/TokenIDAsHTTPBasicCredsFederationFilterTest.java
index b92158f89f..dadd41cffe 100644
--- a/gateway-provider-security-jwt/src/test/java/org/apache/knox/gateway/provider/federation/TokenIDAsHTTPBasicCredsFederationFilterTest.java
+++ b/gateway-provider-security-jwt/src/test/java/org/apache/knox/gateway/provider/federation/TokenIDAsHTTPBasicCredsFederationFilterTest.java
@@ -20,6 +20,7 @@
import static org.junit.Assert.fail;
+import java.io.IOException;
import java.nio.charset.StandardCharsets;
import java.text.ParseException;
import java.time.Instant;
@@ -265,6 +266,55 @@ public void testInvalidPasscodeForJWT() throws Exception {
}
}
+ @Test
+ public void testPasscodeCannotBeReplayedAgainstDifferentTokenId() throws Exception {
+ Properties props = getProperties();
+ handler.init(new TestFilterConfig(props));
+
+ final long issueTime = System.currentTimeMillis() - TimeUnit.MINUTES.toMillis(5);
+ final Date expiry = new Date(System.currentTimeMillis() + TimeUnit.MINUTES.toMillis(5));
+
+ final SignedJWT attackerJwt = getJWT(AbstractJWTFilter.JWT_DEFAULT_ISSUER, "attacker", expiry, privateKey);
+ final String attackerPasscode = (String) attackerJwt.getJWTClaimsSet().getClaims().get(PASSCODE_CLAIM);
+ addTokenState(attackerJwt, issueTime, "attacker", attackerPasscode);
+
+ final SignedJWT victimJwt = getJWT(AbstractJWTFilter.JWT_DEFAULT_ISSUER, "bob", expiry, privateKey);
+ final String victimPasscode = (String) victimJwt.getJWTClaimsSet().getClaims().get(PASSCODE_CLAIM);
+ addTokenState(victimJwt, issueTime, "bob", victimPasscode);
+ final String victimTokenId = getTokenId(victimJwt);
+
+ final TestFilterChain seedChain = new TestFilterChain();
+ handler.doFilter(newPasscodeRequest(generatePasscodeField(getTokenId(attackerJwt), attackerPasscode)),
+ newResponse(), seedChain);
+ Assert.assertTrue("Precondition: the attacker's own passcode should authenticate.", seedChain.doFilterCalled);
+
+ final TestFilterChain attackChain = new TestFilterChain();
+ handler.doFilter(newPasscodeRequest(generatePasscodeField(victimTokenId, attackerPasscode)),
+ newResponse(), attackChain);
+
+ Assert.assertFalse("A passcode must not authenticate when paired with a different token id "
+ + "(identity-assertion / authentication bypass).", attackChain.doFilterCalled);
+ Assert.assertNull("No subject should have been established for the replayed passcode.", attackChain.getSubject());
+ }
+
+ private HttpServletRequest newPasscodeRequest(final String passcodeField) {
+ final HttpServletRequest request = EasyMock.createNiceMock(HttpServletRequest.class);
+ setTokenOnRequest(request, JWTFederationFilter.PASSCODE, passcodeField);
+ EasyMock.expect(request.getRequestURL()).andReturn(new StringBuffer(SERVICE_URL)).anyTimes();
+ EasyMock.expect(request.getPathInfo()).andReturn("resource").anyTimes();
+ EasyMock.expect(request.getQueryString()).andReturn(null).anyTimes();
+ EasyMock.replay(request);
+ return request;
+ }
+
+ private HttpServletResponse newResponse() throws IOException {
+ final HttpServletResponse response = EasyMock.createNiceMock(HttpServletResponse.class);
+ EasyMock.expect(response.encodeRedirectURL(SERVICE_URL)).andReturn(SERVICE_URL).anyTimes();
+ EasyMock.expect(response.getOutputStream()).andAnswer(DummyServletOutputStream::new).anyTimes();
+ EasyMock.replay(response);
+ return response;
+ }
+
@Override
public void testJWTWithoutKnoxUUIDClaim() throws Exception {
// Override to disable N/A test
diff --git a/gateway-provider-security-jwt/src/test/java/org/apache/knox/gateway/provider/federation/jwt/filter/JWTFederationFilterTokenExchangeRoutingTest.java b/gateway-provider-security-jwt/src/test/java/org/apache/knox/gateway/provider/federation/jwt/filter/JWTFederationFilterTokenExchangeRoutingTest.java
new file mode 100644
index 0000000000..1dad10b28c
--- /dev/null
+++ b/gateway-provider-security-jwt/src/test/java/org/apache/knox/gateway/provider/federation/jwt/filter/JWTFederationFilterTokenExchangeRoutingTest.java
@@ -0,0 +1,145 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.knox.gateway.provider.federation.jwt.filter;
+
+import static org.apache.knox.gateway.security.CommonTokenConstants.GRANT_TYPE;
+import static org.junit.Assert.assertFalse;
+import static org.junit.Assert.assertTrue;
+
+import org.easymock.EasyMock;
+import org.junit.Before;
+import org.junit.Test;
+
+import javax.servlet.FilterChain;
+import javax.servlet.ServletException;
+import javax.servlet.ServletRequest;
+import javax.servlet.ServletResponse;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletRequestWrapper;
+import javax.servlet.http.HttpServletResponse;
+
+import java.io.IOException;
+
+/**
+ * Verifies that {@link JWTFederationFilter#doFilter} routes RFC 8693 token-exchange requests to the
+ * {@link TokenExchangeHandler}. The handler itself is replaced by a recording stub so this test
+ * only asserts the dispatch decision (the handler's own logic is covered by
+ * {@link TokenExchangeHandlerTest}).
+ *
+ * The grant type lives in the {@code x-www-form-urlencoded} body, which is only visible on the
+ * unwrapped request; {@link BodyHidingRequestWrapper} reproduces that (its {@code getParameter}
+ * returns {@code null}, mirroring the production wrapper).
+ */
+public class JWTFederationFilterTokenExchangeRoutingTest {
+
+ private JWTFederationFilter filter;
+ private RecordingTokenExchangeHandler recordingHandler;
+ private HttpServletResponse response;
+ private RecordingFilterChain chain;
+
+ @Before
+ public void setUp() {
+ filter = new JWTFederationFilter();
+ recordingHandler = new RecordingTokenExchangeHandler(filter);
+ filter.setTokenExchangeHandler(recordingHandler);
+ response = EasyMock.createNiceMock(HttpServletResponse.class);
+ EasyMock.replay(response);
+ chain = new RecordingFilterChain();
+ }
+
+ @Test
+ public void testTokenExchangeGrantRoutesToHandler() throws Exception {
+ // grant_type in the body (unwrapped), no Authorization header
+ final HttpServletRequest request = wrapped(bodyRequest(JWTFederationFilter.TOKEN_EXCHANGE, null));
+
+ filter.doFilter(request, response, chain);
+
+ assertTrue("token-exchange grant should be dispatched to the handler", recordingHandler.called);
+ assertFalse("the filter chain must not continue when the handler takes over", chain.called);
+ }
+
+ @Test
+ public void testNonTokenExchangeGrantDoesNotRouteToHandler() throws Exception {
+ // no grant_type at all -> not a token exchange
+ final HttpServletRequest request = wrapped(bodyRequest(null, null));
+
+ filter.doFilter(request, response, chain);
+
+ assertFalse("non-exchange requests must not reach the handler", recordingHandler.called);
+ }
+
+ private static HttpServletRequest wrapped(HttpServletRequest inner) {
+ return new BodyHidingRequestWrapper(inner);
+ }
+
+ private static HttpServletRequest bodyRequest(String grantType, String authorizationHeader) {
+ final HttpServletRequest request = EasyMock.createNiceMock(HttpServletRequest.class);
+ EasyMock.expect(request.getHeader("Authorization")).andReturn(authorizationHeader).anyTimes();
+ EasyMock.expect(request.getParameter(GRANT_TYPE)).andReturn(grantType).anyTimes();
+ EasyMock.expect(request.getQueryString()).andReturn(null).anyTimes();
+ EasyMock.expect(request.getPathInfo()).andReturn(null).anyTimes();
+ EasyMock.replay(request);
+ return request;
+ }
+
+ /** Mirrors the production request wrapper: parameters are hidden, the body is only on getRequest(). */
+ private static final class BodyHidingRequestWrapper extends HttpServletRequestWrapper {
+ private final HttpServletRequest inner;
+
+ BodyHidingRequestWrapper(HttpServletRequest inner) {
+ super(inner);
+ this.inner = inner;
+ }
+
+ @Override
+ public String getParameter(String name) {
+ return null; // hide body parameters
+ }
+
+ @Override
+ public String getHeader(String name) {
+ return inner.getHeader(name);
+ }
+
+ @Override
+ public HttpServletRequest getRequest() {
+ return inner;
+ }
+ }
+
+ private static final class RecordingTokenExchangeHandler extends TokenExchangeHandler {
+ private boolean called;
+
+ RecordingTokenExchangeHandler(JWTFederationFilter filter) {
+ super(filter);
+ }
+
+ @Override
+ void handle(HttpServletRequest request, HttpServletResponse response, FilterChain chain) {
+ this.called = true;
+ }
+ }
+
+ private static final class RecordingFilterChain implements FilterChain {
+ private boolean called;
+
+ @Override
+ public void doFilter(ServletRequest request, ServletResponse response) throws IOException, ServletException {
+ this.called = true;
+ }
+ }
+}
diff --git a/gateway-provider-security-jwt/src/test/java/org/apache/knox/gateway/provider/federation/jwt/filter/TokenExchangeHandlerTest.java b/gateway-provider-security-jwt/src/test/java/org/apache/knox/gateway/provider/federation/jwt/filter/TokenExchangeHandlerTest.java
new file mode 100644
index 0000000000..a5296b3490
--- /dev/null
+++ b/gateway-provider-security-jwt/src/test/java/org/apache/knox/gateway/provider/federation/jwt/filter/TokenExchangeHandlerTest.java
@@ -0,0 +1,263 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.knox.gateway.provider.federation.jwt.filter;
+
+import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertFalse;
+import static org.junit.Assert.assertNotNull;
+import static org.junit.Assert.assertTrue;
+
+import org.apache.knox.gateway.security.ActorChainPrincipal;
+import org.apache.knox.gateway.security.PrimaryPrincipal;
+import org.apache.knox.gateway.security.TokenExchangePrincipal;
+import org.apache.knox.gateway.services.security.token.impl.JWT;
+import org.apache.knox.gateway.services.security.token.impl.JWTToken;
+import org.easymock.EasyMock;
+import org.junit.Before;
+import org.junit.Test;
+
+import javax.security.auth.Subject;
+import javax.servlet.FilterChain;
+import javax.servlet.ServletException;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+
+import java.io.IOException;
+import java.text.ParseException;
+import java.util.HashMap;
+import java.util.Map;
+import java.util.Set;
+
+/**
+ * Unit tests for {@link TokenExchangeHandler} covering the RFC 8693 request-validation and
+ * subject-construction business logic. The owning {@link JWTFederationFilter}'s callbacks
+ * (JWT validation and security-context establishment) are stubbed by {@link RecordingFilter}.
+ */
+public class TokenExchangeHandlerTest {
+
+ private static final String JWT_TYPE = JWTFederationFilter.TOKEN_TYPE_JWT;
+ private static final String ACCESS_TOKEN_TYPE = JWTFederationFilter.TOKEN_TYPE_ACCESS_TOKEN;
+ private static final String SAML2_TYPE = "urn:ietf:params:oauth:token-type:saml2";
+
+ private RecordingFilter filter;
+ private TokenExchangeHandler handler;
+ private HttpServletResponse response;
+ private FilterChain chain;
+
+ @Before
+ public void setUp() {
+ filter = new RecordingFilter();
+ handler = new TokenExchangeHandler(filter);
+ response = EasyMock.createNiceMock(HttpServletResponse.class);
+ chain = EasyMock.createNiceMock(FilterChain.class);
+ EasyMock.replay(response, chain);
+ }
+
+ @Test
+ public void testSubjectTokenRequired() throws Exception {
+ handler.handle(request(null, JWT_TYPE, null, null), response, chain);
+ assertEquals(HttpServletResponse.SC_BAD_REQUEST, filter.errorStatus);
+ assertTrue(filter.errorMessage.contains("subject_token"));
+ assertFalse(filter.continued);
+ }
+
+ @Test
+ public void testSubjectTokenTypeRequired() throws Exception {
+ handler.handle(request("subtok", null, null, null), response, chain);
+ assertEquals(HttpServletResponse.SC_BAD_REQUEST, filter.errorStatus);
+ assertTrue(filter.errorMessage.contains("subject_token_type"));
+ assertFalse(filter.continued);
+ }
+
+ @Test
+ public void testActorTokenTypeRequiredWhenActorPresent() throws Exception {
+ filter.valid.put("subtok", jwt("alice", "KNOXSSO"));
+ handler.handle(request("subtok", JWT_TYPE, "acttok", null), response, chain);
+ assertEquals(HttpServletResponse.SC_BAD_REQUEST, filter.errorStatus);
+ assertTrue(filter.errorMessage.contains("actor_token_type is required"));
+ assertFalse(filter.continued);
+ }
+
+ @Test
+ public void testActorTokenTypeForbiddenWithoutActor() throws Exception {
+ handler.handle(request("subtok", JWT_TYPE, null, JWT_TYPE), response, chain);
+ assertEquals(HttpServletResponse.SC_BAD_REQUEST, filter.errorStatus);
+ assertTrue(filter.errorMessage.contains("must not be present"));
+ assertFalse(filter.continued);
+ }
+
+ @Test
+ public void testUnsupportedSubjectTokenType() throws Exception {
+ handler.handle(request("subtok", SAML2_TYPE, null, null), response, chain);
+ assertEquals(HttpServletResponse.SC_BAD_REQUEST, filter.errorStatus);
+ assertTrue(filter.errorMessage.contains("unsupported_token_type"));
+ assertFalse(filter.continued);
+ }
+
+ @Test
+ public void testUnsupportedActorTokenType() throws Exception {
+ filter.valid.put("subtok", jwt("alice", "KNOXSSO"));
+ handler.handle(request("subtok", JWT_TYPE, "acttok", SAML2_TYPE), response, chain);
+ assertEquals(HttpServletResponse.SC_BAD_REQUEST, filter.errorStatus);
+ assertTrue(filter.errorMessage.contains("unsupported_token_type"));
+ assertFalse(filter.continued);
+ }
+
+ @Test
+ public void testAccessTokenTypeIsAcceptedAsJwt() throws Exception {
+ filter.valid.put("subtok", jwt("alice", "KNOXSSO"));
+ handler.handle(request("subtok", ACCESS_TOKEN_TYPE, null, null), response, chain);
+ // access_token URN is accepted (no unsupported_token_type error) and the exchange proceeds
+ assertEquals(-1, filter.errorStatus);
+ assertTrue(filter.continued);
+ }
+
+ @Test
+ public void testSubjectOnlyExchangeEstablishesSubjectIdentity() throws Exception {
+ filter.valid.put("subtok", jwt("alice", "KNOXSSO"));
+ handler.handle(request("subtok", JWT_TYPE, null, null), response, chain);
+
+ assertTrue(filter.continued);
+ assertNotNull(filter.establishedSubject);
+ // Plain subject exchange: subject is the primary identity, no delegation principal
+ assertEquals("alice", primaryName(filter.establishedSubject));
+ assertTrue(filter.establishedSubject.getPrincipals(TokenExchangePrincipal.class).isEmpty());
+ }
+
+ @Test
+ public void testDelegationExchangeMakesActorPrimaryWithTokenExchangePrincipal() throws Exception {
+ filter.valid.put("subtok", jwt("alice", "KNOXSSO"));
+ filter.valid.put("acttok", jwt("svc-dataservice", "https://k8s"));
+ handler.handle(request("subtok", JWT_TYPE, "acttok", JWT_TYPE), response, chain);
+
+ assertTrue(filter.continued);
+ assertNotNull(filter.establishedSubject);
+ // OBO: the actor is the authenticated (primary) party ...
+ assertEquals("svc-dataservice", primaryName(filter.establishedSubject));
+ // ... and a TokenExchangePrincipal carries the subject/actor metadata
+ final TokenExchangePrincipal tep =
+ filter.establishedSubject.getPrincipals(TokenExchangePrincipal.class).iterator().next();
+ assertEquals("alice", tep.getSubjectPrincipalName());
+ assertEquals("svc-dataservice", tep.getActorPrincipalName());
+ }
+
+ @Test
+ public void testSubjectTokenWithActClaimCreatesActorChainPrincipal() throws Exception {
+ // subject_token already carries a prior delegation chain (an 'act' claim) ...
+ filter.valid.put("subtok", jwtWithActClaim("alice", "KNOXSSO", Map.of("sub", "prior-actor")));
+ filter.valid.put("acttok", jwt("svc-dataservice", "https://k8s"));
+ handler.handle(request("subtok", JWT_TYPE, "acttok", JWT_TYPE), response, chain);
+
+ assertTrue(filter.continued);
+ assertNotNull(filter.establishedSubject);
+ // ... which is preserved as an ActorChainPrincipal in the exchanged Subject
+ final Set actorChainPrincipals =
+ filter.establishedSubject.getPrincipals(ActorChainPrincipal.class);
+ assertFalse("ActorChainPrincipal should be present", actorChainPrincipals.isEmpty());
+ assertEquals("prior-actor", actorChainPrincipals.iterator().next().getCurrentActor());
+ }
+
+ @Test
+ public void testSubjectValidationFailureDoesNotEstablishContext() throws Exception {
+ // "subtok" is not in the valid map -> parseAndValidateJWT returns null (error already sent)
+ handler.handle(request("subtok", JWT_TYPE, null, null), response, chain);
+ assertFalse(filter.continued);
+ }
+
+ @Test
+ public void testActorValidationFailureDoesNotEstablishContext() throws Exception {
+ filter.valid.put("subtok", jwt("alice", "KNOXSSO"));
+ // "acttok" is not valid
+ handler.handle(request("subtok", JWT_TYPE, "acttok", JWT_TYPE), response, chain);
+ assertFalse(filter.continued);
+ }
+
+ private static String primaryName(Subject subject) {
+ return subject.getPrincipals(PrimaryPrincipal.class).iterator().next().getName();
+ }
+
+ private HttpServletRequest request(String subjectToken, String subjectTokenType,
+ String actorToken, String actorTokenType) {
+ final HttpServletRequest request = EasyMock.createNiceMock(HttpServletRequest.class);
+ EasyMock.expect(request.getParameter(JWTFederationFilter.SUBJECT_TOKEN)).andReturn(subjectToken).anyTimes();
+ EasyMock.expect(request.getParameter(JWTFederationFilter.SUBJECT_TOKEN_TYPE)).andReturn(subjectTokenType).anyTimes();
+ EasyMock.expect(request.getParameter(JWTFederationFilter.ACTOR_TOKEN)).andReturn(actorToken).anyTimes();
+ EasyMock.expect(request.getParameter(JWTFederationFilter.ACTOR_TOKEN_TYPE)).andReturn(actorTokenType).anyTimes();
+ EasyMock.replay(request);
+ return request;
+ }
+
+ private static JWT jwt(String subject, String issuer) {
+ final JWT jwt = EasyMock.createNiceMock(JWT.class);
+ EasyMock.expect(jwt.getSubject()).andReturn(subject).anyTimes();
+ EasyMock.expect(jwt.getIssuer()).andReturn(issuer).anyTimes();
+ // no actor chain in the token
+ EasyMock.expect(jwt.getClaimAsObject(EasyMock.anyString())).andReturn(null).anyTimes();
+ EasyMock.replay(jwt);
+ return jwt;
+ }
+
+ private static JWT jwtWithActClaim(String subject, String issuer, Map actClaim) {
+ final JWT jwt = EasyMock.createNiceMock(JWT.class);
+ EasyMock.expect(jwt.getSubject()).andReturn(subject).anyTimes();
+ EasyMock.expect(jwt.getIssuer()).andReturn(issuer).anyTimes();
+ // subject_token carries a prior delegation chain via its 'act' claim
+ EasyMock.expect(jwt.getClaimAsObject(JWTToken.ACT_CLAIM)).andReturn(actClaim).anyTimes();
+ EasyMock.replay(jwt);
+ return jwt;
+ }
+
+ /**
+ * A {@link JWTFederationFilter} whose validation and context-establishment callbacks are
+ * replaced with recording stubs, so the handler's own logic can be exercised in isolation.
+ */
+ private static final class RecordingFilter extends JWTFederationFilter {
+ private final Map valid = new HashMap<>();
+ private int errorStatus = -1;
+ private String errorMessage;
+ private boolean continued;
+ private Subject establishedSubject;
+
+ @Override
+ JWT parseAndValidateJWT(HttpServletRequest request, HttpServletResponse response,
+ FilterChain chain, String tokenValue)
+ throws ParseException, IOException, ServletException {
+ return valid.get(tokenValue);
+ }
+
+ @Override
+ protected Subject createSubjectFromToken(final JWT token) {
+ final Subject subject = new Subject();
+ subject.getPrincipals().add(new PrimaryPrincipal(token.getSubject()));
+ return subject;
+ }
+
+ @Override
+ protected void continueWithEstablishedSecurityContext(Subject subject, HttpServletRequest request,
+ HttpServletResponse response, FilterChain chain) {
+ this.continued = true;
+ this.establishedSubject = subject;
+ }
+
+ @Override
+ protected void handleValidationError(HttpServletRequest request, HttpServletResponse response,
+ int status, String error) {
+ this.errorStatus = status;
+ this.errorMessage = error == null ? "" : error;
+ }
+ }
+}
diff --git a/gateway-provider-security-shiro/pom.xml b/gateway-provider-security-shiro/pom.xml
index 8cce8d339b..ae07dbd4d8 100644
--- a/gateway-provider-security-shiro/pom.xml
+++ b/gateway-provider-security-shiro/pom.xml
@@ -67,6 +67,22 @@
org.apache.shiro
shiro-web
+
+ org.apache.shiro
+ shiro-cache
+
+
+ org.apache.shiro
+ shiro-crypto-core
+
+
+ org.apache.shiro
+ shiro-crypto-hash
+
+
+ org.apache.shiro
+ shiro-lang
+
org.ehcache
diff --git a/gateway-provider-security-shiro/src/main/java/org/apache/knox/gateway/filter/RedirectToUrlFilter.java b/gateway-provider-security-shiro/src/main/java/org/apache/knox/gateway/filter/RedirectToUrlFilter.java
index f0f14b365d..bffc5049af 100644
--- a/gateway-provider-security-shiro/src/main/java/org/apache/knox/gateway/filter/RedirectToUrlFilter.java
+++ b/gateway-provider-security-shiro/src/main/java/org/apache/knox/gateway/filter/RedirectToUrlFilter.java
@@ -27,6 +27,7 @@
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
+import org.apache.commons.lang3.StringUtils;
import org.apache.knox.gateway.config.GatewayConfig;
public class RedirectToUrlFilter extends AbstractGatewayFilter {
@@ -47,7 +48,9 @@ public void init(FilterConfig filterConfig) throws ServletException {
@Override
protected void doFilter(HttpServletRequest request, HttpServletResponse response, FilterChain chain) throws IOException, ServletException {
- if (redirectUrl != null && request.getHeader("Authorization") == null) {
+ // Treat a blank fedOpSid the same as absent: a bare "?fedOpSid=" must not suppress the redirect.
+ // (Downstream authentication still runs; this only prevents an empty param from skipping it.)
+ if (redirectUrl != null && request.getHeader("Authorization") == null && StringUtils.isBlank(request.getParameter("fedOpSid"))) {
response.sendRedirect(redirectUrl + getOriginalQueryString(request));
}
chain.doFilter(request, response);
diff --git a/gateway-provider-security-shiro/src/main/java/org/apache/knox/gateway/shirorealm/KnoxCacheManager.java b/gateway-provider-security-shiro/src/main/java/org/apache/knox/gateway/shirorealm/KnoxCacheManager.java
index 0d39fdf70c..7aee9d7068 100644
--- a/gateway-provider-security-shiro/src/main/java/org/apache/knox/gateway/shirorealm/KnoxCacheManager.java
+++ b/gateway-provider-security-shiro/src/main/java/org/apache/knox/gateway/shirorealm/KnoxCacheManager.java
@@ -20,12 +20,12 @@
import org.apache.knox.gateway.ShiroMessages;
import org.apache.knox.gateway.ehcache.EhcacheShiro;
import org.apache.knox.gateway.i18n.messages.MessagesFactory;
-import org.apache.shiro.ShiroException;
+import org.apache.shiro.lang.ShiroException;
import org.apache.shiro.cache.Cache;
import org.apache.shiro.cache.CacheException;
-import org.apache.shiro.io.ResourceUtils;
-import org.apache.shiro.util.Destroyable;
-import org.apache.shiro.util.Initializable;
+import org.apache.shiro.lang.io.ResourceUtils;
+import org.apache.shiro.lang.util.Destroyable;
+import org.apache.shiro.lang.util.Initializable;
import org.ehcache.CacheManager;
import org.ehcache.StateTransitionException;
import org.ehcache.Status;
diff --git a/gateway-provider-security-shiro/src/main/java/org/apache/knox/gateway/shirorealm/KnoxLdapRealm.java b/gateway-provider-security-shiro/src/main/java/org/apache/knox/gateway/shirorealm/KnoxLdapRealm.java
index 8b9f78d1a5..ff5c0956df 100644
--- a/gateway-provider-security-shiro/src/main/java/org/apache/knox/gateway/shirorealm/KnoxLdapRealm.java
+++ b/gateway-provider-security-shiro/src/main/java/org/apache/knox/gateway/shirorealm/KnoxLdapRealm.java
@@ -36,16 +36,15 @@
import org.apache.shiro.authc.credential.HashedCredentialsMatcher;
import org.apache.shiro.authz.AuthorizationInfo;
import org.apache.shiro.authz.SimpleAuthorizationInfo;
-import org.apache.shiro.crypto.hash.DefaultHashService;
-import org.apache.shiro.crypto.hash.Hash;
-import org.apache.shiro.crypto.hash.HashRequest;
-import org.apache.shiro.crypto.hash.HashService;
+import org.apache.shiro.crypto.SecureRandomNumberGenerator;
+import org.apache.shiro.crypto.hash.SimpleHash;
import org.apache.shiro.realm.ldap.DefaultLdapRealm;
import org.apache.shiro.realm.ldap.LdapContextFactory;
import org.apache.shiro.realm.ldap.LdapUtils;
import org.apache.shiro.subject.MutablePrincipalCollection;
import org.apache.shiro.subject.PrincipalCollection;
-import org.apache.shiro.util.StringUtils;
+import org.apache.shiro.lang.util.ByteSource;
+import org.apache.shiro.lang.util.StringUtils;
import javax.naming.AuthenticationException;
import javax.naming.Context;
@@ -61,6 +60,7 @@
import javax.naming.ldap.LdapName;
import javax.naming.ldap.PagedResultsControl;
import javax.naming.ldap.PagedResultsResponseControl;
+import javax.naming.ldap.Rdn;
import java.io.IOException;
import java.util.ArrayList;
import java.util.Collections;
@@ -151,6 +151,18 @@ public class KnoxLdapRealm extends DefaultLdapRealm {
private static final String HASHING_ALGORITHM = "SHA-256";
+ /*
+ * KNOX-3421: Shiro 2.x's DefaultHashService applies a large per-algorithm default
+ * iteration count (e.g. 50000 for SHA-256), whereas HashedCredentialsMatcher still
+ * defaults to a single iteration. To keep the credential round-trip consistent under
+ * the SHA-256 scheme, the stored hash is computed here with an explicit salt and this
+ * pinned iteration count, which matches the matcher configured in the constructor.
+ */
+ private static final int HASHING_ITERATIONS = 1;
+
+ /** How a substituted template value must be escaped for its target context. */
+ private enum EscapeMode { NONE, FILTER, DN }
+
static {
SUBTREE_SCOPE.setSearchScope(SearchControls.SUBTREE_SCOPE);
ONELEVEL_SCOPE.setSearchScope(SearchControls.ONELEVEL_SCOPE);
@@ -186,10 +198,9 @@ public class KnoxLdapRealm extends DefaultLdapRealm {
private String userSearchAttributeName;
private String userObjectClass = "person";
- private HashService hashService = new DefaultHashService();
-
public KnoxLdapRealm() {
HashedCredentialsMatcher credentialsMatcher = new HashedCredentialsMatcher(HASHING_ALGORITHM);
+ credentialsMatcher.setHashIterations(HASHING_ITERATIONS);
setCredentialsMatcher(credentialsMatcher);
}
@@ -258,7 +269,7 @@ private Set rolesFor(PrincipalCollection principals, final String userNa
String userDn;
if (userSearchAttributeName == null || userSearchAttributeName.isEmpty()) {
// memberAttributeValuePrefix and memberAttributeValueSuffix were computed from memberAttributeValueTemplate
- userDn = memberAttributeValuePrefix + userName + memberAttributeValueSuffix;
+ userDn = memberAttributeValuePrefix + escapeDnValue(userName) + memberAttributeValueSuffix;
} else {
userDn = getUserDn(userName);
}
@@ -684,13 +695,19 @@ protected String getUserDn( final String principal ) throws IllegalArgumentExcep
( userSearchAttributeName == null &&
userSearchFilter == null &&
!"object".equalsIgnoreCase( userSearchScope ) ) ) {
- userDn = expandTemplate( userDnTemplate, matchedPrincipal );
+ // When the template is exactly "{0}" the principal IS the full DN (e.g. a system
+ // bind DN), so DN-escaping it would corrupt the DN and break the bind. Escaping is
+ // only needed when the placeholder is embedded within surrounding DN structure
+ // (e.g. "uid={0},ou=people,..."), where the principal is a single RDN value that
+ // could otherwise inject additional RDNs.
+ final EscapeMode escapeMode = "{0}".equals( userDnTemplate.trim() ) ? EscapeMode.NONE : EscapeMode.DN;
+ userDn = expandTemplate( userDnTemplate, matchedPrincipal, escapeMode );
LOG.computedUserDn( userDn, principal );
return userDn;
}
// Create the searchBase and searchFilter from config.
- String searchBase = expandTemplate( getUserSearchBase(), matchedPrincipal );
+ String searchBase = expandTemplate( getUserSearchBase(), matchedPrincipal, EscapeMode.DN );
String searchFilter;
if ( userSearchFilter == null ) {
if ( userSearchAttributeName == null ) {
@@ -700,10 +717,10 @@ protected String getUserDn( final String principal ) throws IllegalArgumentExcep
"(&(objectclass=%1$s)(%2$s=%3$s))",
getUserObjectClass(),
userSearchAttributeName,
- expandTemplate( getUserSearchAttributeTemplate(), matchedPrincipal ) );
+ expandTemplate(getUserSearchAttributeTemplate(), matchedPrincipal, EscapeMode.FILTER));
}
} else {
- searchFilter = expandTemplate( userSearchFilter, matchedPrincipal );
+ searchFilter = expandTemplate(userSearchFilter, matchedPrincipal, EscapeMode.FILTER);
}
SearchControls searchControls = getUserSearchControls();
@@ -744,22 +761,75 @@ protected String getUserDn( final String principal ) throws IllegalArgumentExcep
@Override
protected AuthenticationInfo createAuthenticationInfo(AuthenticationToken token, Object ldapPrincipal, Object ldapCredentials, LdapContext ldapContext) throws NamingException {
- HashRequest.Builder builder = new HashRequest.Builder();
- Hash credentialsHash = hashService.computeHash(builder.setSource(token.getCredentials()).setAlgorithmName(HASHING_ALGORITHM).build());
- return new SimpleAuthenticationInfo(token.getPrincipal(), credentialsHash.toHex(), credentialsHash.getSalt(), getName());
+ final ByteSource credentialsSalt = new SecureRandomNumberGenerator().nextBytes();
+ final SimpleHash credentialsHash = new SimpleHash(HASHING_ALGORITHM, token.getCredentials(), credentialsSalt, HASHING_ITERATIONS);
+ return new SimpleAuthenticationInfo(token.getPrincipal(), credentialsHash.toHex(), credentialsSalt, getName());
}
- private static String expandTemplate( final String template, final Matcher input ) {
+ private static String expandTemplate( final String template, final Matcher input, final EscapeMode escapeMode ) {
String output = template;
Matcher matcher = TEMPLATE_PATTERN.matcher( output );
while( matcher.find() ) {
String lookupStr = matcher.group( 1 );
int lookupIndex = Integer.parseInt( lookupStr );
String lookupValue = input.group( lookupIndex );
- output = matcher.replaceFirst( lookupValue == null ? "" : lookupValue );
+ if (lookupValue == null) {
+ lookupValue = "";
+ } else if (escapeMode == EscapeMode.FILTER) {
+ lookupValue = escapeLdapSearchFilterValue(lookupValue);
+ } else if (escapeMode == EscapeMode.DN) {
+ lookupValue = escapeDnValue(lookupValue);
+ }
+ // A substituted value that itself contains a template token (e.g. a username of
+ // "{0}") would be re-matched on the next scan and expand forever. No legitimate
+ // principal contains a "{}" token, so reject it rather than loop.
+ if (TEMPLATE_PATTERN.matcher(lookupValue).find()) {
+ throw new IllegalArgumentException("Illegal template placeholder in substituted value");
+ }
+ // quoteReplacement is required: replaceFirst treats '\' and '$' in the replacement specially
+ output = matcher.replaceFirst(Matcher.quoteReplacement(lookupValue));
matcher = TEMPLATE_PATTERN.matcher( output );
}
return output;
}
+ private static String escapeLdapSearchFilterValue(final String value) {
+ if (value == null) {
+ return null;
+ }
+ final StringBuilder sb = new StringBuilder(value.length());
+ for (int i = 0; i < value.length(); i++) {
+ final char c = value.charAt(i);
+ switch (c) {
+ case '\\':
+ sb.append("\\5c");
+ break;
+ case '*':
+ sb.append("\\2a");
+ break;
+ case '(':
+ sb.append("\\28");
+ break;
+ case ')':
+ sb.append("\\29");
+ break;
+ case '\0':
+ sb.append("\\00");
+ break;
+ default:
+ sb.append(c);
+ }
+ }
+ return sb.toString();
+ }
+
+ // RFC 4514 DN-value escaping (escapes ',', '=', '+', '"', '\\', '<', '>', ';',
+ // leading/trailing space, and a leading '#'), preventing DN injection.
+ static String escapeDnValue(final String value) {
+ if (value == null) {
+ return null;
+ }
+ return Rdn.escapeValue(value);
+ }
+
}
diff --git a/gateway-provider-security-shiro/src/main/java/org/apache/knox/gateway/shirorealm/KnoxPamRealm.java b/gateway-provider-security-shiro/src/main/java/org/apache/knox/gateway/shirorealm/KnoxPamRealm.java
index a0c17ecb9d..623f90d5f1 100644
--- a/gateway-provider-security-shiro/src/main/java/org/apache/knox/gateway/shirorealm/KnoxPamRealm.java
+++ b/gateway-provider-security-shiro/src/main/java/org/apache/knox/gateway/shirorealm/KnoxPamRealm.java
@@ -39,10 +39,9 @@
import org.apache.shiro.authc.UsernamePasswordToken;
import org.apache.shiro.authz.AuthorizationInfo;
import org.apache.shiro.authz.SimpleAuthorizationInfo;
-import org.apache.shiro.crypto.hash.DefaultHashService;
-import org.apache.shiro.crypto.hash.Hash;
-import org.apache.shiro.crypto.hash.HashRequest;
-import org.apache.shiro.crypto.hash.HashService;
+import org.apache.shiro.crypto.SecureRandomNumberGenerator;
+import org.apache.shiro.crypto.hash.SimpleHash;
+import org.apache.shiro.lang.util.ByteSource;
import org.apache.shiro.realm.AuthorizingRealm;
import org.apache.shiro.subject.PrincipalCollection;
import org.apache.shiro.authc.credential.HashedCredentialsMatcher;
@@ -82,6 +81,14 @@
*/
public class KnoxPamRealm extends AuthorizingRealm {
private static final String HASHING_ALGORITHM = "SHA-256";
+ /*
+ * KNOX-3421: Shiro 2.x's DefaultHashService applies a large per-algorithm default
+ * iteration count (e.g. 50000 for SHA-256), whereas HashedCredentialsMatcher still
+ * defaults to a single iteration. To keep the credential round-trip consistent under
+ * the SHA-256 scheme, the stored hash is computed here with an explicit salt and this
+ * pinned iteration count, which matches the matcher configured in the constructor.
+ */
+ private static final int HASHING_ITERATIONS = 1;
private static final String SUBJECT_USER_ROLES = "subject.userRoles";
private static final String SUBJECT_USER_GROUPS = "subject.userGroups";
@@ -89,7 +96,6 @@ public class KnoxPamRealm extends AuthorizingRealm {
private static final Auditor auditor = auditService.getAuditor(AuditConstants.DEFAULT_AUDITOR_NAME,
AuditConstants.KNOX_SERVICE_NAME, AuditConstants.KNOX_COMPONENT_NAME);
- private final HashService hashService = new DefaultHashService();
private final KnoxShiroMessages shiroLog = MessagesFactory.get(KnoxShiroMessages.class);
private final GatewayMessages gatewayLog = MessagesFactory.get(GatewayMessages.class);
@@ -97,6 +103,7 @@ public class KnoxPamRealm extends AuthorizingRealm {
public KnoxPamRealm() {
HashedCredentialsMatcher credentialsMatcher = new HashedCredentialsMatcher(HASHING_ALGORITHM);
+ credentialsMatcher.setHashIterations(HASHING_ITERATIONS);
setCredentialsMatcher(credentialsMatcher);
}
@@ -147,18 +154,13 @@ protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken token)
}
}
- HashRequest hashRequest = new HashRequest.Builder()
- .setSource(token.getCredentials())
- .setAlgorithmName(HASHING_ALGORITHM)
- .build();
- Hash credentialsHash = hashService.computeHash(hashRequest);
+ return createAuthenticationInfo(token, new UnixUserPrincipal(user));
+ }
- /* Coverity Scan CID 1361684 */
- if (credentialsHash == null) {
- handleAuthFailure(token, "Failed to compute hash", null);
- }
- return new SimpleAuthenticationInfo(new UnixUserPrincipal(user), credentialsHash.toHex(),
- credentialsHash.getSalt(), getName());
+ protected AuthenticationInfo createAuthenticationInfo(AuthenticationToken token, Object principal) {
+ final ByteSource credentialsSalt = new SecureRandomNumberGenerator().nextBytes();
+ final SimpleHash credentialsHash = new SimpleHash(HASHING_ALGORITHM, token.getCredentials(), credentialsSalt, HASHING_ITERATIONS);
+ return new SimpleAuthenticationInfo(principal, credentialsHash.toHex(), credentialsSalt, getName());
}
private void handleAuthFailure(AuthenticationToken token, String errorMessage, Exception e) {
diff --git a/gateway-provider-security-shiro/src/test/java/org/apache/knox/gateway/shirorealm/KnoxLdapRealmDnEscapingTest.java b/gateway-provider-security-shiro/src/test/java/org/apache/knox/gateway/shirorealm/KnoxLdapRealmDnEscapingTest.java
new file mode 100644
index 0000000000..e8270367af
--- /dev/null
+++ b/gateway-provider-security-shiro/src/test/java/org/apache/knox/gateway/shirorealm/KnoxLdapRealmDnEscapingTest.java
@@ -0,0 +1,70 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+package org.apache.knox.gateway.shirorealm;
+
+import org.junit.Test;
+
+import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertNull;
+
+public class KnoxLdapRealmDnEscapingTest {
+
+ // ---- escapeDnValue: the helper used at BOTH DN-construction sites ----
+
+ @Test
+ public void plainValueIsUnchanged() {
+ assertEquals("guest", KnoxLdapRealm.escapeDnValue("guest"));
+ }
+
+ @Test
+ public void dnMetacharactersAreEscaped() {
+ // ',' and '=' must be escaped so the value cannot add or alter RDNs
+ assertEquals("guest\\,ou\\=admin", KnoxLdapRealm.escapeDnValue("guest,ou=admin"));
+ }
+
+ @Test
+ public void plusAndQuoteAreEscaped() {
+ assertEquals("a\\+b\\\"c", KnoxLdapRealm.escapeDnValue("a+b\"c"));
+ }
+
+ @Test
+ public void nullIsNullSafe() {
+ assertNull(KnoxLdapRealm.escapeDnValue(null));
+ }
+
+ // ---- getUserDn: proves the userDnTemplate ({0}) expansion escapes as a DN ----
+
+ @Test
+ public void userDnTemplatePlainPrincipalUnchanged() {
+ KnoxLdapRealm realm = new KnoxLdapRealm();
+ realm.setUserDnTemplate("uid={0},ou=people,dc=hadoop,dc=apache,dc=org");
+ assertEquals("uid=guest,ou=people,dc=hadoop,dc=apache,dc=org",
+ realm.getUserDn("guest"));
+ }
+
+ @Test
+ public void userDnTemplateInjectionIsEscaped() {
+ KnoxLdapRealm realm = new KnoxLdapRealm();
+ realm.setUserDnTemplate("uid={0},ou=people,dc=hadoop,dc=apache,dc=org");
+ // Without escaping this would inject an extra RDN and rewrite the bind DN.
+ assertEquals("uid=guest\\,ou\\=admin,ou=people,dc=hadoop,dc=apache,dc=org",
+ realm.getUserDn("guest,ou=admin"));
+ }
+}
diff --git a/gateway-provider-security-shiro/src/test/java/org/apache/knox/gateway/shirorealm/KnoxLdapRealmHashRoundTripTest.java b/gateway-provider-security-shiro/src/test/java/org/apache/knox/gateway/shirorealm/KnoxLdapRealmHashRoundTripTest.java
new file mode 100644
index 0000000000..33f5c198dd
--- /dev/null
+++ b/gateway-provider-security-shiro/src/test/java/org/apache/knox/gateway/shirorealm/KnoxLdapRealmHashRoundTripTest.java
@@ -0,0 +1,63 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+package org.apache.knox.gateway.shirorealm;
+
+import org.apache.shiro.authc.AuthenticationInfo;
+import org.apache.shiro.authc.AuthenticationToken;
+import org.apache.shiro.authc.UsernamePasswordToken;
+import org.apache.shiro.authc.credential.CredentialsMatcher;
+import org.junit.Test;
+
+import javax.naming.ldap.LdapContext;
+
+import static org.junit.Assert.assertFalse;
+import static org.junit.Assert.assertTrue;
+
+public class KnoxLdapRealmHashRoundTripTest {
+
+ /** Exposes the protected createAuthenticationInfo for testing. */
+ private static class TestableRealm extends KnoxLdapRealm {
+ AuthenticationInfo build(AuthenticationToken token) throws Exception {
+ return createAuthenticationInfo(token, token.getPrincipal(), token.getCredentials(), (LdapContext) null);
+ }
+ }
+
+ @Test
+ public void correctPasswordMatchesUnderShiro221() throws Exception {
+ TestableRealm realm = new TestableRealm();
+ UsernamePasswordToken stored = new UsernamePasswordToken("alice", "s3cr3t");
+ AuthenticationInfo info = realm.build(stored);
+
+ CredentialsMatcher matcher = realm.getCredentialsMatcher();
+ UsernamePasswordToken submittedGood = new UsernamePasswordToken("alice", "s3cr3t");
+ assertTrue("correct password must match", matcher.doCredentialsMatch(submittedGood, info));
+ }
+
+ @Test
+ public void wrongPasswordIsRejectedUnderShiro221() throws Exception {
+ TestableRealm realm = new TestableRealm();
+ UsernamePasswordToken stored = new UsernamePasswordToken("alice", "s3cr3t");
+ AuthenticationInfo info = realm.build(stored);
+
+ CredentialsMatcher matcher = realm.getCredentialsMatcher();
+ UsernamePasswordToken submittedBad = new UsernamePasswordToken("alice", "wrong");
+ assertFalse("wrong password must not match", matcher.doCredentialsMatch(submittedBad, info));
+ }
+}
diff --git a/gateway-provider-security-shiro/src/test/java/org/apache/knox/gateway/shirorealm/KnoxLdapRealmTest.java b/gateway-provider-security-shiro/src/test/java/org/apache/knox/gateway/shirorealm/KnoxLdapRealmTest.java
index d26bdbbe00..18e45bed03 100644
--- a/gateway-provider-security-shiro/src/test/java/org/apache/knox/gateway/shirorealm/KnoxLdapRealmTest.java
+++ b/gateway-provider-security-shiro/src/test/java/org/apache/knox/gateway/shirorealm/KnoxLdapRealmTest.java
@@ -19,13 +19,136 @@
package org.apache.knox.gateway.shirorealm;
+import org.apache.shiro.realm.ldap.LdapContextFactory;
+import org.easymock.Capture;
+import org.easymock.EasyMock;
import org.junit.Test;
+import javax.naming.NamingEnumeration;
+import javax.naming.directory.SearchControls;
+import javax.naming.directory.SearchResult;
+import javax.naming.ldap.LdapContext;
+
import static org.junit.Assert.assertEquals;
import static org.junit.Assert.assertNull;
public class KnoxLdapRealmTest {
+ private static String captureSearchFilter(KnoxLdapRealm realm, String principal) throws Exception {
+ LdapContextFactory factory = EasyMock.createNiceMock(LdapContextFactory.class);
+ LdapContext ctx = EasyMock.createNiceMock(LdapContext.class);
+ NamingEnumeration results = EasyMock.createNiceMock(NamingEnumeration.class);
+
+ EasyMock.expect(factory.getSystemLdapContext()).andReturn(ctx).anyTimes();
+ Capture filter = EasyMock.newCapture();
+ EasyMock.expect(ctx.search(EasyMock.anyString(), EasyMock.capture(filter),
+ EasyMock.anyObject(SearchControls.class))).andReturn(results);
+ EasyMock.expect(results.hasMore()).andReturn(false).anyTimes();
+ EasyMock.replay(factory, ctx, results);
+
+ realm.setContextFactory(factory);
+ try {
+ realm.getUserDn(principal);
+ } catch (IllegalArgumentException expected) {
+ // mock returns no entry, so getUserDn throws after the search; we only need the filter
+ }
+ return filter.getValue();
+ }
+
+ private static String captureSearchBase(KnoxLdapRealm realm, String principal) throws Exception {
+ LdapContextFactory factory = EasyMock.createNiceMock(LdapContextFactory.class);
+ LdapContext ctx = EasyMock.createNiceMock(LdapContext.class);
+ NamingEnumeration results = EasyMock.createNiceMock(NamingEnumeration.class);
+
+ EasyMock.expect(factory.getSystemLdapContext()).andReturn(ctx).anyTimes();
+ Capture base = EasyMock.newCapture();
+ EasyMock.expect(ctx.search(EasyMock.capture(base), EasyMock.anyString(),
+ EasyMock.anyObject(SearchControls.class))).andReturn(results);
+ EasyMock.expect(results.hasMore()).andReturn(false).anyTimes();
+ EasyMock.replay(factory, ctx, results);
+
+ realm.setContextFactory(factory);
+ try {
+ realm.getUserDn(principal);
+ } catch (IllegalArgumentException expected) {
+ // mock returns no entry, so getUserDn throws after the search; we only need the base
+ }
+ return base.getValue();
+ }
+
+ private static KnoxLdapRealm searchModeRealm() {
+ KnoxLdapRealm realm = new KnoxLdapRealm();
+ realm.setSearchBase("dc=hadoop,dc=apache,dc=org");
+ realm.setUserSearchBase("ou=people,dc=hadoop,dc=apache,dc=org");
+ realm.setUserSearchAttributeName("uid");
+ realm.setUserObjectClass("person");
+ return realm;
+ }
+
+ @Test
+ public void getUserDnEscapesLdapFilterMetacharacters() throws Exception {
+ String filter = captureSearchFilter(searchModeRealm(), "*)(uid=admin");
+ assertEquals("(&(objectclass=person)(uid=\\2a\\29\\28uid=admin))", filter);
+ }
+
+ @Test
+ public void getUserDnEscapesWildcard() throws Exception {
+ String filter = captureSearchFilter(searchModeRealm(), "*");
+ assertEquals("(&(objectclass=person)(uid=\\2a))", filter);
+ }
+
+ @Test
+ public void getUserDnEscapesBackslash() throws Exception {
+ String filter = captureSearchFilter(searchModeRealm(), "a\\b");
+ assertEquals("(&(objectclass=person)(uid=a\\5cb))", filter);
+ }
+
+ @Test
+ public void getUserDnLeavesLegitimateUsernameUnchanged() throws Exception {
+ String filter = captureSearchFilter(searchModeRealm(), "sam");
+ assertEquals("(&(objectclass=person)(uid=sam))", filter);
+ }
+
+ @Test
+ public void getUserDnEscapesValueButPreservesOperatorFilterStructure() throws Exception {
+ KnoxLdapRealm realm = searchModeRealm();
+ realm.setUserSearchFilter("(uid={0})");
+ String filter = captureSearchFilter(realm, "a)(b");
+ assertEquals("(uid=a\\29\\28b)", filter);
+ }
+
+ @Test
+ public void getUserDnEscapesSearchBaseTemplateValue() throws Exception {
+ KnoxLdapRealm realm = searchModeRealm();
+ // A userSearchBase that substitutes the raw principal into the base DN.
+ realm.setUserSearchBase("ou={0},dc=hadoop,dc=apache,dc=org");
+ // Injection metacharacters in the username must be DN-escaped so they
+ // cannot add or rewrite RDNs in the search base.
+ String base = captureSearchBase(realm, "people,dc=evil");
+ assertEquals("ou=people\\,dc\\=evil,dc=hadoop,dc=apache,dc=org", base);
+ }
+
+ @Test
+ public void getUserDnWithDefaultTemplateReturnsFullDnUnescaped() {
+ // The default userDnTemplate is "{0}", meaning the principal IS the complete bind DN
+ // (the system-bind case, e.g. KnoxCLI system-user-auth-test). DN-escaping would turn
+ // the ','/'=' separators into '\,'/'\=' and corrupt the DN, so this template must pass
+ // the principal through unescaped. Embedded templates ("uid={0},...") still escape.
+ KnoxLdapRealm realm = new KnoxLdapRealm();
+ String dn = realm.getUserDn("uid=guest,ou=people,dc=hadoop,dc=apache,dc=org");
+ assertEquals("uid=guest,ou=people,dc=hadoop,dc=apache,dc=org", dn);
+ }
+
+ @Test(timeout = 5000, expected = IllegalArgumentException.class)
+ public void getUserDnRejectsTemplatePlaceholderAsUsername() {
+ // A username of "{0}" substituted into a template would re-introduce a "{0}" token
+ // and loop forever. It must be rejected (auth failure), not expanded. The timeout
+ // guards against regression of the infinite loop.
+ KnoxLdapRealm realm = new KnoxLdapRealm();
+ realm.setUserDnTemplate("uid={0},ou=people,dc=hadoop,dc=apache,dc=org");
+ realm.getUserDn("{0}");
+ }
+
@Test
public void setGetSearchBase() {
KnoxLdapRealm realm = new KnoxLdapRealm();
diff --git a/gateway-provider-security-shiro/src/test/java/org/apache/knox/gateway/shirorealm/KnoxPamRealmHashRoundTripTest.java b/gateway-provider-security-shiro/src/test/java/org/apache/knox/gateway/shirorealm/KnoxPamRealmHashRoundTripTest.java
new file mode 100644
index 0000000000..73e32277c4
--- /dev/null
+++ b/gateway-provider-security-shiro/src/test/java/org/apache/knox/gateway/shirorealm/KnoxPamRealmHashRoundTripTest.java
@@ -0,0 +1,61 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+package org.apache.knox.gateway.shirorealm;
+
+import org.apache.shiro.authc.AuthenticationInfo;
+import org.apache.shiro.authc.AuthenticationToken;
+import org.apache.shiro.authc.UsernamePasswordToken;
+import org.apache.shiro.authc.credential.CredentialsMatcher;
+import org.junit.Test;
+
+import static org.junit.Assert.assertFalse;
+import static org.junit.Assert.assertTrue;
+
+public class KnoxPamRealmHashRoundTripTest {
+
+ /** Exposes the protected createAuthenticationInfo for testing. */
+ private static class TestableRealm extends KnoxPamRealm {
+ AuthenticationInfo build(AuthenticationToken token) {
+ return createAuthenticationInfo(token, token.getPrincipal());
+ }
+ }
+
+ @Test
+ public void correctPasswordMatchesUnderShiro221() {
+ TestableRealm realm = new TestableRealm();
+ UsernamePasswordToken stored = new UsernamePasswordToken("alice", "s3cr3t");
+ AuthenticationInfo info = realm.build(stored);
+
+ CredentialsMatcher matcher = realm.getCredentialsMatcher();
+ UsernamePasswordToken submittedGood = new UsernamePasswordToken("alice", "s3cr3t");
+ assertTrue("correct password must match", matcher.doCredentialsMatch(submittedGood, info));
+ }
+
+ @Test
+ public void wrongPasswordIsRejectedUnderShiro221() {
+ TestableRealm realm = new TestableRealm();
+ UsernamePasswordToken stored = new UsernamePasswordToken("alice", "s3cr3t");
+ AuthenticationInfo info = realm.build(stored);
+
+ CredentialsMatcher matcher = realm.getCredentialsMatcher();
+ UsernamePasswordToken submittedBad = new UsernamePasswordToken("alice", "wrong");
+ assertFalse("wrong password must not match", matcher.doCredentialsMatch(submittedBad, info));
+ }
+}
diff --git a/gateway-release/home/conf/topologies/knoxsso.xml b/gateway-release/home/conf/topologies/knoxsso.xml
index 99600f8746..cfee258c34 100644
--- a/gateway-release/home/conf/topologies/knoxsso.xml
+++ b/gateway-release/home/conf/topologies/knoxsso.xml
@@ -73,6 +73,10 @@
main.ldapRealm.contextFactory.authenticationMechanism
simple
+
+ urls./api/v1/websso/federated/op
+ anon
+
urls./**
authcBasic
diff --git a/gateway-release/home/conf/users.ldif b/gateway-release/home/conf/users.ldif
index 4f1c6a9552..999f824034 100644
--- a/gateway-release/home/conf/users.ldif
+++ b/gateway-release/home/conf/users.ldif
@@ -39,7 +39,9 @@ objectclass:organizationalPerson
objectclass:inetOrgPerson
cn: Guest
sn: User
+givenName: Guest
uid: guest
+mail: guest@example.org
userPassword:guest-password
# entry for sample user admin
@@ -48,9 +50,11 @@ objectclass:top
objectclass:person
objectclass:organizationalPerson
objectclass:inetOrgPerson
-cn: Admin
-sn: Admin
+cn: System Administrator
+sn: Administrator
+givenName: System
uid: admin
+mail: admin@example.org
userPassword:admin-password
# entry for sample user sam
@@ -59,9 +63,11 @@ objectclass:top
objectclass:person
objectclass:organizationalPerson
objectclass:inetOrgPerson
-cn: sam
-sn: sam
+cn: Sam Peterson
+sn: Peterson
+givenName: Sam
uid: sam
+mail: sam@example.org
userPassword:sam-password
# entry for sample user tom
@@ -70,9 +76,11 @@ objectclass:top
objectclass:person
objectclass:organizationalPerson
objectclass:inetOrgPerson
-cn: tom
-sn: tom
+cn: Tom Richards
+sn: Richards
+givenName: Tom
uid: tom
+mail: tom@example.org
userPassword:tom-password
# create FIRST Level groups branch
diff --git a/gateway-release/pom.xml b/gateway-release/pom.xml
index 7df1c6c224..00566f9d78 100644
--- a/gateway-release/pom.xml
+++ b/gateway-release/pom.xml
@@ -524,5 +524,9 @@
org.apache.knox
gateway-service-restcatalog
+
+ org.apache.knox
+ gateway-service-knoxidf
+
diff --git a/gateway-server/pom.xml b/gateway-server/pom.xml
index 3ddfb07ab8..5fc869f205 100644
--- a/gateway-server/pom.xml
+++ b/gateway-server/pom.xml
@@ -208,6 +208,14 @@
org.apache.shiro
shiro-web
+
+ org.apache.shiro
+ shiro-config-core
+
+
+ org.apache.shiro
+ shiro-lang
+
commons-beanutils
@@ -417,6 +425,10 @@
com.nimbusds
nimbus-jose-jwt
+
+ com.nimbusds
+ oauth2-oidc-sdk
+
org.apache.knox
diff --git a/gateway-server/src/main/java/org/apache/knox/gateway/GatewayMessages.java b/gateway-server/src/main/java/org/apache/knox/gateway/GatewayMessages.java
index d4639b0114..a71fbf5b3b 100644
--- a/gateway-server/src/main/java/org/apache/knox/gateway/GatewayMessages.java
+++ b/gateway-server/src/main/java/org/apache/knox/gateway/GatewayMessages.java
@@ -738,6 +738,12 @@ void errorRespondingToConfigChange(String source,
@Message(level = MessageLevel.ERROR, text = "Error while initializing {0}: {1}")
void errorInitializingService(String implementation, String error, @StackTrace(level = MessageLevel.DEBUG) Exception e);
+ @Message(level = MessageLevel.DEBUG, text = "Failed to list topology directory {0} while detecting KnoxIDF: {1}")
+ void failedToListTopologyDirForKnoxIdfDetection(String topologyDir, String error, @StackTrace(level = MessageLevel.DEBUG) Exception e);
+
+ @Message(level = MessageLevel.DEBUG, text = "Failed to read topology file {0} while detecting KnoxIDF: {1}")
+ void failedToReadTopologyFileForKnoxIdfDetection(String topologyFile, String error, @StackTrace(level = MessageLevel.DEBUG) Exception e);
+
@Message(level = MessageLevel.ERROR,
text = "Unable to complete service discovery for cluster {0} topology = {1}.")
void failedToDiscoverClusterServices(String clusterName, String topologyName,
diff --git a/gateway-server/src/main/java/org/apache/knox/gateway/UrlEncodedFormRequest.java b/gateway-server/src/main/java/org/apache/knox/gateway/UrlEncodedFormRequest.java
index 2e2482aa1d..139e51862b 100644
--- a/gateway-server/src/main/java/org/apache/knox/gateway/UrlEncodedFormRequest.java
+++ b/gateway-server/src/main/java/org/apache/knox/gateway/UrlEncodedFormRequest.java
@@ -17,17 +17,17 @@
*/
package org.apache.knox.gateway;
+import org.apache.knox.gateway.i18n.messages.MessagesFactory;
+import org.eclipse.jetty.util.MultiMap;
+import org.eclipse.jetty.util.UrlEncoded;
+
+import javax.servlet.ServletRequest;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletRequestWrapper;
import java.io.IOException;
import java.util.Enumeration;
import java.util.Iterator;
import java.util.Map;
-import javax.servlet.ServletRequest;
-import javax.servlet.http.HttpServletRequest;
-import javax.servlet.http.HttpServletRequestWrapper;
-
-import org.apache.knox.gateway.i18n.messages.MessagesFactory;
-import org.eclipse.jetty.util.MultiMap;
-import org.eclipse.jetty.util.UrlEncoded;
/**
* HttpServletRequest
diff --git a/gateway-server/src/main/java/org/apache/knox/gateway/config/impl/GatewayConfigImpl.java b/gateway-server/src/main/java/org/apache/knox/gateway/config/impl/GatewayConfigImpl.java
index 061518537d..56ea2d8169 100644
--- a/gateway-server/src/main/java/org/apache/knox/gateway/config/impl/GatewayConfigImpl.java
+++ b/gateway-server/src/main/java/org/apache/knox/gateway/config/impl/GatewayConfigImpl.java
@@ -392,6 +392,13 @@ public class GatewayConfigImpl extends Configuration implements GatewayConfig {
public static final String STRICT_TRANSPORT_ENABLED = GATEWAY_CONFIG_FILE_PREFIX + ".strict.transport.enabled";
public static final String STRICT_TRANSPORT_OPTION = GATEWAY_CONFIG_FILE_PREFIX + ".strict.transport.option";
+ // Gateway LDAP Properties
+ public static final int DEFAULT_LDAP_PORT = 3890;
+ public static final String DEFAULT_LDAP_BASE_DN = "dc=proxy,dc=com";
+ public static final int DEFAULT_LDAP_MAX_SIZE_LIMIT = 1000;
+ /* The default max time for LDAP search in milliseconds */
+ public static final int DEFAULT_LDAP_MAX_TIME_LIMIT = 60 * 1000;
+
public GatewayConfigImpl() {
init();
}
@@ -1010,6 +1017,25 @@ public String getSigningKeyPassphraseAlias() {
}
}
+ @Override
+ public List getSigningKeyAliases() {
+ final List aliases = new ArrayList<>();
+ final String current = getSigningKeyAlias();
+ if (current != null) {
+ aliases.add(current);
+ }
+ final String additional = get(SIGNING_KEY_ALIASES_ADDITIONAL);
+ if (additional != null && !additional.trim().isEmpty() && !"none".equalsIgnoreCase(additional.trim())) {
+ for (String alias : additional.trim().split("\\s*,\\s*")) {
+ // Skip blanks and de-duplicate so the current key is never published/checked twice.
+ if (!alias.isEmpty() && !aliases.contains(alias)) {
+ aliases.add(alias);
+ }
+ }
+ }
+ return aliases;
+ }
+
@Override
public List getGlobalRulesServices() {
String value = get( GLOBAL_RULES_SERVICES );
@@ -1775,17 +1801,17 @@ public String getStrictTransportOption() {
// LDAP Service Configuration
@Override
public boolean isLDAPEnabled() {
- return Boolean.parseBoolean(get(LDAP_ENABLED, "false"));
+ return getBoolean(LDAP_ENABLED, false);
}
@Override
public int getLDAPPort() {
- return Integer.parseInt(get(LDAP_PORT, "3890"));
+ return getInt(LDAP_PORT, DEFAULT_LDAP_PORT);
}
@Override
public String getLDAPBaseDN() {
- return get(LDAP_BASE_DN, "dc=proxy,dc=com");
+ return get(LDAP_BASE_DN, DEFAULT_LDAP_BASE_DN);
}
@Override
@@ -1840,7 +1866,7 @@ public Map getLDAPInterceptorConfig(String interceptorName) {
@Override
public boolean isLDAPRecursiveGroupResolutionEnabled() {
- return Boolean.parseBoolean(get(LDAP_RECURSIVE_GROUP_RESOLUTION, "false"));
+ return getBoolean(LDAP_RECURSIVE_GROUP_RESOLUTION, false);
}
@Override
@@ -1865,7 +1891,7 @@ public String getLdapRolesLookupFilePath() {
@Override
public boolean isLDAPSSLEnabled() {
- return Boolean.parseBoolean(get(LDAP_SSL_ENABLED, "false"));
+ return getBoolean(LDAP_SSL_ENABLED, false);
}
@Override
@@ -1884,8 +1910,48 @@ public List getLDAPSSLEnabledCipherSuites() {
return cipherSuites == null ? Collections.emptyList() : cipherSuites;
}
+ @Override
+ public int getLDAPMaxSizeLimit() {
+ return getInt(LDAP_MAX_SIZE_LIMIT, DEFAULT_LDAP_MAX_SIZE_LIMIT);
+ }
+
+ @Override
+ public int getLDAPMaxTimeLimit() {
+ return getInt(LDAP_MAX_TIME_LIMIT, DEFAULT_LDAP_MAX_TIME_LIMIT);
+ }
+
@Override
public boolean getGroupUIServicesOnHomepage() {
return getBoolean(KNOX_HOMEPAGE_GROUP_UI_SERVICES, DEFAULT_GROUP_UI_SERVICES);
}
+
+ @Override
+ public int getTrustedOidcIssuerMaxTrustedIssuers() {
+ return getInt(TRUSTED_OIDC_ISSUER_MAX_TRUSTED_ISSUERS, TRUSTED_OIDC_ISSUER_MAX_TRUSTED_ISSUERS_DEFAULT);
+ }
+
+ @Override
+ public int getTrustedOidcIssuerDiscoveryCacheTtlSecs() {
+ return getInt(TRUSTED_OIDC_ISSUER_DISCOVERY_CACHE_TTL_SECS, TRUSTED_OIDC_ISSUER_DISCOVERY_CACHE_TTL_SECS_DEFAULT);
+ }
+
+ @Override
+ public int getTrustedOidcIssuerDiscoveryConnectTimeoutMs() {
+ return getInt(TRUSTED_OIDC_ISSUER_DISCOVERY_CONNECT_TIMEOUT_MS, TRUSTED_OIDC_ISSUER_DISCOVERY_CONNECT_TIMEOUT_MS_DEFAULT);
+ }
+
+ @Override
+ public int getTrustedOidcIssuerDiscoveryReadTimeoutMs() {
+ return getInt(TRUSTED_OIDC_ISSUER_DISCOVERY_READ_TIMEOUT_MS, TRUSTED_OIDC_ISSUER_DISCOVERY_READ_TIMEOUT_MS_DEFAULT);
+ }
+
+ @Override
+ public int getKnoxIDFFederatedOpConnectTimeoutMs() {
+ return getInt(KNOXIDF_FEDERATED_OP_CONNECT_TIMEOUT_MS, KNOXIDF_FEDERATED_OP_CONNECT_TIMEOUT_MS_DEFAULT);
+ }
+
+ @Override
+ public int getKnoxIDFFederatedOpReadTimeoutMs() {
+ return getInt(KNOXIDF_FEDERATED_OP_READ_TIMEOUT_MS, KNOXIDF_FEDERATED_OP_READ_TIMEOUT_MS_DEFAULT);
+ }
}
diff --git a/gateway-server/src/main/java/org/apache/knox/gateway/database/AbstractDataSourceFactory.java b/gateway-server/src/main/java/org/apache/knox/gateway/database/AbstractDataSourceFactory.java
index 7a7afadd13..a76b219a9e 100644
--- a/gateway-server/src/main/java/org/apache/knox/gateway/database/AbstractDataSourceFactory.java
+++ b/gateway-server/src/main/java/org/apache/knox/gateway/database/AbstractDataSourceFactory.java
@@ -42,6 +42,18 @@ public abstract class AbstractDataSourceFactory {
public static final String DERBY_KNOX_PROVIDERS_TABLE_CREATE_SQL_FILE_NAME = "createKnoxProvidersTableDerby.sql";
public static final String DERBY_KNOX_DESCRIPTORS_TABLE_CREATE_SQL_FILE_NAME = "createKnoxDescriptorsTableDerby.sql";
+ //KNOXIDF
+ public static final String KNOXIDF_FED_IDENTITY_TABLE_CREATE_SQL_FILE_NAME = "createKnoxIDFFederatedIdentityTable.sql";
+ public static final String KNOXIDF_FED_IDENTITY_ATTR_TABLE_CREATE_SQL_FILE_NAME = "createKnoxIDFFederatedIdentityAttributesTable.sql";
+ public static final String ORACLE_KNOXIDF_FED_IDENTITY_TABLE_CREATE_SQL_FILE_NAME = "createKnoxIDFFederatedIdentityTableOracle.sql";
+ public static final String ORACLE_KNOXIDF_FED_IDENTITY_ATTR_TABLE_CREATE_SQL_FILE_NAME = "createKnoxIDFFederatedIdentityAttributesTableOracle.sql";
+ public static final String DERBY_KNOXIDF_FED_IDENTITY_TABLE_CREATE_SQL_FILE_NAME = "createKnoxIDFFederatedIdentityTableDerby.sql";
+ public static final String DERBY_KNOXIDF_FED_IDENTITY_ATTR_TABLE_CREATE_SQL_FILE_NAME = "createKnoxIDFFederatedIdentityAttributesTableDerby.sql";
+
+ public static final String KNOXIDF_TRUSTED_OIDC_ISSUERS_TABLE_SQL = "createKnoxIDFTrustedOidcIssuersTable.sql";
+ public static final String DERBY_KNOXIDF_TRUSTED_OIDC_ISSUERS_TABLE_SQL = "createKnoxIDFTrustedOidcIssuersTableDerby.sql";
+ public static final String ORACLE_KNOXIDF_TRUSTED_OIDC_ISSUERS_TABLE_SQL = "createKnoxIDFTrustedOidcIssuersTableOracle.sql";
+
public static final String DATABASE_USER_ALIAS_NAME = "gateway_database_user";
public static final String DATABASE_PASSWORD_ALIAS_NAME = "gateway_database_password";
public static final String DATABASE_TRUSTSTORE_PASSWORD_ALIAS_NAME = "gateway_database_ssl_truststore_password";
diff --git a/gateway-server/src/main/java/org/apache/knox/gateway/database/DatabaseType.java b/gateway-server/src/main/java/org/apache/knox/gateway/database/DatabaseType.java
index 2009872782..5052d5d5a0 100644
--- a/gateway-server/src/main/java/org/apache/knox/gateway/database/DatabaseType.java
+++ b/gateway-server/src/main/java/org/apache/knox/gateway/database/DatabaseType.java
@@ -22,37 +22,55 @@ public enum DatabaseType {
AbstractDataSourceFactory.POSTGRES_TOKENS_TABLE_CREATE_SQL_FILE_NAME,
AbstractDataSourceFactory.POSTGRES_TOKEN_METADATA_TABLE_CREATE_SQL_FILE_NAME,
AbstractDataSourceFactory.KNOX_PROVIDERS_TABLE_CREATE_SQL_FILE_NAME,
- AbstractDataSourceFactory.KNOX_DESCRIPTORS_TABLE_CREATE_SQL_FILE_NAME
+ AbstractDataSourceFactory.KNOX_DESCRIPTORS_TABLE_CREATE_SQL_FILE_NAME,
+ AbstractDataSourceFactory.KNOXIDF_FED_IDENTITY_TABLE_CREATE_SQL_FILE_NAME,
+ AbstractDataSourceFactory.KNOXIDF_FED_IDENTITY_ATTR_TABLE_CREATE_SQL_FILE_NAME,
+ AbstractDataSourceFactory.KNOXIDF_TRUSTED_OIDC_ISSUERS_TABLE_SQL
),
MYSQL("mysql",
AbstractDataSourceFactory.TOKENS_TABLE_CREATE_SQL_FILE_NAME,
AbstractDataSourceFactory.TOKEN_METADATA_TABLE_CREATE_SQL_FILE_NAME,
AbstractDataSourceFactory.KNOX_PROVIDERS_TABLE_CREATE_SQL_FILE_NAME,
- AbstractDataSourceFactory.KNOX_DESCRIPTORS_TABLE_CREATE_SQL_FILE_NAME
+ AbstractDataSourceFactory.KNOX_DESCRIPTORS_TABLE_CREATE_SQL_FILE_NAME,
+ AbstractDataSourceFactory.KNOXIDF_FED_IDENTITY_TABLE_CREATE_SQL_FILE_NAME,
+ AbstractDataSourceFactory.KNOXIDF_FED_IDENTITY_ATTR_TABLE_CREATE_SQL_FILE_NAME,
+ AbstractDataSourceFactory.KNOXIDF_TRUSTED_OIDC_ISSUERS_TABLE_SQL
),
MARIADB("mariadb",
AbstractDataSourceFactory.TOKENS_TABLE_CREATE_SQL_FILE_NAME,
AbstractDataSourceFactory.TOKEN_METADATA_TABLE_CREATE_SQL_FILE_NAME,
AbstractDataSourceFactory.KNOX_PROVIDERS_TABLE_CREATE_SQL_FILE_NAME,
- AbstractDataSourceFactory.KNOX_DESCRIPTORS_TABLE_CREATE_SQL_FILE_NAME
+ AbstractDataSourceFactory.KNOX_DESCRIPTORS_TABLE_CREATE_SQL_FILE_NAME,
+ AbstractDataSourceFactory.KNOXIDF_FED_IDENTITY_TABLE_CREATE_SQL_FILE_NAME,
+ AbstractDataSourceFactory.KNOXIDF_FED_IDENTITY_ATTR_TABLE_CREATE_SQL_FILE_NAME,
+ AbstractDataSourceFactory.KNOXIDF_TRUSTED_OIDC_ISSUERS_TABLE_SQL
),
HSQL("hsql",
AbstractDataSourceFactory.TOKENS_TABLE_CREATE_SQL_FILE_NAME,
AbstractDataSourceFactory.TOKEN_METADATA_TABLE_CREATE_SQL_FILE_NAME,
AbstractDataSourceFactory.KNOX_PROVIDERS_TABLE_CREATE_SQL_FILE_NAME,
- AbstractDataSourceFactory.KNOX_DESCRIPTORS_TABLE_CREATE_SQL_FILE_NAME
+ AbstractDataSourceFactory.KNOX_DESCRIPTORS_TABLE_CREATE_SQL_FILE_NAME,
+ AbstractDataSourceFactory.KNOXIDF_FED_IDENTITY_TABLE_CREATE_SQL_FILE_NAME,
+ AbstractDataSourceFactory.KNOXIDF_FED_IDENTITY_ATTR_TABLE_CREATE_SQL_FILE_NAME,
+ AbstractDataSourceFactory.KNOXIDF_TRUSTED_OIDC_ISSUERS_TABLE_SQL
),
DERBY("derbydb",
AbstractDataSourceFactory.DERBY_TOKENS_TABLE_CREATE_SQL_FILE_NAME,
AbstractDataSourceFactory.DERBY_TOKEN_METADATA_TABLE_CREATE_SQL_FILE_NAME,
AbstractDataSourceFactory.DERBY_KNOX_PROVIDERS_TABLE_CREATE_SQL_FILE_NAME,
- AbstractDataSourceFactory.DERBY_KNOX_DESCRIPTORS_TABLE_CREATE_SQL_FILE_NAME
+ AbstractDataSourceFactory.DERBY_KNOX_DESCRIPTORS_TABLE_CREATE_SQL_FILE_NAME,
+ AbstractDataSourceFactory.DERBY_KNOXIDF_FED_IDENTITY_TABLE_CREATE_SQL_FILE_NAME,
+ AbstractDataSourceFactory.DERBY_KNOXIDF_FED_IDENTITY_ATTR_TABLE_CREATE_SQL_FILE_NAME,
+ AbstractDataSourceFactory.DERBY_KNOXIDF_TRUSTED_OIDC_ISSUERS_TABLE_SQL
),
ORACLE("oracle",
AbstractDataSourceFactory.ORACLE_TOKENS_TABLE_CREATE_SQL_FILE_NAME,
AbstractDataSourceFactory.ORACLE_TOKEN_METADATA_TABLE_CREATE_SQL_FILE_NAME,
AbstractDataSourceFactory.ORACLE_KNOX_PROVIDERS_TABLE_CREATE_SQL_FILE_NAME,
- AbstractDataSourceFactory.ORACLE_KNOX_DESCRIPTORS_TABLE_CREATE_SQL_FILE_NAME
+ AbstractDataSourceFactory.ORACLE_KNOX_DESCRIPTORS_TABLE_CREATE_SQL_FILE_NAME,
+ AbstractDataSourceFactory.ORACLE_KNOXIDF_FED_IDENTITY_TABLE_CREATE_SQL_FILE_NAME,
+ AbstractDataSourceFactory.ORACLE_KNOXIDF_FED_IDENTITY_ATTR_TABLE_CREATE_SQL_FILE_NAME,
+ AbstractDataSourceFactory.ORACLE_KNOXIDF_TRUSTED_OIDC_ISSUERS_TABLE_SQL
);
private final String type;
@@ -60,13 +78,21 @@ public enum DatabaseType {
private final String metadataTableSql;
private final String providersTableSql;
private final String descriptorsTableSql;
+ private final String federatedIdentityTableSql;
+ private final String federatedIdentityAttrTableSql;
+ private final String trustedOidcIssuersTableSql;
- DatabaseType(String type, String tokensTableSql, String metadataTableSql, String providersTableSql, String descriptorsTableSql) {
+ DatabaseType(String type, String tokensTableSql, String metadataTableSql, String providersTableSql,
+ String descriptorsTableSql, String federatedIdentityTableSql, String federatedIdentityAttrTableSql,
+ String trustedOidcIssuersTableSql) {
this.type = type;
this.tokensTableSql = tokensTableSql;
this.metadataTableSql = metadataTableSql;
this.providersTableSql = providersTableSql;
this.descriptorsTableSql = descriptorsTableSql;
+ this.federatedIdentityTableSql = federatedIdentityTableSql;
+ this.federatedIdentityAttrTableSql = federatedIdentityAttrTableSql;
+ this.trustedOidcIssuersTableSql = trustedOidcIssuersTableSql;
}
public String type() {
@@ -89,6 +115,18 @@ public String descriptorsTableSql() {
return descriptorsTableSql;
}
+ public String federatedIdentityTableSql() {
+ return federatedIdentityTableSql;
+ }
+
+ public String federatedIdentityAttrTableSql() {
+ return federatedIdentityAttrTableSql;
+ }
+
+ public String trustedOidcIssuersTableSql() {
+ return trustedOidcIssuersTableSql;
+ }
+
public static DatabaseType fromString(String dbType) {
for (DatabaseType dt : values()) {
if (dt.type.equalsIgnoreCase(dbType)) {
diff --git a/gateway-server/src/main/java/org/apache/knox/gateway/database/JDBCUtils.java b/gateway-server/src/main/java/org/apache/knox/gateway/database/JDBCUtils.java
index 014f8144f6..30e2ab59fe 100644
--- a/gateway-server/src/main/java/org/apache/knox/gateway/database/JDBCUtils.java
+++ b/gateway-server/src/main/java/org/apache/knox/gateway/database/JDBCUtils.java
@@ -36,7 +36,7 @@ public static boolean tableExists(String tableName, DataSource dataSource) throw
boolean exists;
try (Connection connection = dataSource.getConnection()) {
final DatabaseMetaData dbMetadata = connection.getMetaData();
- final String tableNameToCheck = dbMetadata.storesUpperCaseIdentifiers() ? tableName : tableName.toLowerCase(Locale.ROOT);
+ final String tableNameToCheck = normalizeIdentifier(tableName, dbMetadata);
try (ResultSet tables = dbMetadata.getTables(connection.getCatalog(), null, tableNameToCheck, null)) {
exists = tables.next();
}
@@ -44,6 +44,24 @@ public static boolean tableExists(String tableName, DataSource dataSource) throw
return exists;
}
+ /**
+ * Normalises an unquoted identifier to the case the driver actually stores it in, so it can be
+ * matched against {@link DatabaseMetaData#getTables}. Derby (and other uppercase-storing
+ * engines) store an unquoted {@code federated_identity} as {@code FEDERATED_IDENTITY}; passing
+ * the name verbatim would match nothing and cause {@code createTableIfNotExists} to re-run the
+ * CREATE and fail with "table already exists". Callers that use already-uppercase constants
+ * (KNOX_TOKENS, KNOX_PROVIDERS, TRUSTED_OIDC_ISSUERS) are unaffected since upper-casing them is
+ * a no-op.
+ */
+ private static String normalizeIdentifier(String identifier, DatabaseMetaData dbMetadata) throws SQLException {
+ if (dbMetadata.storesUpperCaseIdentifiers()) {
+ return identifier.toUpperCase(Locale.ROOT);
+ } else if (dbMetadata.storesLowerCaseIdentifiers()) {
+ return identifier.toLowerCase(Locale.ROOT);
+ }
+ return identifier;
+ }
+
public static void createTableFromSQL(String createSqlFileName, DataSource dataSource, ClassLoader classLoader) throws Exception {
try (InputStream is = classLoader.getResourceAsStream(createSqlFileName);
Connection connection = dataSource.getConnection();Statement createTableStatement = connection.createStatement()) {
diff --git a/gateway-server/src/main/java/org/apache/knox/gateway/database/KnoxDatabase.java b/gateway-server/src/main/java/org/apache/knox/gateway/database/KnoxDatabase.java
new file mode 100644
index 0000000000..dd6ee68e88
--- /dev/null
+++ b/gateway-server/src/main/java/org/apache/knox/gateway/database/KnoxDatabase.java
@@ -0,0 +1,37 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with this
+ * work for additional information regarding copyright ownership. The ASF
+ * licenses this file to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+ * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+ * License for the specific language governing permissions and limitations under
+ * the License.
+ */
+package org.apache.knox.gateway.database;
+
+import javax.sql.DataSource;
+
+public class KnoxDatabase {
+
+ protected final DataSource dataSource;
+
+ public KnoxDatabase(DataSource dataSource) {
+ this.dataSource = dataSource;
+ }
+
+ protected void createTableIfNotExists(String tableName, String createSqlFileName) throws Exception {
+ if (!JDBCUtils.tableExists(tableName, dataSource)) {
+ // Resolve the DDL resource via the actual subclass's classloader so each KnoxDatabase
+ // subclass (TokenStateDatabase, FederatedIdentityDatabase) loads its own create*.sql
+ // rather than being coupled to one hardcoded sibling class's classloader.
+ JDBCUtils.createTableFromSQL(createSqlFileName, dataSource, getClass().getClassLoader());
+ }
+ }
+}
diff --git a/gateway-server/src/main/java/org/apache/knox/gateway/deploy/DeploymentFactory.java b/gateway-server/src/main/java/org/apache/knox/gateway/deploy/DeploymentFactory.java
index dfe4a4ea90..564f793007 100644
--- a/gateway-server/src/main/java/org/apache/knox/gateway/deploy/DeploymentFactory.java
+++ b/gateway-server/src/main/java/org/apache/knox/gateway/deploy/DeploymentFactory.java
@@ -376,6 +376,13 @@ private static void initialize(
GatewayConfig gatewayConfig) {
WebAppDescriptor wad = context.getWebAppDescriptor();
String topoName = context.getTopology().getName();
+
+ final boolean hasKnoxIdf = services!= null && services.entrySet().stream().anyMatch( e -> e.getKey().equalsIgnoreCase("KNOXIDF") );
+ if (hasKnoxIdf) {
+ wad.createServlet().servletName("auth-consent-redirect").servletClass("org.apache.knox.gateway.service.knoxidf.AuthConsentServlet");
+ wad.createServletMapping().servletName("auth-consent-redirect").urlPattern("/authConsent");
+ }
+
boolean asyncSupported = gatewayConfig.isAsyncSupported() || gatewayConfig.isTopologyAsyncSupported(topoName);
if( applications == null ) {
String servletName = topoName + SERVLET_NAME_SUFFIX;
diff --git a/gateway-server/src/main/java/org/apache/knox/gateway/services/DefaultGatewayServices.java b/gateway-server/src/main/java/org/apache/knox/gateway/services/DefaultGatewayServices.java
index a38026f9a3..39cf0aca0a 100644
--- a/gateway-server/src/main/java/org/apache/knox/gateway/services/DefaultGatewayServices.java
+++ b/gateway-server/src/main/java/org/apache/knox/gateway/services/DefaultGatewayServices.java
@@ -86,6 +86,10 @@ public void init(GatewayConfig config, Map options) throws Servic
addService(ServiceType.LDAP_ROLES_LOOKUP_SERVICE, gatewayServiceFactory.create(this, ServiceType.LDAP_ROLES_LOOKUP_SERVICE, config, options));
addService(ServiceType.LDAP_SERVICE, gatewayServiceFactory.create(this, ServiceType.LDAP_SERVICE, config, options));
+
+ addService(ServiceType.KNOXIDF_FEDERATED_IDENTITY_SERVICE, gatewayServiceFactory.create(this, ServiceType.KNOXIDF_FEDERATED_IDENTITY_SERVICE, config, options));
+
+ addService(ServiceType.TRUSTED_OIDC_ISSUER_SERVICE, gatewayServiceFactory.create(this, ServiceType.TRUSTED_OIDC_ISSUER_SERVICE, config, options));
}
@Override
diff --git a/gateway-server/src/main/java/org/apache/knox/gateway/services/factory/AbstractServiceFactory.java b/gateway-server/src/main/java/org/apache/knox/gateway/services/factory/AbstractServiceFactory.java
index 4b60fa434e..2049c72bb4 100644
--- a/gateway-server/src/main/java/org/apache/knox/gateway/services/factory/AbstractServiceFactory.java
+++ b/gateway-server/src/main/java/org/apache/knox/gateway/services/factory/AbstractServiceFactory.java
@@ -17,9 +17,16 @@
*/
package org.apache.knox.gateway.services.factory;
+import java.io.IOException;
import java.lang.reflect.InvocationTargetException;
+import java.nio.charset.StandardCharsets;
+import java.nio.file.Files;
+import java.nio.file.Path;
+import java.nio.file.Paths;
import java.util.Collection;
+import java.util.Locale;
import java.util.Map;
+import java.util.stream.Stream;
import org.apache.commons.lang3.StringUtils;
import org.apache.knox.gateway.GatewayMessages;
@@ -33,6 +40,8 @@
import org.apache.knox.gateway.services.security.AliasService;
import org.apache.knox.gateway.services.security.KeystoreService;
import org.apache.knox.gateway.services.security.MasterService;
+import org.apache.knox.gateway.services.topology.TopologyService;
+import org.apache.knox.gateway.topology.Topology;
public abstract class AbstractServiceFactory implements ServiceFactory {
@@ -40,6 +49,10 @@ public abstract class AbstractServiceFactory implements ServiceFactory {
private static final String IMPLEMENTATION_PARAM_NAME = "impl";
private static final String EMPTY_DEFAULT_IMPLEMENTATION = "";
+ /** Topology service roles that enable the KnoxIDF-backed service implementations. */
+ private static final String KNOXIDF_ROLE = "KNOXIDF";
+ private static final String KNOXIDF_ADMIN_ROLE = "KNOXIDF_ADMIN";
+
@Override
public Service create(GatewayServices gatewayServices, ServiceType serviceType, GatewayConfig gatewayConfig, Map options) throws ServiceLifecycleException {
return create(gatewayServices, serviceType, gatewayConfig, options, getImplementation(gatewayConfig));
@@ -105,6 +118,72 @@ protected void logServiceUsage(String implementation, ServiceType serviceType) {
LOG.usingServiceImplementation(isEmptyDefaultImplementation(implementation) ? "default" : implementation, serviceType.getServiceTypeName());
}
+ /**
+ * Returns {@code true} if any topology enables KnoxIDF (a service with role {@code KNOXIDF} or
+ * {@code KNOXIDF_ADMIN}).
+ *
+ * Service factories run during {@code DefaultGatewayServices.init}, before the topology monitor
+ * has loaded any topologies, so {@link TopologyService#getTopologies()} is typically empty at
+ * this point. To detect KnoxIDF anyway we fall back to scanning the on-disk topology directory
+ * for the enabling role. The in-memory check is kept first so a caller that runs after topologies
+ * are loaded still works. Known limitation: descriptor-generated {@code .topology} files that are
+ * not yet materialised on disk at init time are not seen (still strictly better than relying on
+ * the empty in-memory map alone).
+ */
+ protected boolean isKnoxIdfEnabledInAnyTopology(GatewayServices gatewayServices, GatewayConfig gatewayConfig) {
+ final TopologyService topologyService = gatewayServices.getService(ServiceType.TOPOLOGY_SERVICE);
+ if (topologyService != null) {
+ for (Topology topology : topologyService.getTopologies()) {
+ if (topology.getServices().stream().anyMatch(service -> isKnoxIdfRole(service.getRole()))) {
+ return true;
+ }
+ }
+ }
+ return isKnoxIdfEnabledOnDisk(gatewayConfig);
+ }
+
+ private static boolean isKnoxIdfRole(String role) {
+ return KNOXIDF_ROLE.equals(role) || KNOXIDF_ADMIN_ROLE.equals(role);
+ }
+
+ private static boolean isKnoxIdfEnabledOnDisk(GatewayConfig gatewayConfig) {
+ if (gatewayConfig == null) {
+ return false;
+ }
+ final String topologyDir = gatewayConfig.getGatewayTopologyDir();
+ if (StringUtils.isBlank(topologyDir)) {
+ return false;
+ }
+ final Path dir = Paths.get(topologyDir);
+ if (!Files.isDirectory(dir)) {
+ return false;
+ }
+ try (Stream files = Files.list(dir)) {
+ return files.filter(AbstractServiceFactory::isTopologyFile).anyMatch(AbstractServiceFactory::topologyFileEnablesKnoxIdf);
+ } catch (IOException e) {
+ LOG.failedToListTopologyDirForKnoxIdfDetection(topologyDir, e.getMessage(), e);
+ return false;
+ }
+ }
+
+ private static boolean isTopologyFile(Path path) {
+ if (!Files.isRegularFile(path)) {
+ return false;
+ }
+ final String name = path.getFileName().toString().toLowerCase(Locale.ROOT);
+ return name.endsWith(".xml") || name.endsWith(".topology");
+ }
+
+ private static boolean topologyFileEnablesKnoxIdf(Path path) {
+ try {
+ final String content = new String(Files.readAllBytes(path), StandardCharsets.UTF_8);
+ return content.contains("" + KNOXIDF_ROLE + "") || content.contains("" + KNOXIDF_ADMIN_ROLE + "");
+ } catch (IOException e) {
+ LOG.failedToReadTopologyFileForKnoxIdfDetection(path.toString(), e.getMessage(), e);
+ return false;
+ }
+ }
+
// abstract methods
protected abstract Service createService(GatewayServices gatewayServices, ServiceType serviceType, GatewayConfig gatewayConfig, Map options,
diff --git a/gateway-server/src/main/java/org/apache/knox/gateway/services/factory/FederatedIdentityServiceFactory.java b/gateway-server/src/main/java/org/apache/knox/gateway/services/factory/FederatedIdentityServiceFactory.java
new file mode 100644
index 0000000000..fbfeaa6d06
--- /dev/null
+++ b/gateway-server/src/main/java/org/apache/knox/gateway/services/factory/FederatedIdentityServiceFactory.java
@@ -0,0 +1,122 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with this
+ * work for additional information regarding copyright ownership. The ASF
+ * licenses this file to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+ * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+ * License for the specific language governing permissions and limitations under
+ * the License.
+ */
+package org.apache.knox.gateway.services.factory;
+
+import org.apache.knox.gateway.GatewayMessages;
+import org.apache.knox.gateway.config.GatewayConfig;
+import org.apache.knox.gateway.database.DatabaseType;
+import org.apache.knox.gateway.i18n.messages.MessagesFactory;
+import org.apache.knox.gateway.services.GatewayServices;
+import org.apache.knox.gateway.services.Service;
+import org.apache.knox.gateway.services.ServiceLifecycleException;
+import org.apache.knox.gateway.services.ServiceType;
+import org.apache.knox.gateway.services.knoxidf.federation.DerbyDBFederatedIdentityService;
+import org.apache.knox.gateway.services.knoxidf.federation.EmptyFederatedIdentityService;
+import org.apache.knox.gateway.services.knoxidf.federation.FederatedIdentityService;
+import org.apache.knox.gateway.services.knoxidf.federation.JdbcFederatedIdentityService;
+
+import java.util.Collection;
+import java.util.List;
+import java.util.Map;
+
+public class FederatedIdentityServiceFactory extends AbstractServiceFactory {
+
+ private static final GatewayMessages LOG = MessagesFactory.get(GatewayMessages.class);
+ private static final String DEFAULT_IMPLEMENTATION = EmptyFederatedIdentityService.class.getName();
+
+ @Override
+ protected Service createService(GatewayServices gatewayServices, ServiceType serviceType, GatewayConfig gatewayConfig, Map options, String implementation)
+ throws ServiceLifecycleException {
+
+ String implementationToUse = implementation;
+ // No explicit impl configured: auto-select a persistence backend when KnoxIDF is deployed.
+ // Otherwise honor the configured impl (very likely a prod JDBC store).
+ if (isEmptyDefaultImplementation(implementationToUse) && isKnoxIdfEnabledInAnyTopology(gatewayServices, gatewayConfig)) {
+ implementationToUse = chooseAutoImplementation(gatewayConfig);
+ }
+
+ FederatedIdentityService service = null;
+ if (shouldCreateService(implementationToUse)) {
+ if (matchesImplementation(implementationToUse, EmptyFederatedIdentityService.class, true)) {
+ service = new EmptyFederatedIdentityService();
+ } else if (matchesImplementation(implementationToUse, DerbyDBFederatedIdentityService.class)) {
+ service = createDerbyService(gatewayServices, gatewayConfig, options);
+ } else if (matchesImplementation(implementationToUse, JdbcFederatedIdentityService.class)) {
+ service = createJdbcService(gatewayServices, gatewayConfig, options);
+ }
+ logServiceUsage(service.getClass().getName(), serviceType);
+ }
+ return service;
+ }
+
+ /**
+ * Chooses the auto-enabled implementation when KnoxIDF is deployed with no explicit impl: an
+ * operator-configured external database wins (very likely a prod JDBC store), otherwise a
+ * self-provisioning embedded Derby store (the {@code none}/{@code derbydb} default) so
+ * federation works out of the box without any extra infrastructure.
+ */
+ String chooseAutoImplementation(GatewayConfig gatewayConfig) {
+ return isExternalDatabaseConfigured(gatewayConfig)
+ ? JdbcFederatedIdentityService.class.getName()
+ : DerbyDBFederatedIdentityService.class.getName();
+ }
+
+ private boolean isExternalDatabaseConfigured(GatewayConfig gatewayConfig) {
+ final String databaseType = gatewayConfig.getDatabaseType();
+ try {
+ return DatabaseType.fromString(databaseType) != DatabaseType.DERBY;
+ } catch (IllegalArgumentException e) {
+ // "none" (the default) or any unrecognized value: no real external DB -> use Derby.
+ return false;
+ }
+ }
+
+ private FederatedIdentityService createDerbyService(GatewayServices gatewayServices, GatewayConfig gatewayConfig, Map options) {
+ try {
+ final DerbyDBFederatedIdentityService derbyService = new DerbyDBFederatedIdentityService();
+ derbyService.setAliasService(getAliasService(gatewayServices));
+ derbyService.setMasterService(getMasterService(gatewayServices));
+ derbyService.init(gatewayConfig, options);
+ return derbyService;
+ } catch (ServiceLifecycleException e) {
+ LOG.errorInitializingService(DerbyDBFederatedIdentityService.class.getName(), e.getMessage(), e);
+ return new EmptyFederatedIdentityService();
+ }
+ }
+
+ private FederatedIdentityService createJdbcService(GatewayServices gatewayServices, GatewayConfig gatewayConfig, Map options) {
+ try {
+ final JdbcFederatedIdentityService jdbcService = new JdbcFederatedIdentityService();
+ jdbcService.setAliasService(getAliasService(gatewayServices));
+ jdbcService.init(gatewayConfig, options);
+ return jdbcService;
+ } catch (ServiceLifecycleException e) {
+ LOG.errorInitializingService(JdbcFederatedIdentityService.class.getName(), e.getMessage(), e);
+ return new EmptyFederatedIdentityService();
+ }
+ }
+
+ @Override
+ protected ServiceType getServiceType() {
+ return ServiceType.KNOXIDF_FEDERATED_IDENTITY_SERVICE;
+ }
+
+ @Override
+ protected Collection getKnownImplementations() {
+ return List.of(DEFAULT_IMPLEMENTATION, JdbcFederatedIdentityService.class.getName(), DerbyDBFederatedIdentityService.class.getName());
+ }
+}
diff --git a/gateway-server/src/main/java/org/apache/knox/gateway/services/factory/TrustedOidcIssuerServiceFactory.java b/gateway-server/src/main/java/org/apache/knox/gateway/services/factory/TrustedOidcIssuerServiceFactory.java
new file mode 100644
index 0000000000..e8219c8e36
--- /dev/null
+++ b/gateway-server/src/main/java/org/apache/knox/gateway/services/factory/TrustedOidcIssuerServiceFactory.java
@@ -0,0 +1,127 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with this
+ * work for additional information regarding copyright ownership. The ASF
+ * licenses this file to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+ * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+ * License for the specific language governing permissions and limitations under
+ * the License.
+ */
+package org.apache.knox.gateway.services.factory;
+
+import org.apache.knox.gateway.GatewayMessages;
+import org.apache.knox.gateway.config.GatewayConfig;
+import org.apache.knox.gateway.database.DatabaseType;
+import org.apache.knox.gateway.i18n.messages.MessagesFactory;
+import org.apache.knox.gateway.services.GatewayServices;
+import org.apache.knox.gateway.services.Service;
+import org.apache.knox.gateway.services.ServiceLifecycleException;
+import org.apache.knox.gateway.services.ServiceType;
+import org.apache.knox.gateway.services.knoxidf.trustedoidcissuer.DerbyDBTrustedOidcIssuerService;
+import org.apache.knox.gateway.services.knoxidf.trustedoidcissuer.EmptyTrustedOidcIssuerService;
+import org.apache.knox.gateway.services.knoxidf.trustedoidcissuer.JdbcTrustedOidcIssuerService;
+import org.apache.knox.gateway.services.knoxidf.trustedoidcissuer.TrustedOidcIssuerService;
+
+import java.util.Collection;
+import java.util.List;
+import java.util.Map;
+
+public class TrustedOidcIssuerServiceFactory extends AbstractServiceFactory {
+
+ private static final GatewayMessages LOG = MessagesFactory.get(GatewayMessages.class);
+ private static final String DEFAULT_IMPLEMENTATION = EmptyTrustedOidcIssuerService.class.getName();
+
+ @Override
+ protected Service createService(GatewayServices gatewayServices, ServiceType serviceType,
+ GatewayConfig gatewayConfig, Map options, String implementation)
+ throws ServiceLifecycleException {
+
+ String implementationToUse = implementation;
+ // No explicit impl configured: auto-select a persistence backend when KnoxIDF is deployed.
+ // Otherwise honor the configured impl (very likely a prod JDBC store).
+ if (isEmptyDefaultImplementation(implementationToUse) && isKnoxIdfEnabledInAnyTopology(gatewayServices, gatewayConfig)) {
+ implementationToUse = chooseAutoImplementation(gatewayConfig);
+ }
+
+ TrustedOidcIssuerService service = null;
+ if (shouldCreateService(implementationToUse)) {
+ if (matchesImplementation(implementationToUse, EmptyTrustedOidcIssuerService.class, true)) {
+ service = new EmptyTrustedOidcIssuerService();
+ } else if (matchesImplementation(implementationToUse, DerbyDBTrustedOidcIssuerService.class)) {
+ service = createDerbyService(gatewayServices, gatewayConfig, options);
+ } else if (matchesImplementation(implementationToUse, JdbcTrustedOidcIssuerService.class)) {
+ service = createJdbcService(gatewayServices, gatewayConfig, options);
+ }
+ if (service != null) {
+ logServiceUsage(service.getClass().getName(), serviceType);
+ }
+ }
+ return service;
+ }
+
+ /**
+ * Chooses the auto-enabled implementation when KnoxIDF is deployed with no explicit impl: an
+ * operator-configured external database wins (very likely a prod JDBC store), otherwise a
+ * self-provisioning embedded Derby store (the {@code none}/{@code derbydb} default) so the
+ * trusted OIDC issuer registry works out of the box without any extra infrastructure.
+ */
+ String chooseAutoImplementation(GatewayConfig gatewayConfig) {
+ return isExternalDatabaseConfigured(gatewayConfig)
+ ? JdbcTrustedOidcIssuerService.class.getName()
+ : DerbyDBTrustedOidcIssuerService.class.getName();
+ }
+
+ private boolean isExternalDatabaseConfigured(GatewayConfig gatewayConfig) {
+ final String databaseType = gatewayConfig.getDatabaseType();
+ try {
+ return DatabaseType.fromString(databaseType) != DatabaseType.DERBY;
+ } catch (IllegalArgumentException e) {
+ // "none" (the default) or any unrecognized value: no real external DB -> use Derby.
+ return false;
+ }
+ }
+
+ private TrustedOidcIssuerService createDerbyService(GatewayServices gatewayServices, GatewayConfig gatewayConfig, Map options)
+ throws ServiceLifecycleException {
+ try {
+ final DerbyDBTrustedOidcIssuerService derbyService = new DerbyDBTrustedOidcIssuerService();
+ derbyService.setAliasService(getAliasService(gatewayServices));
+ derbyService.setMasterService(getMasterService(gatewayServices));
+ derbyService.init(gatewayConfig, options);
+ return derbyService;
+ } catch (ServiceLifecycleException e) {
+ LOG.errorInitializingService(DerbyDBTrustedOidcIssuerService.class.getName(), e.getMessage(), e);
+ return new EmptyTrustedOidcIssuerService();
+ }
+ }
+
+ private TrustedOidcIssuerService createJdbcService(GatewayServices gatewayServices, GatewayConfig gatewayConfig, Map options)
+ throws ServiceLifecycleException {
+ try {
+ final JdbcTrustedOidcIssuerService jdbcService = new JdbcTrustedOidcIssuerService();
+ jdbcService.setAliasService(getAliasService(gatewayServices));
+ jdbcService.init(gatewayConfig, options);
+ return jdbcService;
+ } catch (ServiceLifecycleException e) {
+ LOG.errorInitializingService(JdbcTrustedOidcIssuerService.class.getName(), e.getMessage(), e);
+ return new EmptyTrustedOidcIssuerService();
+ }
+ }
+
+ @Override
+ protected ServiceType getServiceType() {
+ return ServiceType.TRUSTED_OIDC_ISSUER_SERVICE;
+ }
+
+ @Override
+ protected Collection getKnownImplementations() {
+ return List.of(DEFAULT_IMPLEMENTATION, JdbcTrustedOidcIssuerService.class.getName(), DerbyDBTrustedOidcIssuerService.class.getName());
+ }
+}
diff --git a/gateway-server/src/main/java/org/apache/knox/gateway/services/knoxidf/federation/DerbyDBFederatedIdentityService.java b/gateway-server/src/main/java/org/apache/knox/gateway/services/knoxidf/federation/DerbyDBFederatedIdentityService.java
new file mode 100644
index 0000000000..aa4bec22c0
--- /dev/null
+++ b/gateway-server/src/main/java/org/apache/knox/gateway/services/knoxidf/federation/DerbyDBFederatedIdentityService.java
@@ -0,0 +1,101 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with this
+ * work for additional information regarding copyright ownership. The ASF
+ * licenses this file to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+ * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+ * License for the specific language governing permissions and limitations under
+ * the License.
+ */
+package org.apache.knox.gateway.services.knoxidf.federation;
+
+import static org.apache.knox.gateway.config.impl.GatewayConfigImpl.GATEWAY_DATABASE_NAME;
+import static org.apache.knox.gateway.config.impl.GatewayConfigImpl.GATEWAY_DATABASE_TYPE;
+import static org.apache.knox.gateway.database.AbstractDataSourceFactory.DATABASE_PASSWORD_ALIAS_NAME;
+import static org.apache.knox.gateway.database.AbstractDataSourceFactory.DATABASE_USER_ALIAS_NAME;
+import static org.apache.knox.gateway.database.DatabaseType.DERBY;
+import static org.apache.knox.gateway.services.security.AliasService.NO_CLUSTER_NAME;
+
+import java.nio.file.Path;
+import java.nio.file.Paths;
+import java.util.Map;
+import java.util.concurrent.TimeUnit;
+
+import org.apache.hadoop.conf.Configuration;
+import org.apache.knox.gateway.config.GatewayConfig;
+import org.apache.knox.gateway.services.ServiceLifecycleException;
+import org.apache.knox.gateway.services.security.MasterService;
+import org.apache.knox.gateway.services.token.impl.DerbyDBTokenStateService;
+import org.apache.knox.gateway.shell.jdbc.derby.DerbyDatabase;
+
+/**
+ * A self-provisioning, embedded-Derby backed {@link FederatedIdentityService}. This is the
+ * auto-enabled default when KnoxIDF is deployed without an operator-configured external database,
+ * mirroring how {@link DerbyDBTokenStateService} is the default token-state service.
+ *
+ * It reuses the single embedded Derby database that the token-state service already provisions
+ * under {@code ${securityDir}/tokens} (the {@code ;create=true} JDBC URL is idempotent, so
+ * connecting to an already-booted database simply connects), sets the shared {@link GatewayConfig}
+ * to point at it, ensures the connection user/password aliases exist, and then delegates all
+ * persistence to {@link JdbcFederatedIdentityService} (which builds the
+ * {@link FederatedIdentityDatabase} and self-creates its tables).
+ */
+public class DerbyDBFederatedIdentityService extends JdbcFederatedIdentityService {
+
+ private DerbyDatabase derbyDatabase;
+ private Path derbyDatabaseFolder;
+ private MasterService masterService;
+
+ public void setMasterService(MasterService masterService) {
+ this.masterService = masterService;
+ }
+
+ @Override
+ public void init(GatewayConfig config, Map options) throws ServiceLifecycleException {
+ try {
+ derbyDatabaseFolder = Paths.get(config.getGatewaySecurityDir(), DerbyDBTokenStateService.DB_NAME);
+ startDerby();
+ ((Configuration) config).set(GATEWAY_DATABASE_TYPE, DERBY.type());
+ ((Configuration) config).set(GATEWAY_DATABASE_NAME, derbyDatabaseFolder.toString());
+ getAliasService().addAliasForCluster(NO_CLUSTER_NAME, DATABASE_USER_ALIAS_NAME, getDatabaseUserName());
+ getAliasService().addAliasForCluster(NO_CLUSTER_NAME, DATABASE_PASSWORD_ALIAS_NAME, getDatabasePassword());
+ super.init(config, options);
+ } catch (Exception e) {
+ throw new ServiceLifecycleException("Error while initiating DerbyDBFederatedIdentityService: " + e, e);
+ }
+ }
+
+ private void startDerby() throws Exception {
+ derbyDatabase = new DerbyDatabase(derbyDatabaseFolder.toString());
+ derbyDatabase.create();
+ TimeUnit.SECONDS.sleep(1); // give a bit of time for the server to start
+ }
+
+ private String getDatabasePassword() throws Exception {
+ final char[] dbPasswordAliasValue = getAliasService().getPasswordFromAliasForGateway(DATABASE_PASSWORD_ALIAS_NAME);
+ return dbPasswordAliasValue != null ? new String(dbPasswordAliasValue) : new String(masterService.getMasterSecret());
+ }
+
+ private String getDatabaseUserName() throws Exception {
+ final char[] dbUserAliasValue = getAliasService().getPasswordFromAliasForGateway(DATABASE_USER_ALIAS_NAME);
+ return dbUserAliasValue != null ? new String(dbUserAliasValue) : DerbyDBTokenStateService.DEFAULT_TOKEN_DB_USER_NAME;
+ }
+
+ @Override
+ public void stop() throws ServiceLifecycleException {
+ try {
+ if (derbyDatabase != null) {
+ derbyDatabase.shutdown();
+ }
+ } catch (Exception e) {
+ throw new ServiceLifecycleException("Error while shutting down Derby Database", e);
+ }
+ }
+}
diff --git a/gateway-server/src/main/java/org/apache/knox/gateway/services/knoxidf/federation/EmptyFederatedIdentityService.java b/gateway-server/src/main/java/org/apache/knox/gateway/services/knoxidf/federation/EmptyFederatedIdentityService.java
new file mode 100644
index 0000000000..6738b2660c
--- /dev/null
+++ b/gateway-server/src/main/java/org/apache/knox/gateway/services/knoxidf/federation/EmptyFederatedIdentityService.java
@@ -0,0 +1,52 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with this
+ * work for additional information regarding copyright ownership. The ASF
+ * licenses this file to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+ * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+ * License for the specific language governing permissions and limitations under
+ * the License.
+ */
+package org.apache.knox.gateway.services.knoxidf.federation;
+
+import org.apache.knox.gateway.config.GatewayConfig;
+import org.apache.knox.gateway.services.ServiceLifecycleException;
+
+import java.util.Map;
+import java.util.Optional;
+
+public class EmptyFederatedIdentityService implements FederatedIdentityService {
+ @Override
+ public FederatedIdentity addFederatedIdentity(FederatedIdentity identity) {
+ return identity;
+ }
+
+ @Override
+ public Optional findById(String identityId) {
+ return Optional.empty();
+ }
+
+ @Override
+ public Optional findByProviderAndSubject(String provider, String externalIssuer, String externalSubject) {
+ return Optional.empty();
+ }
+
+ @Override
+ public void init(GatewayConfig config, Map options) throws ServiceLifecycleException {
+ }
+
+ @Override
+ public void start() throws ServiceLifecycleException {
+ }
+
+ @Override
+ public void stop() throws ServiceLifecycleException {
+ }
+}
diff --git a/gateway-server/src/main/java/org/apache/knox/gateway/services/knoxidf/federation/FederatedIdentityDatabase.java b/gateway-server/src/main/java/org/apache/knox/gateway/services/knoxidf/federation/FederatedIdentityDatabase.java
new file mode 100644
index 0000000000..0fc2790a41
--- /dev/null
+++ b/gateway-server/src/main/java/org/apache/knox/gateway/services/knoxidf/federation/FederatedIdentityDatabase.java
@@ -0,0 +1,148 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with this
+ * work for additional information regarding copyright ownership. The ASF
+ * licenses this file to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+ * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+ * License for the specific language governing permissions and limitations under
+ * the License.
+ */
+package org.apache.knox.gateway.services.knoxidf.federation;
+
+import org.apache.knox.gateway.database.DatabaseType;
+import org.apache.knox.gateway.database.KnoxDatabase;
+
+import javax.sql.DataSource;
+import java.sql.Connection;
+import java.sql.PreparedStatement;
+import java.sql.ResultSet;
+import java.sql.SQLException;
+import java.sql.Timestamp;
+import java.util.HashMap;
+import java.util.Optional;
+
+class FederatedIdentityDatabase extends KnoxDatabase {
+ private static final String FEDERATED_IDENTITY_TABLE_NAME = "federated_identity";
+ private static final String FEDERATED_IDENTITY_ATTRIBUTES_TABLE_NAME = "federated_identity_attr";
+ private static final String ADD_FEDERATED_IDENTITY_SQL = "INSERT INTO " + FEDERATED_IDENTITY_TABLE_NAME
+ + " (id, user_id, provider, external_subject, external_issuer, created_at) VALUES (?, ?, ?, ?, ?, ?)";
+ private static final String ADD_FEDERATED_IDENTITY_ATTR_SQL = "INSERT INTO " + FEDERATED_IDENTITY_ATTRIBUTES_TABLE_NAME +
+ " (identity_id, attr_key, attr_value) VALUES (?, ?, ?)";
+ private static final String FETCH_FEDERATED_IDENTITY_BY_PROV_ISS_SUB_SQL = "SELECT id, user_id, provider, external_subject, external_issuer, created_at FROM "
+ + FEDERATED_IDENTITY_TABLE_NAME + " WHERE provider = ? AND external_issuer = ? AND external_subject = ?";
+ private static final String FETCH_FEDERATED_IDENTITY_SQL_BY_ID = "SELECT id, user_id, provider, external_subject, external_issuer, created_at FROM "
+ + FEDERATED_IDENTITY_TABLE_NAME + " WHERE id = ?";
+ private static final String FETCH_FEDERATED_IDENTITY_ATTR_SQL = "SELECT attr_key, attr_value FROM " + FEDERATED_IDENTITY_ATTRIBUTES_TABLE_NAME + " WHERE identity_id = ?";
+
+ FederatedIdentityDatabase(DataSource dataSource, String dbType) throws Exception {
+ super(dataSource);
+ DatabaseType databaseType = DatabaseType.fromString(dbType);
+ createTableIfNotExists(FEDERATED_IDENTITY_TABLE_NAME, databaseType.federatedIdentityTableSql());
+ createTableIfNotExists(FEDERATED_IDENTITY_ATTRIBUTES_TABLE_NAME, databaseType.federatedIdentityAttrTableSql());
+ }
+
+ void addFederatedIdentity(FederatedIdentity identity) throws SQLException {
+ // Persist the core identity row and its attribute rows atomically on a single connection
+ // with autocommit off: either the identity and all its attributes commit together, or the
+ // whole write rolls back. Previously each INSERT ran on its own auto-committed connection,
+ // so a failure between them could leave an identity persisted without its attributes.
+ try (Connection connection = dataSource.getConnection()) {
+ final boolean previousAutoCommit = connection.getAutoCommit();
+ connection.setAutoCommit(false);
+ try {
+ // save core metadata first
+ try (PreparedStatement addFederatedIdentityStatement = connection.prepareStatement(ADD_FEDERATED_IDENTITY_SQL)) {
+ addFederatedIdentityStatement.setString(1, identity.getId());
+ addFederatedIdentityStatement.setString(2, identity.getUserId());
+ addFederatedIdentityStatement.setString(3, identity.getProvider());
+ addFederatedIdentityStatement.setString(4, identity.getExternalSubject());
+ addFederatedIdentityStatement.setString(5, identity.getExternalIssuer());
+ addFederatedIdentityStatement.setTimestamp(6, Timestamp.from(identity.getCreatedAt()));
+ addFederatedIdentityStatement.executeUpdate();
+ }
+
+ // save attributes
+ try (PreparedStatement addFederatedIdentityAttrStatement = connection.prepareStatement(ADD_FEDERATED_IDENTITY_ATTR_SQL)) {
+ for (var attribute : identity.getAttributes().entrySet()) {
+ addFederatedIdentityAttrStatement.setString(1, identity.getId());
+ addFederatedIdentityAttrStatement.setString(2, attribute.getKey());
+ addFederatedIdentityAttrStatement.setString(3, attribute.getValue());
+ addFederatedIdentityAttrStatement.addBatch();
+ }
+ addFederatedIdentityAttrStatement.executeBatch();
+ }
+ connection.commit();
+ } catch (SQLException e) {
+ connection.rollback();
+ throw e;
+ } finally {
+ connection.setAutoCommit(previousAutoCommit);
+ }
+ }
+ }
+
+
+ Optional findByProviderAndSubject(String provider, String issuer, String subject) throws SQLException {
+ FederatedIdentity federatedIdentity = null;
+ try (Connection connection = dataSource.getConnection(); PreparedStatement getFederatedIdentityStatement = connection.prepareStatement(FETCH_FEDERATED_IDENTITY_BY_PROV_ISS_SUB_SQL)) {
+ getFederatedIdentityStatement.setString(1, provider);
+ getFederatedIdentityStatement.setString(2, issuer);
+ getFederatedIdentityStatement.setString(3, subject);
+ try (ResultSet rs = getFederatedIdentityStatement.executeQuery()) {
+ if (rs.next()) {
+ federatedIdentity = new FederatedIdentity(
+ rs.getString("id"),
+ rs.getString("user_id"),
+ provider,
+ subject,
+ issuer,
+ rs.getTimestamp("created_at").toInstant(), new HashMap<>());
+ } else {
+ return Optional.empty();
+ }
+ }
+ }
+ populateAttributes(federatedIdentity);
+ return Optional.of(federatedIdentity);
+ }
+
+ Optional findById(String id) throws SQLException {
+ FederatedIdentity federatedIdentity = null;
+ try (Connection connection = dataSource.getConnection(); PreparedStatement getFederatedIdentityStatement = connection.prepareStatement(FETCH_FEDERATED_IDENTITY_SQL_BY_ID)) {
+ getFederatedIdentityStatement.setString(1, id);
+ try (ResultSet rs = getFederatedIdentityStatement.executeQuery()) {
+ if (rs.next()) {
+ federatedIdentity = new FederatedIdentity(
+ id,
+ rs.getString("user_id"),
+ rs.getString("provider"),
+ rs.getString("external_subject"),
+ rs.getString("external_issuer"),
+ rs.getTimestamp("created_at").toInstant(), new HashMap<>());
+ } else {
+ return Optional.empty();
+ }
+ }
+ }
+ populateAttributes(federatedIdentity);
+ return Optional.of(federatedIdentity);
+ }
+
+ private void populateAttributes(FederatedIdentity federatedIdentity) throws SQLException {
+ try (Connection connection = dataSource.getConnection(); PreparedStatement getFederatedIdentityAttrStatement = connection.prepareStatement(FETCH_FEDERATED_IDENTITY_ATTR_SQL)) {
+ getFederatedIdentityAttrStatement.setString(1, federatedIdentity.getId());
+ try (ResultSet rs = getFederatedIdentityAttrStatement.executeQuery()) {
+ while (rs.next()) {
+ federatedIdentity.getAttributes().put(rs.getString(1), rs.getString(2));
+ }
+ }
+ }
+ }
+}
diff --git a/gateway-server/src/main/java/org/apache/knox/gateway/services/knoxidf/federation/FederatedIdentityServiceMessages.java b/gateway-server/src/main/java/org/apache/knox/gateway/services/knoxidf/federation/FederatedIdentityServiceMessages.java
new file mode 100644
index 0000000000..1241e54e72
--- /dev/null
+++ b/gateway-server/src/main/java/org/apache/knox/gateway/services/knoxidf/federation/FederatedIdentityServiceMessages.java
@@ -0,0 +1,38 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with this
+ * work for additional information regarding copyright ownership. The ASF
+ * licenses this file to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+ * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+ * License for the specific language governing permissions and limitations under
+ * the License.
+ */
+package org.apache.knox.gateway.services.knoxidf.federation;
+
+import org.apache.knox.gateway.i18n.messages.Message;
+import org.apache.knox.gateway.i18n.messages.MessageLevel;
+import org.apache.knox.gateway.i18n.messages.Messages;
+import org.apache.knox.gateway.i18n.messages.StackTrace;
+
+@Messages(logger="org.apache.knox.gateway.knoxidf.federated.identity.service")
+public interface FederatedIdentityServiceMessages {
+
+ @Message(level = MessageLevel.ERROR, text = "An error occurred while saving federated identity {0} in the database : {1}")
+ void errorSavingFederatedIdentityInDatabase(String federatedIdentityId, String errorMessage, @StackTrace(level = MessageLevel.DEBUG) Exception e);
+
+ @Message(level = MessageLevel.ERROR, text = "An error occurred while fetching federated identity ({0} / {1} / {2}) from the database : {3}")
+ void errorFetchingFederatedIdentityFromDatabase(String provider, String issuer, String subject, String errorMessage, @StackTrace(level = MessageLevel.DEBUG) Exception e);
+
+ @Message(level = MessageLevel.ERROR, text = "An error occurred while fetching federated identity ({0}) from the database : {1}")
+ void errorFetchingFederatedIdentityFromDatabase(String id, String errorMessage, @StackTrace(level = MessageLevel.DEBUG) Exception e);
+
+ @Message(level = MessageLevel.DEBUG, text = "Federated identity ({0} / {1} / {2}) already exists; skipping insert")
+ void federatedIdentityAlreadyExists(String provider, String issuer, String subject);
+}
diff --git a/gateway-server/src/main/java/org/apache/knox/gateway/services/knoxidf/federation/JdbcFederatedIdentityService.java b/gateway-server/src/main/java/org/apache/knox/gateway/services/knoxidf/federation/JdbcFederatedIdentityService.java
new file mode 100644
index 0000000000..aec849d67c
--- /dev/null
+++ b/gateway-server/src/main/java/org/apache/knox/gateway/services/knoxidf/federation/JdbcFederatedIdentityService.java
@@ -0,0 +1,146 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with this
+ * work for additional information regarding copyright ownership. The ASF
+ * licenses this file to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+ * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+ * License for the specific language governing permissions and limitations under
+ * the License.
+ */
+package org.apache.knox.gateway.services.knoxidf.federation;
+
+import org.apache.knox.gateway.config.GatewayConfig;
+import org.apache.knox.gateway.database.DataSourceProvider;
+import org.apache.knox.gateway.i18n.messages.MessagesFactory;
+import org.apache.knox.gateway.services.ServiceLifecycleException;
+import org.apache.knox.gateway.services.security.AliasService;
+
+import java.sql.SQLException;
+import java.sql.SQLIntegrityConstraintViolationException;
+import java.util.Map;
+import java.util.Optional;
+import java.util.concurrent.atomic.AtomicBoolean;
+import java.util.concurrent.locks.Lock;
+import java.util.concurrent.locks.ReentrantLock;
+
+public class JdbcFederatedIdentityService implements FederatedIdentityService {
+ private static final FederatedIdentityServiceMessages LOG = MessagesFactory.get(FederatedIdentityServiceMessages.class);
+
+ private final AtomicBoolean initialized = new AtomicBoolean(false);
+ private final Lock initLock = new ReentrantLock(true);
+ private AliasService aliasService; // connection username/pw are stored here
+ private FederatedIdentityDatabase federatedIdentityDatabase;
+
+ @Override
+ public void init(GatewayConfig config, Map options) throws ServiceLifecycleException {
+ if (!initialized.get()) {
+ initLock.lock();
+ try {
+ // Double-checked locking: re-test under the lock so a thread that blocked while
+ // another was initialising does not re-initialise the database a second time.
+ if (!initialized.get()) {
+ if (aliasService == null) {
+ throw new ServiceLifecycleException("The required AliasService reference has not been set.");
+ }
+ try {
+ this.federatedIdentityDatabase = new FederatedIdentityDatabase(DataSourceProvider.getDataSource(config, aliasService), config.getDatabaseType());
+ initialized.set(true);
+ } catch (Exception e) {
+ throw new ServiceLifecycleException("Error while initiating JdbcFederatedIdentityService: " + e, e);
+ }
+ }
+ } finally {
+ initLock.unlock();
+ }
+ }
+ }
+
+ @Override
+ public void start() throws ServiceLifecycleException {
+ }
+
+ @Override
+ public void stop() throws ServiceLifecycleException {
+ }
+
+ public void setAliasService(AliasService aliasService) {
+ this.aliasService = aliasService;
+ }
+
+ protected AliasService getAliasService() {
+ return aliasService;
+ }
+
+ @Override
+ public FederatedIdentity addFederatedIdentity(FederatedIdentity identity) {
+ // Insert-and-catch rather than check-then-insert: the UNIQUE(provider, external_issuer,
+ // external_subject) index is the atomic arbiter, so two concurrent requests for the same
+ // external identity cannot both insert. A unique-constraint violation means the row already
+ // exists, which is exactly the desired end state, so it is treated as benign rather than
+ // surfaced as an error (closing the prior TOCTOU race between the pre-check and the insert).
+ try {
+ federatedIdentityDatabase.addFederatedIdentity(identity);
+ return identity;
+ } catch (SQLException e) {
+ if (isUniqueConstraintViolation(e)) {
+ LOG.federatedIdentityAlreadyExists(identity.getProvider(), identity.getExternalIssuer(), identity.getExternalSubject());
+ // The concurrent winner owns the canonical primary key; our in-memory identity carries a
+ // different random id (UUID.randomUUID) that was never persisted. Return the stored row so
+ // callers never mint a token/auth-code against a phantom id. Fall back to the local copy
+ // only if the re-query itself fails (findByProviderAndSubject swallows read errors).
+ return findByProviderAndSubject(identity.getProvider(), identity.getExternalIssuer(),
+ identity.getExternalSubject()).orElse(identity);
+ }
+ LOG.errorSavingFederatedIdentityInDatabase(identity.getId(), e.getMessage(), e);
+ throw new FederatedIdentityServiceException("An error occurred while saving Federated Identity " + identity.getId() + " in the database", e);
+ }
+ }
+
+ /**
+ * Recognises a unique/primary-key constraint violation across dialects: either a
+ * {@link SQLIntegrityConstraintViolationException} or any {@link SQLException} in the cause
+ * chain whose SQLState is in the {@code 23} (integrity constraint violation) class.
+ */
+ private static boolean isUniqueConstraintViolation(SQLException e) {
+ for (Throwable t = e; t != null; t = t.getCause()) {
+ if (t instanceof SQLIntegrityConstraintViolationException) {
+ return true;
+ }
+ if (t instanceof SQLException) {
+ final String sqlState = ((SQLException) t).getSQLState();
+ if (sqlState != null && sqlState.startsWith("23")) {
+ return true;
+ }
+ }
+ }
+ return false;
+ }
+
+ @Override
+ public Optional findByProviderAndSubject(String provider, String issuer, String subject) {
+ try {
+ return federatedIdentityDatabase.findByProviderAndSubject(provider, issuer, subject);
+ } catch (SQLException e) {
+ LOG.errorFetchingFederatedIdentityFromDatabase(provider, subject, issuer, e.getMessage(), e);
+ }
+ return Optional.empty();
+ }
+
+ @Override
+ public Optional findById(String id) {
+ try {
+ return federatedIdentityDatabase.findById(id);
+ } catch (SQLException e) {
+ LOG.errorFetchingFederatedIdentityFromDatabase(id, e.getMessage(), e);
+ }
+ return Optional.empty();
+ }
+
+}
diff --git a/gateway-server/src/main/java/org/apache/knox/gateway/services/knoxidf/trustedoidcissuer/DerbyDBTrustedOidcIssuerService.java b/gateway-server/src/main/java/org/apache/knox/gateway/services/knoxidf/trustedoidcissuer/DerbyDBTrustedOidcIssuerService.java
new file mode 100644
index 0000000000..f1c73e9b38
--- /dev/null
+++ b/gateway-server/src/main/java/org/apache/knox/gateway/services/knoxidf/trustedoidcissuer/DerbyDBTrustedOidcIssuerService.java
@@ -0,0 +1,102 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with this
+ * work for additional information regarding copyright ownership. The ASF
+ * licenses this file to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+ * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+ * License for the specific language governing permissions and limitations under
+ * the License.
+ */
+package org.apache.knox.gateway.services.knoxidf.trustedoidcissuer;
+
+import static org.apache.knox.gateway.config.impl.GatewayConfigImpl.GATEWAY_DATABASE_NAME;
+import static org.apache.knox.gateway.config.impl.GatewayConfigImpl.GATEWAY_DATABASE_TYPE;
+import static org.apache.knox.gateway.database.AbstractDataSourceFactory.DATABASE_PASSWORD_ALIAS_NAME;
+import static org.apache.knox.gateway.database.AbstractDataSourceFactory.DATABASE_USER_ALIAS_NAME;
+import static org.apache.knox.gateway.database.DatabaseType.DERBY;
+import static org.apache.knox.gateway.services.security.AliasService.NO_CLUSTER_NAME;
+
+import java.nio.file.Path;
+import java.nio.file.Paths;
+import java.util.Map;
+import java.util.concurrent.TimeUnit;
+
+import org.apache.hadoop.conf.Configuration;
+import org.apache.knox.gateway.config.GatewayConfig;
+import org.apache.knox.gateway.services.ServiceLifecycleException;
+import org.apache.knox.gateway.services.security.MasterService;
+import org.apache.knox.gateway.services.token.impl.DerbyDBTokenStateService;
+import org.apache.knox.gateway.shell.jdbc.derby.DerbyDatabase;
+
+/**
+ * A self-provisioning, embedded-Derby backed {@link TrustedOidcIssuerService}. This is the
+ * auto-enabled default when KnoxIDF is deployed without an operator-configured external database,
+ * mirroring how {@link DerbyDBTokenStateService} is the default token-state service and
+ * {@code DerbyDBFederatedIdentityService} is the default federated-identity service.
+ *
+ * It reuses the single embedded Derby database that the token-state service already provisions
+ * under {@code ${securityDir}/tokens} (the {@code ;create=true} JDBC URL is idempotent, so
+ * connecting to an already-booted database simply connects), sets the shared {@link GatewayConfig}
+ * to point at it, ensures the connection user/password aliases exist, and then delegates all
+ * persistence to {@link JdbcTrustedOidcIssuerService} (which builds the
+ * {@link TrustedOidcIssuerDatabase} and self-creates its table).
+ */
+public class DerbyDBTrustedOidcIssuerService extends JdbcTrustedOidcIssuerService {
+
+ private DerbyDatabase derbyDatabase;
+ private Path derbyDatabaseFolder;
+ private MasterService masterService;
+
+ public void setMasterService(MasterService masterService) {
+ this.masterService = masterService;
+ }
+
+ @Override
+ public void init(GatewayConfig config, Map options) throws ServiceLifecycleException {
+ try {
+ derbyDatabaseFolder = Paths.get(config.getGatewaySecurityDir(), DerbyDBTokenStateService.DB_NAME);
+ startDerby();
+ ((Configuration) config).set(GATEWAY_DATABASE_TYPE, DERBY.type());
+ ((Configuration) config).set(GATEWAY_DATABASE_NAME, derbyDatabaseFolder.toString());
+ getAliasService().addAliasForCluster(NO_CLUSTER_NAME, DATABASE_USER_ALIAS_NAME, getDatabaseUserName());
+ getAliasService().addAliasForCluster(NO_CLUSTER_NAME, DATABASE_PASSWORD_ALIAS_NAME, getDatabasePassword());
+ super.init(config, options);
+ } catch (Exception e) {
+ throw new ServiceLifecycleException("Error while initiating DerbyDBTrustedOidcIssuerService: " + e, e);
+ }
+ }
+
+ private void startDerby() throws Exception {
+ derbyDatabase = new DerbyDatabase(derbyDatabaseFolder.toString());
+ derbyDatabase.create();
+ TimeUnit.SECONDS.sleep(1); // give a bit of time for the server to start
+ }
+
+ private String getDatabasePassword() throws Exception {
+ final char[] dbPasswordAliasValue = getAliasService().getPasswordFromAliasForGateway(DATABASE_PASSWORD_ALIAS_NAME);
+ return dbPasswordAliasValue != null ? new String(dbPasswordAliasValue) : new String(masterService.getMasterSecret());
+ }
+
+ private String getDatabaseUserName() throws Exception {
+ final char[] dbUserAliasValue = getAliasService().getPasswordFromAliasForGateway(DATABASE_USER_ALIAS_NAME);
+ return dbUserAliasValue != null ? new String(dbUserAliasValue) : DerbyDBTokenStateService.DEFAULT_TOKEN_DB_USER_NAME;
+ }
+
+ @Override
+ public void stop() throws ServiceLifecycleException {
+ try {
+ if (derbyDatabase != null) {
+ derbyDatabase.shutdown();
+ }
+ } catch (Exception e) {
+ throw new ServiceLifecycleException("Error while shutting down Derby Database", e);
+ }
+ }
+}
diff --git a/gateway-server/src/main/java/org/apache/knox/gateway/services/knoxidf/trustedoidcissuer/EmptyTrustedOidcIssuerService.java b/gateway-server/src/main/java/org/apache/knox/gateway/services/knoxidf/trustedoidcissuer/EmptyTrustedOidcIssuerService.java
new file mode 100644
index 0000000000..506b31d657
--- /dev/null
+++ b/gateway-server/src/main/java/org/apache/knox/gateway/services/knoxidf/trustedoidcissuer/EmptyTrustedOidcIssuerService.java
@@ -0,0 +1,81 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with this
+ * work for additional information regarding copyright ownership. The ASF
+ * licenses this file to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+ * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+ * License for the specific language governing permissions and limitations under
+ * the License.
+ */
+package org.apache.knox.gateway.services.knoxidf.trustedoidcissuer;
+
+import org.apache.knox.gateway.config.GatewayConfig;
+import org.apache.knox.gateway.services.ServiceLifecycleException;
+
+import java.util.Collections;
+import java.util.List;
+import java.util.Map;
+import java.util.Optional;
+
+/**
+ * No-op stub used when the KNOXIDF or KNOXIDF_ADMIN service role is not deployed.
+ * Read methods return safe empty results; mutating methods throw
+ * {@link UnsupportedOperationException}.
+ */
+public class EmptyTrustedOidcIssuerService implements TrustedOidcIssuerService {
+
+ @Override
+ public void init(GatewayConfig config, Map options) throws ServiceLifecycleException {
+ }
+
+ @Override
+ public void start() throws ServiceLifecycleException {
+ }
+
+ @Override
+ public void stop() throws ServiceLifecycleException {
+ }
+
+ @Override
+ public boolean isTrusted(String issuerUrl) {
+ return false;
+ }
+
+ @Override
+ public boolean isDynamicJwks(String issuerUrl) {
+ return false;
+ }
+
+ @Override
+ public Optional resolveJwksUri(String issuerUrl) {
+ return Optional.empty();
+ }
+
+ @Override
+ public void refreshJwksUri(String issuerUrl) {
+ }
+
+ @Override
+ public void register(TrustedOidcIssuer issuer) {
+ throw new UnsupportedOperationException("TrustedOidcIssuerService is not enabled; "
+ + "deploy the KNOXIDF or KNOXIDF_ADMIN service role to activate it.");
+ }
+
+ @Override
+ public void deregister(String issuerUrl) {
+ throw new UnsupportedOperationException("TrustedOidcIssuerService is not enabled; "
+ + "deploy the KNOXIDF or KNOXIDF_ADMIN service role to activate it.");
+ }
+
+ @Override
+ public List list() {
+ return Collections.emptyList();
+ }
+}
diff --git a/gateway-server/src/main/java/org/apache/knox/gateway/services/knoxidf/trustedoidcissuer/JdbcTrustedOidcIssuerService.java b/gateway-server/src/main/java/org/apache/knox/gateway/services/knoxidf/trustedoidcissuer/JdbcTrustedOidcIssuerService.java
new file mode 100644
index 0000000000..3f345fe571
--- /dev/null
+++ b/gateway-server/src/main/java/org/apache/knox/gateway/services/knoxidf/trustedoidcissuer/JdbcTrustedOidcIssuerService.java
@@ -0,0 +1,187 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with this
+ * work for additional information regarding copyright ownership. The ASF
+ * licenses this file to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+ * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+ * License for the specific language governing permissions and limitations under
+ * the License.
+ */
+package org.apache.knox.gateway.services.knoxidf.trustedoidcissuer;
+
+import org.apache.knox.gateway.config.GatewayConfig;
+import org.apache.knox.gateway.database.DataSourceProvider;
+import org.apache.knox.gateway.i18n.messages.MessagesFactory;
+import org.apache.knox.gateway.services.ServiceLifecycleException;
+import org.apache.knox.gateway.services.security.AliasService;
+
+import java.sql.SQLException;
+import java.util.ArrayList;
+import java.util.Collections;
+import java.util.List;
+import java.util.Map;
+import java.util.Optional;
+import java.util.concurrent.atomic.AtomicBoolean;
+import java.util.concurrent.atomic.AtomicReference;
+import java.util.concurrent.locks.Lock;
+import java.util.concurrent.locks.ReentrantLock;
+import java.util.function.Function;
+import java.util.stream.Collectors;
+
+/**
+ * JDBC-backed implementation of {@link TrustedOidcIssuerService}.
+ *
+ * Maintains an in-memory registry snapshot as an {@link AtomicReference} to an immutable
+ * {@link Map}. Reads ({@link #isTrusted}, {@link #isDynamicJwks}, {@link #list}) are
+ * lock-free and always see a consistent snapshot. Writes ({@link #register},
+ * {@link #deregister}) are synchronized: the DB is committed first, then the snapshot is
+ * rebuilt from a fresh SELECT to guarantee the in-memory state cannot diverge from
+ * persistent storage.
+ *
+ * HA note: each Knox node maintains its own snapshot. A registration on node A updates
+ * that node's snapshot immediately; other nodes' snapshots remain stale until restart.
+ */
+public class JdbcTrustedOidcIssuerService implements TrustedOidcIssuerService {
+
+ private static final TrustedOidcIssuerServiceMessages LOG =
+ MessagesFactory.get(TrustedOidcIssuerServiceMessages.class);
+
+
+ private final AtomicBoolean initialized = new AtomicBoolean(false);
+ private final Lock initLock = new ReentrantLock(true);
+
+ private final AtomicReference> registrySnapshot =
+ new AtomicReference<>(Collections.emptyMap());
+
+ private AliasService aliasService;
+ private TrustedOidcIssuerDatabase database;
+ private OIDCDiscoveryHelper discoveryHelper;
+ private int maxTrustedIssuers;
+
+ @Override
+ public void init(GatewayConfig config, Map options) throws ServiceLifecycleException {
+ if (!initialized.get()) {
+ initLock.lock();
+ try {
+ // Double-checked locking: re-test under the lock so a thread that blocked while another was
+ // initialising does not re-initialise the database/discoveryHelper a second time (mirrors
+ // JdbcFederatedIdentityService). Without this inner check a startup race overwrote the
+ // already-built database and discoveryHelper references.
+ if (!initialized.get()) {
+ if (aliasService == null) {
+ throw new ServiceLifecycleException("The required AliasService reference has not been set.");
+ }
+ try {
+ this.maxTrustedIssuers = config.getTrustedOidcIssuerMaxTrustedIssuers();
+ this.database = new TrustedOidcIssuerDatabase(
+ DataSourceProvider.getDataSource(config, aliasService), config.getDatabaseType());
+ this.discoveryHelper = new OIDCDiscoveryHelper(this, config.getTrustedOidcIssuerDiscoveryCacheTtlSecs(),
+ OIDCDiscoveryHelper.buildHttpClient(config.getTrustedOidcIssuerDiscoveryConnectTimeoutMs(), config.getTrustedOidcIssuerDiscoveryReadTimeoutMs()));
+ reloadRegistrySnapshot();
+ initialized.set(true);
+ } catch (ServiceLifecycleException e) {
+ throw e;
+ } catch (Exception e) {
+ throw new ServiceLifecycleException("Error initializing JdbcTrustedOidcIssuerService: " + e, e);
+ }
+ }
+ } finally {
+ initLock.unlock();
+ }
+ }
+ }
+
+ @Override
+ public void start() throws ServiceLifecycleException {
+ }
+
+ @Override
+ public void stop() throws ServiceLifecycleException {
+ }
+
+ public void setAliasService(AliasService aliasService) {
+ this.aliasService = aliasService;
+ }
+
+ protected AliasService getAliasService() {
+ return aliasService;
+ }
+
+ @Override
+ public boolean isTrusted(String issuerUrl) {
+ return registrySnapshot.get().containsKey(issuerUrl);
+ }
+
+ @Override
+ public boolean isDynamicJwks(String issuerUrl) {
+ final TrustedOidcIssuer entry = registrySnapshot.get().get(issuerUrl);
+ return entry != null && entry.isDynamicJwks();
+ }
+
+ @Override
+ public Optional resolveJwksUri(String issuerUrl) {
+ return discoveryHelper.discoverJwksUri(issuerUrl);
+ }
+
+ @Override
+ public synchronized void register(TrustedOidcIssuer issuer) {
+ if (registrySnapshot.get().size() >= maxTrustedIssuers) {
+ throw new IllegalStateException(
+ "Cannot register issuer: MAX_TRUSTED_ISSUERS (" + maxTrustedIssuers + ") reached");
+ }
+ try {
+ database.insert(issuer);
+ } catch (SQLException e) {
+ LOG.errorRegisteringIssuer(issuer.getIssuerUrl(), e.getMessage(), e);
+ throw new RuntimeException("Error registering trusted OIDC issuer: " + issuer.getIssuerUrl(), e);
+ }
+ reloadRegistrySnapshot();
+ }
+
+ @Override
+ public synchronized void deregister(String issuerUrl) {
+ try {
+ database.delete(issuerUrl);
+ } catch (SQLException e) {
+ LOG.errorDeregisteringIssuer(issuerUrl, e.getMessage(), e);
+ throw new RuntimeException("Error deregistering trusted OIDC issuer: " + issuerUrl, e);
+ }
+ reloadRegistrySnapshot();
+ discoveryHelper.invalidate(issuerUrl);
+ }
+
+ @Override
+ public void refreshJwksUri(String issuerUrl) {
+ if (isDynamicJwks(issuerUrl)) {
+ discoveryHelper.invalidate(issuerUrl);
+ }
+ }
+
+ @Override
+ public List list() {
+ return new ArrayList<>(registrySnapshot.get().values());
+ }
+
+ /**
+ * Rebuilds the registry snapshot from the current DB state.
+ * Called on init, after register, and after deregister.
+ * Synchronized on this to prevent concurrent rebuilds from interleaving with mutations.
+ */
+ private synchronized void reloadRegistrySnapshot() {
+ try {
+ final Map fresh = database.selectAll().stream()
+ .collect(Collectors.toMap(TrustedOidcIssuer::getIssuerUrl, Function.identity()));
+ registrySnapshot.set(Collections.unmodifiableMap(fresh));
+ } catch (Exception e) {
+ LOG.errorReloadingRegistrySnapshot(e.getMessage(), e);
+ throw new RuntimeException("Error reloading trusted OIDC issuer registry snapshot", e);
+ }
+ }
+}
diff --git a/gateway-server/src/main/java/org/apache/knox/gateway/services/knoxidf/trustedoidcissuer/OIDCDiscoveryHelper.java b/gateway-server/src/main/java/org/apache/knox/gateway/services/knoxidf/trustedoidcissuer/OIDCDiscoveryHelper.java
new file mode 100644
index 0000000000..2c830bebb7
--- /dev/null
+++ b/gateway-server/src/main/java/org/apache/knox/gateway/services/knoxidf/trustedoidcissuer/OIDCDiscoveryHelper.java
@@ -0,0 +1,176 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with this
+ * work for additional information regarding copyright ownership. The ASF
+ * licenses this file to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+ * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+ * License for the specific language governing permissions and limitations under
+ * the License.
+ */
+package org.apache.knox.gateway.services.knoxidf.trustedoidcissuer;
+
+import com.github.benmanes.caffeine.cache.Cache;
+import com.github.benmanes.caffeine.cache.Caffeine;
+import com.nimbusds.openid.connect.sdk.op.OIDCProviderMetadata;
+import org.apache.http.client.config.RequestConfig;
+import org.apache.http.client.methods.CloseableHttpResponse;
+import org.apache.http.client.methods.HttpGet;
+import org.apache.http.impl.client.CloseableHttpClient;
+import org.apache.http.impl.client.DefaultHttpRequestRetryHandler;
+import org.apache.http.impl.client.HttpClients;
+import org.apache.http.util.EntityUtils;
+import org.apache.knox.gateway.i18n.messages.MessagesFactory;
+
+import java.net.URI;
+import java.util.Optional;
+import java.util.concurrent.TimeUnit;
+
+/**
+ * Fetches and caches JWKS URIs resolved from OIDC provider discovery documents
+ * (/.well-known/openid-configuration). Backed by a Caffeine time-based cache.
+ *
+ * SSRF gate: {@link #discoverJwksUri(String)} returns {@link Optional#empty()} immediately
+ * for any issuer not registered for dynamic JWKS. No HTTP call is ever made for
+ * untrusted or static-JWKS issuers.
+ *
+ * The {@link CloseableHttpClient} is injected at construction time so that tests can
+ * supply a mock and verify the full fetch-and-parse code path without overriding methods.
+ * Production callers use {@link #buildHttpClient(int, int)} to obtain a properly
+ * configured long-lived client.
+ */
+class OIDCDiscoveryHelper {
+
+ private static final TrustedOidcIssuerServiceMessages LOG =
+ MessagesFactory.get(TrustedOidcIssuerServiceMessages.class);
+
+ private static final String USER_AGENT = "Apache-Knox-OIDCDiscovery/1.0";
+ private static final int HTTP_RETRY_COUNT = 2;
+ // Idle connections in the pool are closed after this duration so the next cache-miss
+ // fetch always goes through a fresh connection rather than a potentially stale one.
+ private static final long IDLE_EVICTION_SECONDS = 60L;
+
+ private final TrustedOidcIssuerService trustedIssuers;
+ // OIDC discovery document cache: issuerUrl → jwks_uri resolved from discovery endpoint.
+ // Entries expire after cacheTtlSeconds and are re-fetched lazily on the next access.
+ private final Cache discoveryDocumentCache;
+ private final CloseableHttpClient httpClient;
+
+ /**
+ * Creates an {@code OIDCDiscoveryHelper} with the supplied HTTP client. Use
+ * {@link #buildHttpClient(int, int)} to obtain the production-configured client.
+ */
+ OIDCDiscoveryHelper(TrustedOidcIssuerService trustedIssuers, long cacheTtlSeconds,
+ CloseableHttpClient httpClient) {
+ this.trustedIssuers = trustedIssuers;
+ this.discoveryDocumentCache = Caffeine.newBuilder()
+ .expireAfterWrite(cacheTtlSeconds, TimeUnit.SECONDS)
+ .build();
+ this.httpClient = httpClient;
+ }
+
+ /**
+ * Builds a production-configured {@link CloseableHttpClient} for OIDC discovery fetches.
+ *
+ * {@code requestSentRetryEnabled=true}: Discovery endpoints are GET-only (idempotent by RFC 7231
+ * §4.2.2), so retrying after the request was sent is safe and covers the most common
+ * failure mode — connection reset mid-response.
+ *
+ * {@code evictIdleConnections} + {@code evictExpiredConnections}: the client is held for the
+ * gateway process lifetime. Without eviction, pooled connections become stale when the remote
+ * server or a network middlebox closes them silently, causing the next fetch to fail with a
+ * {@code NoHttpResponseException} before the retry handler can save it.
+ */
+ static CloseableHttpClient buildHttpClient(int connectTimeoutMs, int readTimeoutMs) {
+ final RequestConfig requestConfig = RequestConfig.custom()
+ .setConnectTimeout(connectTimeoutMs)
+ .setSocketTimeout(readTimeoutMs)
+ .build();
+ return HttpClients.custom()
+ .setDefaultRequestConfig(requestConfig)
+ .setRetryHandler(new DefaultHttpRequestRetryHandler(HTTP_RETRY_COUNT, true))
+ .evictIdleConnections(IDLE_EVICTION_SECONDS, TimeUnit.SECONDS)
+ .evictExpiredConnections()
+ .build();
+ }
+
+ /**
+ * Returns the JWKS URI for the given issuer URL, resolving it via OIDC discovery if
+ * not already cached. Returns {@link Optional#empty()} immediately without any HTTP
+ * call if the issuer is not registered for dynamic JWKS — this is the primary SSRF gate.
+ *
+ * {@code Cache.get(key, mappingFunction)} is atomic per key: concurrent cache misses for the
+ * same issuer block on a single {@link #fetchJwksUri} call and share its result. If
+ * {@link #fetchJwksUri} returns null (on any error), Caffeine does not cache null, so the
+ * next call retries transparently.
+ */
+ Optional discoverJwksUri(String issuerUrl) {
+ if (!trustedIssuers.isDynamicJwks(issuerUrl)) {
+ return Optional.empty();
+ }
+ return Optional.ofNullable(discoveryDocumentCache.get(issuerUrl, this::fetchJwksUri));
+ }
+
+ /**
+ * Evicts the cached JWKS URI for the given issuer so the next call to
+ * {@link #discoverJwksUri(String)} re-fetches from the discovery endpoint.
+ */
+ void invalidate(String issuerUrl) {
+ discoveryDocumentCache.invalidate(issuerUrl);
+ }
+
+ /**
+ * Fetches the JWKS URI by retrieving and parsing the OIDC discovery document for the
+ * given issuer. The discovery URL is constructed by stripping any trailing slash from
+ * the issuer URL and appending {@code /.well-known/openid-configuration}.
+ * Returns null on any error so Caffeine does not cache the failure and the next call retries.
+ */
+ String fetchJwksUri(String issuerUrl) {
+ final String discoveryUrl = issuerUrl.replaceAll("/$", "") + "/.well-known/openid-configuration";
+ final String body = httpGet(issuerUrl, discoveryUrl);
+ if (body == null) {
+ return null;
+ }
+ try {
+ final URI jwksUri = OIDCProviderMetadata.parse(body).getJWKSetURI();
+ if (jwksUri == null) {
+ // Defensive: OIDC spec requires jwks_uri; Nimbus 11.x throws ParseException if absent,
+ // but a non-compliant or future-lenient implementation could return null here.
+ LOG.errorParsingDiscoveryDocument(issuerUrl,
+ "discovery document contains no jwks_uri", null);
+ return null;
+ }
+ return jwksUri.toString();
+ } catch (Exception e) {
+ LOG.errorParsingDiscoveryDocument(issuerUrl, e.getMessage(), e);
+ return null;
+ }
+ }
+
+ /**
+ * Executes a GET request against the given URL and returns the response body as a string.
+ * Logs any failure and returns null so the caller knows not to cache the result.
+ */
+ private String httpGet(String issuerUrl, String url) {
+ final HttpGet request = new HttpGet(url);
+ request.setHeader("User-Agent", USER_AGENT);
+ try (CloseableHttpResponse response = httpClient.execute(request)) {
+ final int statusCode = response.getStatusLine().getStatusCode();
+ if (statusCode != 200) {
+ LOG.errorFetchingDiscoveryDocument(issuerUrl, url, "HTTP " + statusCode,
+ new java.io.IOException("Non-200 status: " + statusCode));
+ return null;
+ }
+ return EntityUtils.toString(response.getEntity());
+ } catch (Exception e) {
+ LOG.errorFetchingDiscoveryDocument(issuerUrl, url, e.getMessage(), e);
+ return null;
+ }
+ }
+}
diff --git a/gateway-server/src/main/java/org/apache/knox/gateway/services/knoxidf/trustedoidcissuer/TrustedOidcIssuerDatabase.java b/gateway-server/src/main/java/org/apache/knox/gateway/services/knoxidf/trustedoidcissuer/TrustedOidcIssuerDatabase.java
new file mode 100644
index 0000000000..05b9d4f723
--- /dev/null
+++ b/gateway-server/src/main/java/org/apache/knox/gateway/services/knoxidf/trustedoidcissuer/TrustedOidcIssuerDatabase.java
@@ -0,0 +1,91 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with this
+ * work for additional information regarding copyright ownership. The ASF
+ * licenses this file to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+ * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+ * License for the specific language governing permissions and limitations under
+ * the License.
+ */
+package org.apache.knox.gateway.services.knoxidf.trustedoidcissuer;
+
+import org.apache.knox.gateway.database.DatabaseType;
+import org.apache.knox.gateway.database.KnoxDatabase;
+
+import javax.sql.DataSource;
+import java.sql.Connection;
+import java.sql.PreparedStatement;
+import java.sql.ResultSet;
+import java.sql.SQLException;
+import java.sql.Timestamp;
+import java.util.ArrayList;
+import java.util.List;
+
+/**
+ * JDBC helper for the {@code TRUSTED_OIDC_ISSUERS} table.
+ * All SQL uses {@link PreparedStatement} with {@code ?} parameters only.
+ * Uses {@link ResultSet#getBoolean(String)} for the {@code dynamic_jwks} column,
+ * which correctly maps both BOOLEAN (standard/Derby) and NUMBER(1) (Oracle) values.
+ */
+class TrustedOidcIssuerDatabase extends KnoxDatabase {
+
+ static final String TABLE_NAME = "TRUSTED_OIDC_ISSUERS";
+
+ private static final String INSERT_SQL =
+ "INSERT INTO " + TABLE_NAME + " (issuer_url, dynamic_jwks, cluster_name, registered_at, registered_by) VALUES (?, ?, ?, ?, ?)";
+ private static final String DELETE_SQL =
+ "DELETE FROM " + TABLE_NAME + " WHERE issuer_url = ?";
+ private static final String SELECT_ALL_SQL =
+ "SELECT issuer_url, dynamic_jwks, cluster_name, registered_at, registered_by FROM " + TABLE_NAME;
+
+ TrustedOidcIssuerDatabase(DataSource dataSource, String dbType) throws Exception {
+ super(dataSource);
+ final DatabaseType databaseType = DatabaseType.fromString(dbType);
+ createTableIfNotExists(TABLE_NAME, databaseType.trustedOidcIssuersTableSql());
+ }
+
+ void insert(TrustedOidcIssuer issuer) throws SQLException {
+ try (Connection connection = dataSource.getConnection();
+ PreparedStatement ps = connection.prepareStatement(INSERT_SQL)) {
+ ps.setString(1, issuer.getIssuerUrl());
+ ps.setBoolean(2, issuer.isDynamicJwks());
+ ps.setString(3, issuer.getClusterName());
+ ps.setTimestamp(4, Timestamp.from(issuer.getRegisteredAt()));
+ ps.setString(5, issuer.getRegisteredBy());
+ ps.executeUpdate();
+ }
+ }
+
+ void delete(String issuerUrl) throws SQLException {
+ try (Connection connection = dataSource.getConnection();
+ PreparedStatement ps = connection.prepareStatement(DELETE_SQL)) {
+ ps.setString(1, issuerUrl);
+ ps.executeUpdate();
+ }
+ }
+
+ List selectAll() throws SQLException {
+ final List result = new ArrayList<>();
+ try (Connection connection = dataSource.getConnection();
+ PreparedStatement ps = connection.prepareStatement(SELECT_ALL_SQL);
+ ResultSet rs = ps.executeQuery()) {
+ while (rs.next()) {
+ result.add(new TrustedOidcIssuer(
+ rs.getString("issuer_url"),
+ rs.getBoolean("dynamic_jwks"),
+ rs.getString("cluster_name"),
+ rs.getTimestamp("registered_at").toInstant(),
+ rs.getString("registered_by")
+ ));
+ }
+ }
+ return result;
+ }
+}
diff --git a/gateway-server/src/main/java/org/apache/knox/gateway/services/knoxidf/trustedoidcissuer/TrustedOidcIssuerServiceMessages.java b/gateway-server/src/main/java/org/apache/knox/gateway/services/knoxidf/trustedoidcissuer/TrustedOidcIssuerServiceMessages.java
new file mode 100644
index 0000000000..1918bec476
--- /dev/null
+++ b/gateway-server/src/main/java/org/apache/knox/gateway/services/knoxidf/trustedoidcissuer/TrustedOidcIssuerServiceMessages.java
@@ -0,0 +1,51 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with this
+ * work for additional information regarding copyright ownership. The ASF
+ * licenses this file to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+ * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+ * License for the specific language governing permissions and limitations under
+ * the License.
+ */
+package org.apache.knox.gateway.services.knoxidf.trustedoidcissuer;
+
+import org.apache.knox.gateway.i18n.messages.Message;
+import org.apache.knox.gateway.i18n.messages.MessageLevel;
+import org.apache.knox.gateway.i18n.messages.Messages;
+import org.apache.knox.gateway.i18n.messages.StackTrace;
+
+@Messages(logger = "org.apache.knox.gateway.knoxidf.trustedoidcissuer.service")
+interface TrustedOidcIssuerServiceMessages {
+
+ @Message(level = MessageLevel.ERROR,
+ text = "Failed to fetch OIDC discovery document for issuer {0} from {1}: {2}")
+ void errorFetchingDiscoveryDocument(String issuerUrl, String discoveryUrl, String cause,
+ @StackTrace(level = MessageLevel.DEBUG) Exception e);
+
+ @Message(level = MessageLevel.ERROR,
+ text = "Failed to parse OIDC discovery document for issuer {0}: {1}")
+ void errorParsingDiscoveryDocument(String issuerUrl, String cause,
+ @StackTrace(level = MessageLevel.DEBUG) Exception e);
+
+ @Message(level = MessageLevel.ERROR,
+ text = "Error registering trusted OIDC issuer {0}: {1}")
+ void errorRegisteringIssuer(String issuerUrl, String cause,
+ @StackTrace(level = MessageLevel.DEBUG) Exception e);
+
+ @Message(level = MessageLevel.ERROR,
+ text = "Error deregistering trusted OIDC issuer {0}: {1}")
+ void errorDeregisteringIssuer(String issuerUrl, String cause,
+ @StackTrace(level = MessageLevel.DEBUG) Exception e);
+
+ @Message(level = MessageLevel.ERROR,
+ text = "Error reloading trusted OIDC issuer registry snapshot: {0}")
+ void errorReloadingRegistrySnapshot(String cause,
+ @StackTrace(level = MessageLevel.DEBUG) Exception e);
+}
diff --git a/gateway-server/src/main/java/org/apache/knox/gateway/services/ldap/KnoxLDAPServerManager.java b/gateway-server/src/main/java/org/apache/knox/gateway/services/ldap/KnoxLDAPServerManager.java
index 3e42c2117c..e4445276e1 100644
--- a/gateway-server/src/main/java/org/apache/knox/gateway/services/ldap/KnoxLDAPServerManager.java
+++ b/gateway-server/src/main/java/org/apache/knox/gateway/services/ldap/KnoxLDAPServerManager.java
@@ -72,7 +72,8 @@ public class KnoxLDAPServerManager {
@VisibleForTesting
DirectoryService directoryService;
- private LdapServer ldapServer;
+ @VisibleForTesting
+ LdapServer ldapServer;
private GatewayConfig gatewayConfig;
private List interceptors;
private boolean hasRolesLookupInterceptor;
@@ -87,6 +88,8 @@ public class KnoxLDAPServerManager {
private List sslEnabledCipherSuites;
// Collection of DNs for the proxied backend LDAP servers
private Set baseDns;
+ private int maxSizeLimit;
+ private int maxTimeLimit;
KnoxLDAPServerManager(AliasService aliasService) {
this(aliasService, null);
@@ -114,6 +117,9 @@ public void initialize(GatewayConfig config) throws Exception {
this.baseDn = config.getLDAPBaseDN();
this.bindUser = config.getLDAPBindUser();
+ maxSizeLimit = config.getLDAPMaxSizeLimit();
+ maxTimeLimit = config.getLDAPMaxTimeLimit();
+
// Secure (LDAPS) transport configuration. When enabled but no dedicated keystore is
// configured, fall back to the gateway identity keystore so the embedded server can
// reuse the gateway's own TLS material out of the box.
@@ -148,6 +154,13 @@ private void createInterceptors(GatewayConfig config) throws Exception {
// Add common configuration
interceptorConfig.put("baseDn", baseDn);
+ if (!interceptorConfig.containsKey("maxResultSetSize")) {
+ // Set the backend to return more results than the proxy's size limit.
+ // This will ensure that the proxy will return "Size limit exceeded"
+ if (maxSizeLimit != 0) {
+ interceptorConfig.put("maxResultSetSize", Integer.toString(maxSizeLimit + 1));
+ }
+ }
// Add common LDAP Proxy configurations to backends
if ("backend".equalsIgnoreCase(interceptorConfig.get("interceptorType"))) {
@@ -241,6 +254,9 @@ public void start() throws Exception {
ldapServer.setTransports(transport);
ldapServer.setDirectoryService(directoryService);
+ ldapServer.setMaxSizeLimit(maxSizeLimit);
+ ldapServer.setMaxTimeLimit(maxTimeLimit);
+
ldapServer.start();
LOG.ldapServiceStarted(port);
diff --git a/gateway-server/src/main/java/org/apache/knox/gateway/services/ldap/LdapMessages.java b/gateway-server/src/main/java/org/apache/knox/gateway/services/ldap/LdapMessages.java
index 816fef0035..8683f46457 100644
--- a/gateway-server/src/main/java/org/apache/knox/gateway/services/ldap/LdapMessages.java
+++ b/gateway-server/src/main/java/org/apache/knox/gateway/services/ldap/LdapMessages.java
@@ -73,6 +73,10 @@ public interface LdapMessages {
text = "Creating LDAP interceptor: {0} (via {1})")
void ldapInterceptorCreating(String interceptorName, String source);
+ @Message(level = MessageLevel.INFO,
+ text = "Configuring LDAP interceptor {0}: {1} = {2}")
+ void ldapInterceptorConfiguring(String interceptorName, String configName, String configValue);
+
@Message(level = MessageLevel.INFO,
text = "Loading backend: {0} (via {1})")
void ldapBackendLoading(String backendName, String source);
@@ -101,6 +105,18 @@ public interface LdapMessages {
text = "LDAP Search: {0} | {1}")
void ldapSearch(String baseDn, String filter);
+ @Message(level = MessageLevel.DEBUG,
+ text = "LDAP Paged Search: {0} | {1}, page size {2}, page {3}")
+ void ldapPagedSearch(String baseDn, String filter, int pageSize, int pageNumber);
+
+ @Message(level = MessageLevel.ERROR,
+ text = "LDAP Paged Search Exceeded Max Result Set Size: {0} | {1}")
+ void ldapPagedSearchExceededMaxResultSetSize(int resultSetSize, int maxResultSetSize);
+
+ @Message(level = MessageLevel.DEBUG,
+ text = "LDAP Paged Search Completed: {0} | {1}")
+ void ldapPagedSearchCompleted(String baseDn, String filter);
+
@Message(level = MessageLevel.ERROR,
text = "LDAP Search failed: {0} | {1}, {2}")
void ldapSearchFailed(String baseDn, String filter, @StackTrace(level = MessageLevel.DEBUG) Exception e);
@@ -133,9 +149,9 @@ public interface LdapMessages {
text = "Backend user not found: {0}")
void ldapUserNull(String username);
- @Message(level = MessageLevel.ERROR,
+ @Message(level = MessageLevel.DEBUG,
text = "Failed to copy attribute: {0}")
- void ldapAttributeCopyError(@StackTrace(level = MessageLevel.DEBUG) Exception e);
+ void ldapAttributeCopyError(@StackTrace(level = MessageLevel.TRACE) Exception e);
@Message(level = MessageLevel.DEBUG, text = "LDAP authentication succeeded for user: {0}")
void ldapAuthSucceeded(String user);
diff --git a/gateway-server/src/main/java/org/apache/knox/gateway/services/ldap/backend/LdapProxyBackend.java b/gateway-server/src/main/java/org/apache/knox/gateway/services/ldap/backend/LdapProxyBackend.java
index 0c56168520..32fd033b24 100644
--- a/gateway-server/src/main/java/org/apache/knox/gateway/services/ldap/backend/LdapProxyBackend.java
+++ b/gateway-server/src/main/java/org/apache/knox/gateway/services/ldap/backend/LdapProxyBackend.java
@@ -21,12 +21,20 @@
import org.apache.directory.api.ldap.model.cursor.CursorException;
import org.apache.directory.api.ldap.model.cursor.EntryCursor;
+import org.apache.directory.api.ldap.model.cursor.SearchCursor;
import org.apache.directory.api.ldap.model.entry.Attribute;
import org.apache.directory.api.ldap.model.entry.DefaultEntry;
import org.apache.directory.api.ldap.model.entry.Entry;
import org.apache.directory.api.ldap.model.entry.Value;
import org.apache.directory.api.ldap.model.exception.LdapException;
+import org.apache.directory.api.ldap.model.message.Response;
+import org.apache.directory.api.ldap.model.message.SearchRequest;
+import org.apache.directory.api.ldap.model.message.SearchRequestImpl;
+import org.apache.directory.api.ldap.model.message.SearchResultDone;
+import org.apache.directory.api.ldap.model.message.SearchResultEntry;
import org.apache.directory.api.ldap.model.message.SearchScope;
+import org.apache.directory.api.ldap.model.message.controls.PagedResults;
+import org.apache.directory.api.ldap.model.message.controls.PagedResultsImpl;
import org.apache.directory.api.ldap.model.name.Dn;
import org.apache.directory.api.ldap.model.schema.SchemaManager;
import org.apache.directory.ldap.client.api.DefaultLdapConnectionFactory;
@@ -50,7 +58,6 @@
import java.security.cert.X509Certificate;
import java.util.ArrayList;
import java.util.Arrays;
-import java.util.Collection;
import java.util.HashMap;
import java.util.HashSet;
import java.util.List;
@@ -96,6 +103,8 @@ public class LdapProxyBackend implements LdapBackend {
private boolean useMemberOf; // Use memberOf attribute for group lookup (efficient for AD)
private boolean recursiveGroupResolution;
private int recursiveGroupResolutionMaxDepth;
+ private int pageSize;
+ private int maxResultSetSize;
private final String proxyEntryGroupMembershipAttributeType = "memberOf";
@@ -184,6 +193,11 @@ public LdapProxyBackend(String name, Map config) {
recursiveGroupResolution = Boolean.parseBoolean(config.getOrDefault("recursiveGroupResolution", "false"));
recursiveGroupResolutionMaxDepth = Integer.parseInt(config.getOrDefault("recursiveGroupResolutionMaxDepth", "3"));
+ // Configure search parameters
+ pageSize = Integer.parseInt(config.getOrDefault("pageSize", "1000"));
+ maxResultSetSize = Integer.parseInt(config.getOrDefault("maxResultSetSize", "0")); // 0 means unlimited
+ LOG.ldapInterceptorConfiguring(name, "maxResultSetSize", Integer.toString(maxResultSetSize));
+
// Configure secure transport (LDAPS) to the remote server. An ldaps:// URL enables it
// by default; an explicit useSsl setting always wins.
final boolean ldapsFromUrl = ldapUrl != null && ldapUrl.toLowerCase(Locale.ROOT).startsWith("ldaps://");
@@ -490,15 +504,14 @@ public List getUserGroups(String username, SchemaManager schemaManager)
return List.of();
}
- LdapConnection connection = null;
- try {
- connection = getConnection();
- List groups = getUserGroupsEntries(connection, user, createEntryCache(), createResolvedParentsCache());
- List cns = getCnsFromEntries(groups);
- return cns;
- } finally {
- releaseConnection(connection);
+ List groups = new ArrayList<>();
+ Attribute groupsAttribute = user.get(proxyEntryGroupMembershipAttributeType);
+ if (groupsAttribute != null) {
+ for (Value value : groupsAttribute) {
+ groups.add(new Dn(value.getString()).getRdn().getValue());
+ }
}
+ return groups;
}
@Override
@@ -511,12 +524,10 @@ public List searchUsers(String filter, SchemaManager schemaManager) throw
try {
connection = getConnection();
String ldapFilter = "(" + remoteUserIdentifierAttribute + "=" + filter.trim() + ")";
- try (EntryCursor cursor = connection.search(remoteUserSearchBase, ldapFilter, SearchScope.SUBTREE, "*")) {
- while (cursor.next()) {
- Entry sourceEntry = cursor.get();
- addGroupMemberships(sourceEntry, connection, entryCache, resolvedParentsCache);
- results.add(remoteSchemaConverter.convertRemoteEntryToProxyEntry(sourceEntry, schemaManager));
- }
+ List searchResults = performPagedSearch(connection, remoteUserSearchBase, ldapFilter, SearchScope.SUBTREE, "*");
+ for (Entry sourceEntry : searchResults) {
+ addGroupMemberships(sourceEntry, connection, entryCache, resolvedParentsCache);
+ results.add(remoteSchemaConverter.convertRemoteEntryToProxyEntry(sourceEntry, schemaManager));
}
return results;
} finally {
@@ -535,14 +546,10 @@ public List search(String searchBase, SearchScope searchScope, String fil
try {
connection = getConnection();
List results = new ArrayList<>();
- try (EntryCursor cursor = connection.search(remoteSearchBase, remoteFilter, searchScope, "*")) {
- while (cursor.next()) {
- Entry entry = cursor.get();
- addGroupMemberships(entry, connection, entryCache, resolvedParentsCache);
- results.add(remoteSchemaConverter.convertRemoteEntryToProxyEntry(entry, schemaManager));
- }
- } catch (LdapException e) {
- LOG.ldapSearchFailed(remoteSearchBase, remoteFilter, e);
+ List searchResults = performPagedSearch(connection, remoteSearchBase, remoteFilter, searchScope, "*");
+ for (Entry entry : searchResults) {
+ addGroupMemberships(entry, connection, entryCache, resolvedParentsCache);
+ results.add(remoteSchemaConverter.convertRemoteEntryToProxyEntry(entry, schemaManager));
}
return results;
} finally {
@@ -721,21 +728,19 @@ private List resolveGroupsRecursive(LdapConnection connection, List searchResults = performPagedSearch(connection, remoteGroupSearchBase, filter, SearchScope.SUBTREE, "cn", "memberUid", "member", "uniqueMember");
+ for (Entry parentGroup : searchResults) {
+ String parentDn = parentGroup.getDn().getNormName();
+
+ // Update cache for all groups found in this search
+ updateCache(entryCache, resolvedParentsCache, groupsToSearch, parentGroup);
+
+ if (!allGroupDns.contains(parentDn)) {
+ allGroupDns.add(parentDn);
+ allGroups.add(parentGroup);
+ nextLevelGroups.add(parentGroup);
+ } else {
+ LOG.ldapRecursiveGroupSearchCycleDetected(entryName, parentDn);
}
}
@@ -839,13 +844,69 @@ private List getUserGroupsInternal(LdapConnection connection, Dn... dns)
String filter = buildMultipleGroupMemberFilter(dns);
- try (EntryCursor cursor = connection.search(remoteGroupSearchBase, filter, SearchScope.SUBTREE, "cn")) {
- while (cursor.next()) {
- groups.add(cursor.get());
+ groups.addAll(performPagedSearch(connection, remoteGroupSearchBase, filter, SearchScope.SUBTREE, "cn"));
+
+ return groups;
+ }
+
+ protected List performPagedSearch(LdapConnection connection, String baseDn, String filter, SearchScope scope, String... attributes ) throws LdapException, CursorException, IOException {
+ List results = new ArrayList<>();
+
+ // 1. Setup basic search parameters
+ SearchRequest searchRequest = new SearchRequestImpl();
+ searchRequest.setBase(new Dn(baseDn));
+ searchRequest.setFilter(filter);
+ searchRequest.setScope(scope);
+ searchRequest.addAttributes(attributes);
+
+ // 2. Initialize the PagedResults control
+ PagedResults pagedControl = new PagedResultsImpl();
+ pagedControl.setSize(pageSize);
+ searchRequest.addControl(pagedControl);
+
+ byte[] cookie = null;
+
+ // 3. Loop until no more pages remain
+ int pageNumber = 1;
+ do {
+ // Update cookie for the subsequent pages
+ if (cookie != null) {
+ pagedControl.setCookie(cookie);
}
+
+ try (SearchCursor cursor = connection.search(searchRequest)) {
+ LOG.ldapPagedSearch(baseDn, filter, pageSize, pageNumber);
+ while (cursor.next()) {
+ Response response = cursor.get();
+
+ // Process matching entries
+ if (response instanceof SearchResultEntry) {
+ Entry entry = ((SearchResultEntry) response).getEntry();
+ results.add(entry);
+ }
+ }
+ if (cursor.isDone()) {
+ SearchResultDone done = cursor.getSearchResultDone();
+ PagedResults responseControl = (PagedResults) done.getControl(PagedResults.OID);
+
+ if (responseControl != null) {
+ cookie = responseControl.getCookie();
+ } else {
+ cookie = null;
+ }
+ }
+ pageNumber++;
+ }
+ } while (cookie != null && cookie.length > 0 &&
+ (maxResultSetSize == 0 || results.size() < maxResultSetSize));
+
+ if (maxResultSetSize != 0 && results.size() >= maxResultSetSize) {
+ LOG.ldapPagedSearchExceededMaxResultSetSize(results.size(), maxResultSetSize);
+ } else {
+ LOG.ldapPagedSearchCompleted(baseDn, filter);
}
- return groups;
+ return results;
}
private String buildMultipleGroupMemberFilter(Dn... dns) {
@@ -877,21 +938,6 @@ private String buildMultipleGroupMemberFilter(Dn... dns) {
return filterBuilder.toString();
}
- private List getCnsFromEntries(Collection entries) throws LdapException {
- List cns = new ArrayList<>();
- for (Entry entry : entries) {
- Attribute cnAttr = entry.get("cn");
- if (cnAttr != null) {
- cns.add(cnAttr.getString());
- } else if (entry.getDn() != null && entry.getDn().getRdn() != null) {
- // Fall back to the CN carried in the DN when the entry was fetched without the
- // cn attribute, so resolved groups are not silently dropped from the result.
- cns.add(entry.getDn().getRdn().getValue());
- }
- }
- return cns;
- }
-
protected Map createEntryCache() {
return new HashMap<>();
}
diff --git a/gateway-server/src/main/java/org/apache/knox/gateway/services/token/impl/DefaultTokenAuthorityService.java b/gateway-server/src/main/java/org/apache/knox/gateway/services/token/impl/DefaultTokenAuthorityService.java
index 034b27ce54..98b720a3da 100644
--- a/gateway-server/src/main/java/org/apache/knox/gateway/services/token/impl/DefaultTokenAuthorityService.java
+++ b/gateway-server/src/main/java/org/apache/knox/gateway/services/token/impl/DefaultTokenAuthorityService.java
@@ -32,14 +32,17 @@
import java.security.interfaces.RSAPublicKey;
import java.text.ParseException;
import java.util.Arrays;
+import java.util.Collections;
import java.util.HashMap;
import java.util.HashSet;
+import java.util.List;
import java.util.Map;
import java.util.Optional;
import java.util.Set;
import com.nimbusds.jose.JOSEException;
import com.nimbusds.jose.JWSAlgorithm;
+import com.nimbusds.jose.JWSHeader;
import com.nimbusds.jose.JWSSigner;
import com.nimbusds.jose.JWSVerifier;
import com.nimbusds.jose.KeyLengthException;
@@ -202,17 +205,62 @@ private boolean verifyTokenUsingRSA(JWT token, RSAPublicKey publicKey) throws To
try {
PublicKey key = publicKey;
if (key == null) {
- key = keystoreService.getSigningKeystore().getCertificate(getSigningKeyAlias()).getPublicKey();
+ key = selectVerificationKey(token);
}
final JWSVerifier verifier = new RSASSAVerifier((RSAPublicKey) key);
- // TODO: interrogate the token for issuer claim in order to determine the public key to use for verification
- // consider jwk for specifying the key too
return token.verify(verifier);
} catch (KeyStoreException | KeystoreServiceException e) {
throw new TokenServiceException("Cannot verify token.", e);
}
}
+ /**
+ * Selects the public key to verify a gateway-signed RSA token with. When more than one signing
+ * key alias is configured, the token's {@code kid} header is matched against each configured
+ * key's SHA-256 thumbprint so a token signed by a rotated-out key still verifies. When there is a
+ * single configured key, or the token carries no matching {@code kid}, this falls back to the
+ * current signing key — the historical single-key behavior.
+ */
+ private PublicKey selectVerificationKey(JWT token) throws KeyStoreException, KeystoreServiceException {
+ final KeyStore keystore = keystoreService.getSigningKeystore();
+ final List aliases = getVerificationKeyAliases();
+ // Fast path / backward compatibility: a single configured key means no kid selection is needed.
+ if (aliases.size() > 1) {
+ final String kid = extractKid(token);
+ if (kid != null) {
+ for (final String alias : aliases) {
+ final Certificate cert = keystore.getCertificate(alias);
+ if (cert == null || !(cert.getPublicKey() instanceof RSAPublicKey)) {
+ continue;
+ }
+ try {
+ if (kid.equals(TokenUtils.getThumbprint((RSAPublicKey) cert.getPublicKey(), "SHA-256"))) {
+ return cert.getPublicKey();
+ }
+ } catch (JOSEException e) {
+ // Cannot compute this key's thumbprint; skip it and try the next alias.
+ LOG.errorGettingKid(e.toString());
+ }
+ }
+ }
+ }
+ // No kid, no match, or a single key: verify with the current signing key.
+ return keystore.getCertificate(getSigningKeyAlias()).getPublicKey();
+ }
+
+ private List getVerificationKeyAliases() {
+ final List aliases = config == null ? null : config.getSigningKeyAliases();
+ return (aliases == null || aliases.isEmpty()) ? Collections.singletonList(getSigningKeyAlias()) : aliases;
+ }
+
+ private static String extractKid(JWT token) {
+ try {
+ return JWSHeader.parse(token.getHeader()).getKeyID();
+ } catch (ParseException e) {
+ return null;
+ }
+ }
+
private boolean verifyTokenUsingHMAC(JWT token) throws TokenServiceException {
try {
final JWSVerifier verifier = new MACVerifier(getHmacSecret());
diff --git a/gateway-server/src/main/java/org/apache/knox/gateway/services/token/impl/DefaultTokenStateService.java b/gateway-server/src/main/java/org/apache/knox/gateway/services/token/impl/DefaultTokenStateService.java
index afca435bd0..95d0b8eabd 100644
--- a/gateway-server/src/main/java/org/apache/knox/gateway/services/token/impl/DefaultTokenStateService.java
+++ b/gateway-server/src/main/java/org/apache/knox/gateway/services/token/impl/DefaultTokenStateService.java
@@ -265,6 +265,22 @@ public void revokeToken(final String tokenId) throws UnknownTokenException {
log.revokedToken(Tokens.getTokenIDDisplayText(tokenId));
}
+ @Override
+ public boolean consumeToken(final String tokenId) {
+ validateTokenIdentifier(tokenId);
+ // Atomic single-use claim: ConcurrentHashMap#remove returns the prior value to exactly one
+ // caller, so concurrent redemptions of the same token can never both observe it as present.
+ final boolean claimed = tokenExpirations.remove(tokenId) != null;
+ if (claimed) {
+ // Evict the remaining per-token state (idempotent for a token we won the race for).
+ tokenIssueTimes.remove(tokenId);
+ maxTokenLifetimes.remove(tokenId);
+ metadataMap.remove(tokenId);
+ log.revokedToken(Tokens.getTokenIDDisplayText(tokenId));
+ }
+ return claimed;
+ }
+
@Override
public boolean isExpired(final JWTToken token) throws UnknownTokenException {
return getTokenExpiration(token) <= System.currentTimeMillis();
diff --git a/gateway-server/src/main/java/org/apache/knox/gateway/services/token/impl/JDBCTokenStateService.java b/gateway-server/src/main/java/org/apache/knox/gateway/services/token/impl/JDBCTokenStateService.java
index 4dfc46d298..5d60fbe33f 100644
--- a/gateway-server/src/main/java/org/apache/knox/gateway/services/token/impl/JDBCTokenStateService.java
+++ b/gateway-server/src/main/java/org/apache/knox/gateway/services/token/impl/JDBCTokenStateService.java
@@ -240,6 +240,25 @@ protected void removeToken(String tokenId) throws UnknownTokenException {
}
}
+ @Override
+ public boolean consumeToken(String tokenId) {
+ // The single-row primary-key DELETE is the atomic arbiter: only the caller whose statement
+ // actually removed the row observes rowsAffected == 1, so exactly one concurrent redemption
+ // wins. Fail closed on a SQL error (report "not consumed by us") rather than the inherited
+ // removeToken() behaviour of swallowing the exception, which would falsely signal a win.
+ try {
+ final boolean removed = tokenDatabase.removeToken(tokenId);
+ if (removed) {
+ super.removeTokens(Collections.singleton(tokenId)); // evict the in-memory cache copy
+ log.removedTokenFromDatabase(Tokens.getTokenIDDisplayText(tokenId));
+ }
+ return removed;
+ } catch (SQLException e) {
+ log.errorRemovingTokenFromDatabase(Tokens.getTokenIDDisplayText(tokenId), e.getMessage(), e);
+ return false;
+ }
+ }
+
@Override
protected void evictExpiredTokens() {
try {
diff --git a/gateway-server/src/main/java/org/apache/knox/gateway/services/token/impl/TokenStateDatabase.java b/gateway-server/src/main/java/org/apache/knox/gateway/services/token/impl/TokenStateDatabase.java
index dbc89d6950..c7579a4805 100644
--- a/gateway-server/src/main/java/org/apache/knox/gateway/services/token/impl/TokenStateDatabase.java
+++ b/gateway-server/src/main/java/org/apache/knox/gateway/services/token/impl/TokenStateDatabase.java
@@ -19,7 +19,7 @@
import org.apache.commons.codec.binary.Base64;
import org.apache.knox.gateway.database.DatabaseType;
-import org.apache.knox.gateway.database.JDBCUtils;
+import org.apache.knox.gateway.database.KnoxDatabase;
import org.apache.knox.gateway.services.security.token.KnoxToken;
import org.apache.knox.gateway.services.security.token.TokenMetadata;
@@ -37,7 +37,7 @@
import static java.nio.charset.StandardCharsets.UTF_8;
-public class TokenStateDatabase {
+public class TokenStateDatabase extends KnoxDatabase {
static final String TOKENS_TABLE_NAME = "KNOX_TOKENS";
static final String TOKEN_METADATA_TABLE_NAME = "KNOX_TOKEN_METADATA";
private static final String ADD_TOKEN_SQL = "INSERT INTO " + TOKENS_TABLE_NAME + "(token_id, issue_time, expiration, max_lifetime) VALUES(?, ?, ?, ?)";
@@ -58,21 +58,13 @@ public class TokenStateDatabase {
private static final String GET_TOKENS_CREATED_BY_USER_NAME_SQL = GET_ALL_TOKENS_SQL + " AND kt.token_id IN (SELECT token_id FROM " + TOKEN_METADATA_TABLE_NAME + " WHERE md_name = '" + TokenMetadata.CREATED_BY + "' AND md_value = ? )"
+ " ORDER BY kt.issue_time";
- private final DataSource dataSource;
-
TokenStateDatabase(DataSource dataSource, String dbType) throws Exception {
- this.dataSource = dataSource;
+ super(dataSource);
DatabaseType databaseType = DatabaseType.fromString(dbType);
createTableIfNotExists(TOKENS_TABLE_NAME, databaseType.tokensTableSql());
createTableIfNotExists(TOKEN_METADATA_TABLE_NAME, databaseType.metadataTableSql());
}
- private void createTableIfNotExists(String tableName, String createSqlFileName) throws Exception {
- if (!JDBCUtils.tableExists(tableName, dataSource)) {
- JDBCUtils.createTableFromSQL(createSqlFileName, dataSource, TokenStateDatabase.class.getClassLoader());
- }
- }
-
boolean addToken(String tokenId, long issueTime, long expiration, long maxLifetimeDuration) throws SQLException {
try (Connection connection = dataSource.getConnection(); PreparedStatement addTokenStatement = connection.prepareStatement(ADD_TOKEN_SQL)) {
addTokenStatement.setString(1, tokenId);
diff --git a/gateway-server/src/main/java/org/apache/knox/gateway/services/topology/impl/DefaultTopologyService.java b/gateway-server/src/main/java/org/apache/knox/gateway/services/topology/impl/DefaultTopologyService.java
index 02d916f29c..0468e4aee8 100644
--- a/gateway-server/src/main/java/org/apache/knox/gateway/services/topology/impl/DefaultTopologyService.java
+++ b/gateway-server/src/main/java/org/apache/knox/gateway/services/topology/impl/DefaultTopologyService.java
@@ -306,13 +306,17 @@ public void setAliasService(AliasService as) {
public void deployTopology(Topology t){
try {
+ File topology = new File(topologiesDirectory.getAbsolutePath() + "/" + t.getName() + ".xml");
+ if (!topology.getCanonicalFile().toPath().startsWith(topologiesDirectory.getCanonicalFile().toPath())) {
+ throw new IOException("Resolved topology path escapes managed directory: " + t.getName());
+ }
+
File temp = new File(topologiesDirectory.getAbsolutePath() + "/" + t.getName() + ".xml.temp");
Marshaller mr = jaxbContext.createMarshaller();
mr.setProperty(Marshaller.JAXB_FORMATTED_OUTPUT, true);
mr.marshal(t, temp);
- File topology = new File(topologiesDirectory.getAbsolutePath() + "/" + t.getName() + ".xml");
if(!temp.renameTo(topology)) {
FileUtils.forceDelete(temp);
throw new IOException("Could not rename temp file");
@@ -716,8 +720,15 @@ private static boolean writeConfig(File dest, String name, String content) {
File destFile = new File(dest, name);
try {
- FileUtils.writeStringToFile(destFile, content, StandardCharsets.UTF_8);
- log.wroteConfigurationFile(destFile.getAbsolutePath());
+ final File canonicalDest = dest.getCanonicalFile();
+ final File canonicalFile = destFile.getCanonicalFile();
+ if (!canonicalFile.toPath().startsWith(canonicalDest.toPath())) {
+ log.failedToWriteConfigurationFile(destFile.getAbsolutePath(),
+ new IOException("Resolved path escapes managed directory: " + name));
+ return false;
+ }
+ FileUtils.writeStringToFile(canonicalFile, content, StandardCharsets.UTF_8);
+ log.wroteConfigurationFile(canonicalFile.getAbsolutePath());
result = true;
} catch (IOException e) {
log.failedToWriteConfigurationFile(destFile.getAbsolutePath(), e);
diff --git a/gateway-server/src/main/java/org/apache/knox/gateway/topology/monitor/ZkRemoteConfigurationMonitorService.java b/gateway-server/src/main/java/org/apache/knox/gateway/topology/monitor/ZkRemoteConfigurationMonitorService.java
index 0d8e34c57c..2c6d89a389 100644
--- a/gateway-server/src/main/java/org/apache/knox/gateway/topology/monitor/ZkRemoteConfigurationMonitorService.java
+++ b/gateway-server/src/main/java/org/apache/knox/gateway/topology/monitor/ZkRemoteConfigurationMonitorService.java
@@ -212,14 +212,14 @@ public void stop() throws ServiceLifecycleException {
@Override
public boolean createProvider(String name, String content) {
- String entryPath = "/knox/config/shared-providers/" + name;
+ String entryPath = "/knox/config/shared-providers/" + FilenameUtils.getName(name);
client.createEntry(entryPath, content);
return (client.getEntryData(entryPath) != null);
}
@Override
public boolean createDescriptor(String name, String content) {
- String entryPath = "/knox/config/descriptors/" + name;
+ String entryPath = "/knox/config/descriptors/" + FilenameUtils.getName(name);
client.createEntry(entryPath, content);
return (client.getEntryData(entryPath) != null);
}
diff --git a/gateway-server/src/main/java/org/apache/knox/gateway/util/KnoxCLI.java b/gateway-server/src/main/java/org/apache/knox/gateway/util/KnoxCLI.java
index ea77ad9bf5..6f0b162863 100644
--- a/gateway-server/src/main/java/org/apache/knox/gateway/util/KnoxCLI.java
+++ b/gateway-server/src/main/java/org/apache/knox/gateway/util/KnoxCLI.java
@@ -91,13 +91,14 @@
import org.apache.knox.gateway.topology.Topology;
import org.apache.knox.gateway.topology.validation.TopologyValidator;
import org.apache.shiro.SecurityUtils;
+import org.apache.shiro.UnavailableSecurityManagerException;
import org.apache.shiro.authc.AuthenticationException;
import org.apache.shiro.authc.UsernamePasswordToken;
import org.apache.shiro.config.ConfigurationException;
import org.apache.shiro.config.Ini;
-import org.apache.shiro.config.IniSecurityManagerFactory;
+import org.apache.shiro.env.BasicIniEnvironment;
+import org.apache.shiro.lang.util.LifecycleUtils;
import org.apache.shiro.subject.Subject;
-import org.apache.shiro.util.Factory;
import org.apache.shiro.util.ThreadContext;
import org.eclipse.persistence.oxm.MediaType;
import org.jboss.shrinkwrap.api.exporter.ExplodedExporter;
@@ -1769,6 +1770,8 @@ protected boolean authenticateUser(Ini ini, UsernamePasswordToken token){
} catch ( Exception e ) {
out.println(e.getCause());
out.println(e.toString());
+ } finally {
+ destroySecurityManager();
}
return result;
}
@@ -1866,9 +1869,7 @@ private char[] getSystemPassword(Topology t) throws NoSuchProviderException, Mis
protected Subject getSubject(Ini config) throws BadSubjectException {
try {
ThreadContext.unbindSubject();
- @SuppressWarnings("deprecation")
- Factory factory = new IniSecurityManagerFactory(config);
- org.apache.shiro.mgt.SecurityManager securityManager = (org.apache.shiro.mgt.SecurityManager) factory.getInstance();
+ org.apache.shiro.mgt.SecurityManager securityManager = new BasicIniEnvironment(config).getSecurityManager();
SecurityUtils.setSecurityManager(securityManager);
Subject subject = SecurityUtils.getSubject();
if( subject != null) {
@@ -1882,6 +1883,25 @@ protected Subject getSubject(Ini config) throws BadSubjectException {
throw new BadSubjectException("Subject could not be created with Shiro Config at " + config);
}
+ /**
+ * Releases the Shiro {@link org.apache.shiro.mgt.SecurityManager} created for the
+ * current command by {@link #getSubject(Ini)}. The {@code DefaultSecurityManager}
+ * built by {@link BasicIniEnvironment} is {@code Destroyable} and can hold
+ * resources such as a cache manager and a session-validation scheduler thread, so
+ * it must be destroyed once the Subject is no longer needed to avoid leaking them.
+ * Null-safe and safe to call when no SecurityManager is currently set.
+ */
+ protected void destroySecurityManager() {
+ final org.apache.shiro.mgt.SecurityManager securityManager;
+ try {
+ securityManager = SecurityUtils.getSecurityManager();
+ } catch (UnavailableSecurityManagerException e) {
+ return; // nothing was set, nothing to release
+ }
+ LifecycleUtils.destroy(securityManager);
+ SecurityUtils.setSecurityManager(null);
+ }
+
protected Subject getSubject(String config) throws ConfigurationException {
Ini ini = new Ini();
ini.loadFromPath(config);
@@ -2118,6 +2138,8 @@ private Set getGroups(Topology t, UsernamePasswordToken token){
if(debug){
e.printStackTrace();
}
+ } finally {
+ destroySecurityManager();
}
return groups;
}
diff --git a/gateway-server/src/main/java/org/apache/knox/gateway/websockets/GatewayWebsocketHandler.java b/gateway-server/src/main/java/org/apache/knox/gateway/websockets/GatewayWebsocketHandler.java
index f275ee9eeb..60b41c5cdd 100644
--- a/gateway-server/src/main/java/org/apache/knox/gateway/websockets/GatewayWebsocketHandler.java
+++ b/gateway-server/src/main/java/org/apache/knox/gateway/websockets/GatewayWebsocketHandler.java
@@ -25,6 +25,8 @@
import org.apache.knox.gateway.services.registry.ServiceDefEntry;
import org.apache.knox.gateway.services.registry.ServiceDefinitionRegistry;
import org.apache.knox.gateway.services.registry.ServiceRegistry;
+import org.apache.knox.gateway.services.security.AliasService;
+import org.apache.knox.gateway.services.security.AliasServiceException;
import org.apache.knox.gateway.services.security.KeystoreService;
import org.apache.knox.gateway.services.security.KeystoreServiceException;
import org.apache.knox.gateway.webshell.WebshellWebSocketAdapter;
@@ -68,6 +70,12 @@ public class GatewayWebsocketHandler extends WebSocketHandler
static final String REGEX_SPLIT_SERVICE_PATH = "^((?:[^/]*/){3}[^/]*)";
+ static final String TRUSTSTORE_USER_PROPERTY = "org.apache.knox.gateway.websockets.truststore";
+
+ static final String KEYSTORE_USER_PROPERTY = "org.apache.knox.gateway.websockets.keystore";
+
+ static final String KEYSTORE_KEY_PASSPHRASE_USER_PROPERTY = "org.apache.knox.gateway.websockets.keystore.key.passphrase";
+
static final String REGEX_WEBSHELL_REQUEST_PATH =
"^(" + SECURE_WEBSOCKET_PROTOCOL_STRING+"|"+WEBSOCKET_PROTOCOL_STRING + ")[^/]+/[^/]+/webshell$";
@@ -150,7 +158,8 @@ public Object createWebSocket(ServletUpgradeRequest req,
// Upgrade happens here
final ClientEndpointConfig clientConfig = getClientEndpointConfig(req);
- clientConfig.getUserProperties().put("org.apache.knox.gateway.websockets.truststore", getTruststore());
+ clientConfig.getUserProperties().put(TRUSTSTORE_USER_PROPERTY, getTruststore());
+ configureClientIdentity(clientConfig.getUserProperties());
return new ProxyWebSocketAdapter(URI.create(backendURL), pool, clientConfig, config);
} catch (final Exception e) {
LOG.failedCreatingWebSocket(e);
@@ -169,6 +178,38 @@ private KeyStore getTruststore() throws KeystoreServiceException {
return trustKeystore;
}
+ /**
+ * Mirrors DefaultHttpClientFactory#createSSLContext: when two-way SSL is
+ * enabled, select the client identity keystore (single-EKU aware) and add it,
+ * with its key passphrase, to the WebSocket client's user properties so the
+ * outbound TLS handshake can present a client certificate.
+ */
+ void configureClientIdentity(final Map userProperties)
+ throws KeystoreServiceException, AliasServiceException {
+ if (!config.isHttpClientTwoWaySslEnabled()) {
+ return;
+ }
+
+ final KeystoreService ks = this.services.getService(ServiceType.KEYSTORE_SERVICE);
+ final AliasService as = this.services.getService(ServiceType.ALIAS_SERVICE);
+
+ final KeyStore identityKeystore;
+ final char[] identityKeyPassphrase;
+ if (config.isSingleEkuEnabled()) {
+ identityKeystore = ks.getKeystoreForHttpClient();
+ identityKeyPassphrase = as.getHttpClientKeyPassphrase();
+ } else {
+ identityKeystore = ks.getKeystoreForGateway();
+ identityKeyPassphrase = as.getGatewayIdentityPassphrase();
+ }
+
+ if (identityKeystore != null) {
+ userProperties.put(KEYSTORE_USER_PROPERTY, identityKeystore);
+ userProperties.put(KEYSTORE_KEY_PASSPHRASE_USER_PROPERTY, identityKeyPassphrase);
+ } else {
+ LOG.noClientIdentityForTwoWaySsl();
+ }
+ }
/**
* Returns a {@link ClientEndpointConfig} config that contains the headers
diff --git a/gateway-server/src/main/java/org/apache/knox/gateway/websockets/ProxyWebSocketAdapter.java b/gateway-server/src/main/java/org/apache/knox/gateway/websockets/ProxyWebSocketAdapter.java
index 37c94a6ac5..2774f69a35 100644
--- a/gateway-server/src/main/java/org/apache/knox/gateway/websockets/ProxyWebSocketAdapter.java
+++ b/gateway-server/src/main/java/org/apache/knox/gateway/websockets/ProxyWebSocketAdapter.java
@@ -21,6 +21,7 @@
import java.net.URI;
import java.util.List;
import java.util.ArrayList;
+import java.util.Map;
import java.util.concurrent.ExecutorService;
import java.util.concurrent.locks.Lock;
import java.util.concurrent.locks.ReentrantLock;
@@ -35,6 +36,7 @@
import org.apache.knox.gateway.config.GatewayConfig;
import org.eclipse.jetty.io.RuntimeIOException;
import org.eclipse.jetty.util.component.LifeCycle;
+import org.eclipse.jetty.util.ssl.SslContextFactory;
import org.eclipse.jetty.websocket.api.BatchMode;
import org.eclipse.jetty.websocket.api.RemoteEndpoint;
import org.eclipse.jetty.websocket.api.Session;
@@ -100,21 +102,17 @@ public void onWebSocketConnect(final Session frontEndSession) {
container.setAsyncSendTimeout(frontEndSession.getPolicy().getAsyncWriteTimeout());
container.setDefaultMaxSessionIdleTimeout(frontEndSession.getPolicy().getIdleTimeout());
- KeyStore ks = null;
- if(clientConfig != null) {
- ks = (KeyStore) clientConfig.getUserProperties().get("org.apache.knox.gateway.websockets.truststore");
- }
-
/*
Currently javax.websocket API has no provisions to configure SSL
https://github.com/eclipse-ee4j/websocket-api/issues/210
Until that gets fixed we'll have to resort to this.
*/
- if(container instanceof org.eclipse.jetty.websocket.jsr356.ClientContainer &&
+ if(clientConfig != null &&
+ container instanceof org.eclipse.jetty.websocket.jsr356.ClientContainer &&
((org.eclipse.jetty.websocket.jsr356.ClientContainer)container).getClient() != null &&
((org.eclipse.jetty.websocket.jsr356.ClientContainer)container).getClient().getSslContextFactory() != null ) {
- ((org.eclipse.jetty.websocket.jsr356.ClientContainer)container).getClient().getHttpClient().getSslContextFactory().setTrustStore(ks);
- LOG.logMessage("Truststore for websocket setup");
+ configureSsl(((org.eclipse.jetty.websocket.jsr356.ClientContainer)container).getClient().getHttpClient().getSslContextFactory(), clientConfig);
+ LOG.logMessage("SSL for websocket setup");
}
final ProxyInboundClient backendSocket = new ProxyInboundClient(getMessageCallback());
@@ -160,6 +158,31 @@ public void onWebSocketConnect(final Session frontEndSession) {
}
}
+ /**
+ * Configures the WebSocket client's SslContextFactory from the values the
+ * handler placed in the ClientEndpointConfig user properties: the truststore
+ * (unchanged behavior, may be null) and, when two-way SSL supplied one, the
+ * client identity keystore plus its key-manager password.
+ */
+ static void configureSsl(final SslContextFactory sslContextFactory,
+ final ClientEndpointConfig clientConfig) {
+ final Map userProperties = clientConfig.getUserProperties();
+
+ sslContextFactory.setTrustStore(
+ (KeyStore) userProperties.get(GatewayWebsocketHandler.TRUSTSTORE_USER_PROPERTY));
+
+ final KeyStore identityKeystore =
+ (KeyStore) userProperties.get(GatewayWebsocketHandler.KEYSTORE_USER_PROPERTY);
+ if (identityKeystore != null) {
+ sslContextFactory.setKeyStore(identityKeystore);
+ final char[] passphrase =
+ (char[]) userProperties.get(GatewayWebsocketHandler.KEYSTORE_KEY_PASSPHRASE_USER_PROPERTY);
+ if (passphrase != null) {
+ sslContextFactory.setKeyManagerPassword(new String(passphrase));
+ }
+ }
+ }
+
@Override
public void onWebSocketBinary(final byte[] payload, final int offset, final int length) {
if (isNotConnected()) {
diff --git a/gateway-server/src/main/java/org/apache/knox/gateway/websockets/WebsocketLogMessages.java b/gateway-server/src/main/java/org/apache/knox/gateway/websockets/WebsocketLogMessages.java
index fc8484ec3f..9e057e56d9 100644
--- a/gateway-server/src/main/java/org/apache/knox/gateway/websockets/WebsocketLogMessages.java
+++ b/gateway-server/src/main/java/org/apache/knox/gateway/websockets/WebsocketLogMessages.java
@@ -60,4 +60,9 @@ void failedCreatingWebSocket(
text = "{0}")
void debugLog(String message);
+ @Message(level = MessageLevel.WARN,
+ text = "Two-way SSL is enabled but no client identity keystore was found; "
+ + "the outbound WebSocket connection will not present a client certificate")
+ void noClientIdentityForTwoWaySsl();
+
}
diff --git a/gateway-server/src/main/resources/META-INF/services/org.apache.knox.gateway.services.ServiceFactory b/gateway-server/src/main/resources/META-INF/services/org.apache.knox.gateway.services.ServiceFactory
index bd808747c5..e67206f2c5 100644
--- a/gateway-server/src/main/resources/META-INF/services/org.apache.knox.gateway.services.ServiceFactory
+++ b/gateway-server/src/main/resources/META-INF/services/org.apache.knox.gateway.services.ServiceFactory
@@ -16,9 +16,14 @@
# limitations under the License.
##########################################################################
+# Please keep the alphabetical order of service factories!
+
org.apache.knox.gateway.services.factory.AliasServiceFactory
+org.apache.knox.gateway.services.factory.ConcurrentSessionVerifierFactory
org.apache.knox.gateway.services.factory.ClusterConfigurationMonitorServiceFactory
org.apache.knox.gateway.services.factory.CryptoServiceFactory
+org.apache.knox.gateway.services.factory.FederatedIdentityServiceFactory
+org.apache.knox.gateway.services.factory.GatewayStatusServiceFactory
org.apache.knox.gateway.services.factory.HostMappingServiceFactory
org.apache.knox.gateway.services.factory.KeystoreServiceFactory
org.apache.knox.gateway.services.factory.MasterServiceFactory
@@ -28,10 +33,9 @@ org.apache.knox.gateway.services.factory.ServerInfoServiceFactory
org.apache.knox.gateway.services.factory.ServiceDefinitionRegistryFactory
org.apache.knox.gateway.services.factory.ServiceRegistryServiceFactory
org.apache.knox.gateway.services.factory.SslServiceFactory
-org.apache.knox.gateway.services.factory.TokenServiceFactory
org.apache.knox.gateway.services.factory.TokenStateServiceFactory
org.apache.knox.gateway.services.factory.TopologyServiceFactory
-org.apache.knox.gateway.services.factory.ConcurrentSessionVerifierFactory
-org.apache.knox.gateway.services.factory.GatewayStatusServiceFactory
org.apache.knox.gateway.services.factory.LdapServiceFactory
org.apache.knox.gateway.services.factory.LDAPRolesLookupServiceFactory
+org.apache.knox.gateway.services.factory.TokenServiceFactory
+org.apache.knox.gateway.services.factory.TrustedOidcIssuerServiceFactory
diff --git a/gateway-server/src/main/resources/conf/gateway-site.xml b/gateway-server/src/main/resources/conf/gateway-site.xml
index fda674c179..a44a81d7e8 100644
--- a/gateway-server/src/main/resources/conf/gateway-site.xml
+++ b/gateway-server/src/main/resources/conf/gateway-site.xml
@@ -56,6 +56,18 @@ limitations under the License.
Base DN for LDAP entries in the proxy server. Default is dc=proxy,dc=com.
+
+ gateway.ldap.max.size.limit
+ 1000
+ Maximum number of entries returned by a search request.
+
+
+
+ gateway.ldap.max.time.limit
+ 60000
+ Maximum time for a search request in milliseconds.
+
+
gateway.ldap.recursive.group.resolution
false
@@ -113,4 +125,53 @@ limitations under the License.
Interceptor type.
+
+
+
\ No newline at end of file
diff --git a/gateway-server/src/main/resources/createKnoxIDFFederatedIdentityAttributesTable.sql b/gateway-server/src/main/resources/createKnoxIDFFederatedIdentityAttributesTable.sql
new file mode 100644
index 0000000000..c74cf756ed
--- /dev/null
+++ b/gateway-server/src/main/resources/createKnoxIDFFederatedIdentityAttributesTable.sql
@@ -0,0 +1,21 @@
+-- Licensed to the Apache Software Foundation (ASF) under one or more
+-- contributor license agreements. See the NOTICE file distributed with this
+-- work for additional information regarding copyright ownership. The ASF
+-- licenses this file to you under the Apache License, Version 2.0 (the
+-- "License"); you may not use this file except in compliance with the License.
+-- You may obtain a copy of the License at
+--
+-- http://www.apache.org/licenses/LICENSE-2.0
+--
+-- Unless required by applicable law or agreed to in writing, software
+-- distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+-- WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+-- License for the specific language governing permissions and limitations under
+-- the License.
+CREATE TABLE FEDERATED_IDENTITY_ATTR (
+ identity_id VARCHAR(36) NOT NULL,
+ attr_key VARCHAR(128) NOT NULL,
+ attr_value TEXT,
+ PRIMARY KEY (identity_id, attr_key),
+ FOREIGN KEY (identity_id) REFERENCES FEDERATED_IDENTITY (id) ON DELETE CASCADE
+)
\ No newline at end of file
diff --git a/gateway-server/src/main/resources/createKnoxIDFFederatedIdentityAttributesTableDerby.sql b/gateway-server/src/main/resources/createKnoxIDFFederatedIdentityAttributesTableDerby.sql
new file mode 100644
index 0000000000..60e1e247b6
--- /dev/null
+++ b/gateway-server/src/main/resources/createKnoxIDFFederatedIdentityAttributesTableDerby.sql
@@ -0,0 +1,22 @@
+-- Licensed to the Apache Software Foundation (ASF) under one or more
+-- contributor license agreements. See the NOTICE file distributed with this
+-- work for additional information regarding copyright ownership. The ASF
+-- licenses this file to you under the Apache License, Version 2.0 (the
+-- "License"); you may not use this file except in compliance with the License.
+-- You may obtain a copy of the License at
+--
+-- http://www.apache.org/licenses/LICENSE-2.0
+--
+-- Unless required by applicable law or agreed to in writing, software
+-- distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+-- WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+-- License for the specific language governing permissions and limitations under
+-- the License.
+
+CREATE TABLE FEDERATED_IDENTITY_ATTR (
+ identity_id VARCHAR(36) NOT NULL,
+ attr_key VARCHAR(128) NOT NULL,
+ attr_value CLOB,
+ PRIMARY KEY (identity_id, attr_key),
+ CONSTRAINT fk_fed_attr FOREIGN KEY (identity_id) REFERENCES FEDERATED_IDENTITY(id) ON DELETE CASCADE
+)
\ No newline at end of file
diff --git a/gateway-server/src/main/resources/createKnoxIDFFederatedIdentityAttributesTableOracle.sql b/gateway-server/src/main/resources/createKnoxIDFFederatedIdentityAttributesTableOracle.sql
new file mode 100644
index 0000000000..9d89349aa9
--- /dev/null
+++ b/gateway-server/src/main/resources/createKnoxIDFFederatedIdentityAttributesTableOracle.sql
@@ -0,0 +1,22 @@
+-- Licensed to the Apache Software Foundation (ASF) under one or more
+-- contributor license agreements. See the NOTICE file distributed with this
+-- work for additional information regarding copyright ownership. The ASF
+-- licenses this file to you under the Apache License, Version 2.0 (the
+-- "License"); you may not use this file except in compliance with the License.
+-- You may obtain a copy of the License at
+--
+-- http://www.apache.org/licenses/LICENSE-2.0
+--
+-- Unless required by applicable law or agreed to in writing, software
+-- distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+-- WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+-- License for the specific language governing permissions and limitations under
+-- the License.
+
+CREATE TABLE FEDERATED_IDENTITY_ATTR (
+ identity_id VARCHAR2(36) NOT NULL,
+ attr_key VARCHAR2(128) NOT NULL,
+ attr_value CLOB,
+ CONSTRAINT pk_fed_attr PRIMARY KEY (identity_id, attr_key),
+ CONSTRAINT fk_fed_attr FOREIGN KEY (identity_id) REFERENCES FEDERATED_IDENTITY(id) ON DELETE CASCADE
+)
\ No newline at end of file
diff --git a/gateway-server/src/main/resources/createKnoxIDFFederatedIdentityTable.sql b/gateway-server/src/main/resources/createKnoxIDFFederatedIdentityTable.sql
new file mode 100644
index 0000000000..dd2b163a7d
--- /dev/null
+++ b/gateway-server/src/main/resources/createKnoxIDFFederatedIdentityTable.sql
@@ -0,0 +1,24 @@
+-- Licensed to the Apache Software Foundation (ASF) under one or more
+-- contributor license agreements. See the NOTICE file distributed with this
+-- work for additional information regarding copyright ownership. The ASF
+-- licenses this file to you under the Apache License, Version 2.0 (the
+-- "License"); you may not use this file except in compliance with the License.
+-- You may obtain a copy of the License at
+--
+-- http://www.apache.org/licenses/LICENSE-2.0
+--
+-- Unless required by applicable law or agreed to in writing, software
+-- distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+-- WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+-- License for the specific language governing permissions and limitations under
+-- the License.
+
+CREATE TABLE FEDERATED_IDENTITY (
+ id VARCHAR(36) PRIMARY KEY,
+ user_id VARCHAR(36) NOT NULL,
+ provider VARCHAR(64) NOT NULL,
+ external_subject VARCHAR(255) NOT NULL,
+ external_issuer VARCHAR(255) NOT NULL,
+ created_at TIMESTAMP NOT NULL,
+ CONSTRAINT UX_FED_IDENTITY UNIQUE (provider, external_issuer, external_subject)
+)
\ No newline at end of file
diff --git a/gateway-server/src/main/resources/createKnoxIDFFederatedIdentityTableDerby.sql b/gateway-server/src/main/resources/createKnoxIDFFederatedIdentityTableDerby.sql
new file mode 100644
index 0000000000..dd2b163a7d
--- /dev/null
+++ b/gateway-server/src/main/resources/createKnoxIDFFederatedIdentityTableDerby.sql
@@ -0,0 +1,24 @@
+-- Licensed to the Apache Software Foundation (ASF) under one or more
+-- contributor license agreements. See the NOTICE file distributed with this
+-- work for additional information regarding copyright ownership. The ASF
+-- licenses this file to you under the Apache License, Version 2.0 (the
+-- "License"); you may not use this file except in compliance with the License.
+-- You may obtain a copy of the License at
+--
+-- http://www.apache.org/licenses/LICENSE-2.0
+--
+-- Unless required by applicable law or agreed to in writing, software
+-- distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+-- WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+-- License for the specific language governing permissions and limitations under
+-- the License.
+
+CREATE TABLE FEDERATED_IDENTITY (
+ id VARCHAR(36) PRIMARY KEY,
+ user_id VARCHAR(36) NOT NULL,
+ provider VARCHAR(64) NOT NULL,
+ external_subject VARCHAR(255) NOT NULL,
+ external_issuer VARCHAR(255) NOT NULL,
+ created_at TIMESTAMP NOT NULL,
+ CONSTRAINT UX_FED_IDENTITY UNIQUE (provider, external_issuer, external_subject)
+)
\ No newline at end of file
diff --git a/gateway-server/src/main/resources/createKnoxIDFFederatedIdentityTableOracle.sql b/gateway-server/src/main/resources/createKnoxIDFFederatedIdentityTableOracle.sql
new file mode 100644
index 0000000000..922d7b95a2
--- /dev/null
+++ b/gateway-server/src/main/resources/createKnoxIDFFederatedIdentityTableOracle.sql
@@ -0,0 +1,24 @@
+-- Licensed to the Apache Software Foundation (ASF) under one or more
+-- contributor license agreements. See the NOTICE file distributed with this
+-- work for additional information regarding copyright ownership. The ASF
+-- licenses this file to you under the Apache License, Version 2.0 (the
+-- "License"); you may not use this file except in compliance with the License.
+-- You may obtain a copy of the License at
+--
+-- http://www.apache.org/licenses/LICENSE-2.0
+--
+-- Unless required by applicable law or agreed to in writing, software
+-- distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+-- WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+-- License for the specific language governing permissions and limitations under
+-- the License.
+
+CREATE TABLE FEDERATED_IDENTITY (
+ id VARCHAR2(36) PRIMARY KEY,
+ user_id VARCHAR2(36) NOT NULL,
+ provider VARCHAR2(64) NOT NULL,
+ external_subject VARCHAR2(255) NOT NULL,
+ external_issuer VARCHAR2(255) NOT NULL,
+ created_at TIMESTAMP NOT NULL,
+ CONSTRAINT UX_FED_IDENTITY UNIQUE (provider, external_issuer, external_subject)
+)
\ No newline at end of file
diff --git a/gateway-server/src/main/resources/createKnoxIDFTrustedOidcIssuersTable.sql b/gateway-server/src/main/resources/createKnoxIDFTrustedOidcIssuersTable.sql
new file mode 100644
index 0000000000..a97a4a6cc8
--- /dev/null
+++ b/gateway-server/src/main/resources/createKnoxIDFTrustedOidcIssuersTable.sql
@@ -0,0 +1,23 @@
+-- Licensed to the Apache Software Foundation (ASF) under one or more
+-- contributor license agreements. See the NOTICE file distributed with this
+-- work for additional information regarding copyright ownership. The ASF
+-- licenses this file to you under the Apache License, Version 2.0 (the
+-- "License"); you may not use this file except in compliance with the License.
+-- You may obtain a copy of the License at
+--
+-- http://www.apache.org/licenses/LICENSE-2.0
+--
+-- Unless required by applicable law or agreed to in writing, software
+-- distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+-- WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+-- License for the specific language governing permissions and limitations under
+-- the License.
+
+CREATE TABLE IF NOT EXISTS TRUSTED_OIDC_ISSUERS (
+ issuer_url VARCHAR(2048) NOT NULL,
+ dynamic_jwks BOOLEAN DEFAULT false NOT NULL,
+ registered_at TIMESTAMP NOT NULL,
+ registered_by VARCHAR(2048),
+ cluster_name VARCHAR(256),
+ PRIMARY KEY (issuer_url)
+);
diff --git a/gateway-server/src/main/resources/createKnoxIDFTrustedOidcIssuersTableDerby.sql b/gateway-server/src/main/resources/createKnoxIDFTrustedOidcIssuersTableDerby.sql
new file mode 100644
index 0000000000..a3e77b4656
--- /dev/null
+++ b/gateway-server/src/main/resources/createKnoxIDFTrustedOidcIssuersTableDerby.sql
@@ -0,0 +1,22 @@
+-- Licensed to the Apache Software Foundation (ASF) under one or more
+-- contributor license agreements. See the NOTICE file distributed with this
+-- work for additional information regarding copyright ownership. The ASF
+-- licenses this file to you under the Apache License, Version 2.0 (the
+-- "License"); you may not use this file except in compliance with the License.
+-- You may obtain a copy of the License at
+--
+-- http://www.apache.org/licenses/LICENSE-2.0
+--
+-- Unless required by applicable law or agreed to in writing, software
+-- distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+-- WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+-- License for the specific language governing permissions and limitations under
+-- the License.
+
+CREATE TABLE TRUSTED_OIDC_ISSUERS (
+ issuer_url VARCHAR(2048) PRIMARY KEY NOT NULL,
+ dynamic_jwks BOOLEAN DEFAULT false NOT NULL,
+ registered_at TIMESTAMP NOT NULL,
+ registered_by VARCHAR(2048),
+ cluster_name VARCHAR(256)
+)
diff --git a/gateway-server/src/main/resources/createKnoxIDFTrustedOidcIssuersTableOracle.sql b/gateway-server/src/main/resources/createKnoxIDFTrustedOidcIssuersTableOracle.sql
new file mode 100644
index 0000000000..2c0de4bd04
--- /dev/null
+++ b/gateway-server/src/main/resources/createKnoxIDFTrustedOidcIssuersTableOracle.sql
@@ -0,0 +1,23 @@
+-- Licensed to the Apache Software Foundation (ASF) under one or more
+-- contributor license agreements. See the NOTICE file distributed with this
+-- work for additional information regarding copyright ownership. The ASF
+-- licenses this file to you under the Apache License, Version 2.0 (the
+-- "License"); you may not use this file except in compliance with the License.
+-- You may obtain a copy of the License at
+--
+-- http://www.apache.org/licenses/LICENSE-2.0
+--
+-- Unless required by applicable law or agreed to in writing, software
+-- distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+-- WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+-- License for the specific language governing permissions and limitations under
+-- the License.
+
+CREATE TABLE TRUSTED_OIDC_ISSUERS (
+ issuer_url VARCHAR2(2048) NOT NULL,
+ dynamic_jwks NUMBER(1) DEFAULT 0 NOT NULL,
+ registered_at TIMESTAMP(6) NOT NULL,
+ registered_by VARCHAR2(2048),
+ cluster_name VARCHAR2(256),
+ PRIMARY KEY (issuer_url)
+)
diff --git a/gateway-server/src/test/java/org/apache/knox/gateway/config/impl/GatewayConfigImplTest.java b/gateway-server/src/test/java/org/apache/knox/gateway/config/impl/GatewayConfigImplTest.java
index 0303150be3..9a337146bc 100644
--- a/gateway-server/src/test/java/org/apache/knox/gateway/config/impl/GatewayConfigImplTest.java
+++ b/gateway-server/src/test/java/org/apache/knox/gateway/config/impl/GatewayConfigImplTest.java
@@ -38,6 +38,7 @@
import java.security.KeyStore;
import java.util.ArrayList;
import java.util.Arrays;
+import java.util.Collections;
import java.util.HashSet;
import java.util.List;
import java.util.Map;
@@ -825,4 +826,31 @@ public void testReloadableConfigLoading() throws Exception {
System.clearProperty("KNOX_GATEWAY_CONF_DIR");
}
}
+
+ @Test
+ public void testSigningKeyAliases() {
+ GatewayConfigImpl config = new GatewayConfigImpl();
+
+ // Default: only the current signing key, so a single-key deployment is unchanged.
+ assertEquals(Collections.singletonList(config.getSigningKeyAlias()), config.getSigningKeyAliases());
+
+ // Additional aliases follow the current key, in order.
+ config.set(GatewayConfig.SIGNING_KEY_ALIASES_ADDITIONAL, "old-key-1, old-key-2");
+ List aliases = config.getSigningKeyAliases();
+ assertEquals(3, aliases.size());
+ assertEquals(config.getSigningKeyAlias(), aliases.get(0));
+ assertTrue(aliases.contains("old-key-1"));
+ assertTrue(aliases.contains("old-key-2"));
+
+ // "none" disables additional aliases.
+ config.set(GatewayConfig.SIGNING_KEY_ALIASES_ADDITIONAL, "none");
+ assertEquals(Collections.singletonList(config.getSigningKeyAlias()), config.getSigningKeyAliases());
+
+ // The current alias is never published/checked twice, even if listed as additional.
+ config.set(GatewayConfig.SIGNING_KEY_ALIASES_ADDITIONAL, config.getSigningKeyAlias() + ", old-key-1");
+ aliases = config.getSigningKeyAliases();
+ assertEquals(2, aliases.size());
+ assertEquals(config.getSigningKeyAlias(), aliases.get(0));
+ assertTrue(aliases.contains("old-key-1"));
+ }
}
diff --git a/gateway-server/src/test/java/org/apache/knox/gateway/services/AbstractGatewayServicesTest.java b/gateway-server/src/test/java/org/apache/knox/gateway/services/AbstractGatewayServicesTest.java
index ff58ad6f93..9041118883 100644
--- a/gateway-server/src/test/java/org/apache/knox/gateway/services/AbstractGatewayServicesTest.java
+++ b/gateway-server/src/test/java/org/apache/knox/gateway/services/AbstractGatewayServicesTest.java
@@ -67,7 +67,9 @@ public void testAddStartAndStop() throws ServiceLifecycleException {
ServiceType.REMOTE_CONFIGURATION_MONITOR,
ServiceType.GATEWAY_STATUS_SERVICE,
ServiceType.LDAP_SERVICE,
- ServiceType.LDAP_ROLES_LOOKUP_SERVICE
+ ServiceType.LDAP_ROLES_LOOKUP_SERVICE,
+ ServiceType.KNOXIDF_FEDERATED_IDENTITY_SERVICE,
+ ServiceType.TRUSTED_OIDC_ISSUER_SERVICE
};
assertNotEquals(ServiceType.values(), orderedServiceTypes);
diff --git a/gateway-server/src/test/java/org/apache/knox/gateway/services/factory/FederatedIdentityServiceFactoryTest.java b/gateway-server/src/test/java/org/apache/knox/gateway/services/factory/FederatedIdentityServiceFactoryTest.java
new file mode 100644
index 0000000000..996aae6cb2
--- /dev/null
+++ b/gateway-server/src/test/java/org/apache/knox/gateway/services/factory/FederatedIdentityServiceFactoryTest.java
@@ -0,0 +1,211 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.knox.gateway.services.factory;
+
+import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertFalse;
+import static org.junit.Assert.assertTrue;
+
+import java.io.File;
+import java.io.IOException;
+import java.nio.charset.StandardCharsets;
+import java.nio.file.Files;
+import java.nio.file.Paths;
+import java.util.Arrays;
+import java.util.Collections;
+import java.util.HashMap;
+import java.util.Map;
+
+import org.apache.commons.io.FileUtils;
+import org.apache.knox.gateway.config.impl.GatewayConfigImpl;
+import org.apache.knox.gateway.database.DatabaseType;
+import org.apache.knox.gateway.services.GatewayServices;
+import org.apache.knox.gateway.services.Service;
+import org.apache.knox.gateway.services.ServiceType;
+import org.apache.knox.gateway.services.knoxidf.federation.DerbyDBFederatedIdentityService;
+import org.apache.knox.gateway.services.knoxidf.federation.EmptyFederatedIdentityService;
+import org.apache.knox.gateway.services.knoxidf.federation.JdbcFederatedIdentityService;
+import org.apache.knox.gateway.services.security.AliasService;
+import org.apache.knox.gateway.services.security.MasterService;
+import org.apache.knox.gateway.services.topology.TopologyService;
+import org.apache.knox.gateway.topology.Topology;
+import org.apache.knox.test.TestUtils;
+import org.easymock.EasyMock;
+import org.junit.After;
+import org.junit.Test;
+
+public class FederatedIdentityServiceFactoryTest {
+
+ private final FederatedIdentityServiceFactory serviceFactory = new FederatedIdentityServiceFactory();
+ private final Map options = new HashMap<>();
+ private File tempDir;
+ private Service createdService;
+
+ @After
+ public void tearDown() throws Exception {
+ if (createdService != null) {
+ createdService.stop();
+ }
+ if (tempDir != null) {
+ FileUtils.forceDelete(tempDir);
+ }
+ }
+
+ @Test
+ public void shouldChooseDerbyWhenNoDatabaseConfigured() {
+ final GatewayConfigImpl config = EasyMock.createNiceMock(GatewayConfigImpl.class);
+ EasyMock.expect(config.getDatabaseType()).andReturn("none").anyTimes();
+ EasyMock.replay(config);
+ assertEquals(DerbyDBFederatedIdentityService.class.getName(), serviceFactory.chooseAutoImplementation(config));
+ }
+
+ @Test
+ public void shouldChooseDerbyWhenDatabaseTypeIsDerby() {
+ final GatewayConfigImpl config = EasyMock.createNiceMock(GatewayConfigImpl.class);
+ EasyMock.expect(config.getDatabaseType()).andReturn(DatabaseType.DERBY.type()).anyTimes();
+ EasyMock.replay(config);
+ assertEquals(DerbyDBFederatedIdentityService.class.getName(), serviceFactory.chooseAutoImplementation(config));
+ }
+
+ @Test
+ public void shouldChooseJdbcWhenExternalDatabaseConfigured() {
+ final GatewayConfigImpl config = EasyMock.createNiceMock(GatewayConfigImpl.class);
+ EasyMock.expect(config.getDatabaseType()).andReturn(DatabaseType.POSTGRESQL.type()).anyTimes();
+ EasyMock.replay(config);
+ assertEquals(JdbcFederatedIdentityService.class.getName(), serviceFactory.chooseAutoImplementation(config));
+ }
+
+ @Test
+ public void shouldDetectKnoxIdfFromInMemoryTopology() {
+ final GatewayServices gatewayServices = servicesWithTopology(topologyWithRole("KNOXIDF"));
+ final GatewayConfigImpl config = EasyMock.createNiceMock(GatewayConfigImpl.class);
+ EasyMock.replay(config);
+ assertTrue(serviceFactory.isKnoxIdfEnabledInAnyTopology(gatewayServices, config));
+ }
+
+ @Test
+ public void shouldDetectKnoxIdfAdminFromInMemoryTopology() {
+ final GatewayServices gatewayServices = servicesWithTopology(topologyWithRole("KNOXIDF_ADMIN"));
+ final GatewayConfigImpl config = EasyMock.createNiceMock(GatewayConfigImpl.class);
+ EasyMock.replay(config);
+ assertTrue(serviceFactory.isKnoxIdfEnabledInAnyTopology(gatewayServices, config));
+ }
+
+ @Test
+ public void shouldDetectKnoxIdfViaDiskScanWhenNoTopologiesLoadedYet() throws IOException {
+ // Mirrors the real init-time timing: the topology monitor has not loaded topologies yet, so the
+ // in-memory list is empty, but the topology XML already exists on disk.
+ tempDir = TestUtils.createTempDir(this.getClass().getName());
+ writeTopologyFile("knoxidf-sso.xml", "KNOXIDF");
+
+ final GatewayServices gatewayServices = servicesWithTopology(/* no in-memory topologies */);
+ final GatewayConfigImpl config = EasyMock.createNiceMock(GatewayConfigImpl.class);
+ EasyMock.expect(config.getGatewayTopologyDir()).andReturn(tempDir.getAbsolutePath()).anyTimes();
+ EasyMock.replay(config);
+
+ assertTrue(serviceFactory.isKnoxIdfEnabledInAnyTopology(gatewayServices, config));
+ }
+
+ @Test
+ public void shouldNotDetectKnoxIdfWhenAbsentFromMemoryAndDisk() throws IOException {
+ tempDir = TestUtils.createTempDir(this.getClass().getName());
+ writeTopologyFile("sandbox.xml", "KNOXSSO");
+
+ final GatewayServices gatewayServices = servicesWithTopology(topologyWithRole("KNOXSSO"));
+ final GatewayConfigImpl config = EasyMock.createNiceMock(GatewayConfigImpl.class);
+ EasyMock.expect(config.getGatewayTopologyDir()).andReturn(tempDir.getAbsolutePath()).anyTimes();
+ EasyMock.replay(config);
+
+ assertFalse(serviceFactory.isKnoxIdfEnabledInAnyTopology(gatewayServices, config));
+ }
+
+ @Test
+ public void shouldHonorExplicitEmptyImplEvenWhenKnoxIdfIsDeployed() throws Exception {
+ final GatewayServices gatewayServices = servicesWithTopology(topologyWithRole("KNOXIDF"));
+ final GatewayConfigImpl config = EasyMock.createNiceMock(GatewayConfigImpl.class);
+ EasyMock.replay(config);
+
+ createdService = serviceFactory.create(gatewayServices, ServiceType.KNOXIDF_FEDERATED_IDENTITY_SERVICE, config, options,
+ EmptyFederatedIdentityService.class.getName());
+ assertTrue(createdService instanceof EmptyFederatedIdentityService);
+ }
+
+ @Test
+ public void shouldSelectEmptyWhenKnoxIdfNotDeployed() throws Exception {
+ final GatewayServices gatewayServices = servicesWithTopology(/* no topologies */);
+ final GatewayConfigImpl config = EasyMock.createNiceMock(GatewayConfigImpl.class);
+ // No topology dir and no in-memory topology -> KnoxIDF not enabled -> Empty.
+ EasyMock.replay(config);
+
+ createdService = serviceFactory.create(gatewayServices, ServiceType.KNOXIDF_FEDERATED_IDENTITY_SERVICE, config, options, "");
+ assertTrue(createdService instanceof EmptyFederatedIdentityService);
+ }
+
+ @Test
+ public void shouldAutoSelectDerbyServiceWhenKnoxIdfDeployedWithoutExternalDatabase() throws Exception {
+ tempDir = TestUtils.createTempDir(this.getClass().getName());
+ final String masterSecret = "M4st3RSecret!";
+ final MasterService masterService = EasyMock.createNiceMock(MasterService.class);
+ EasyMock.expect(masterService.getMasterSecret()).andReturn(masterSecret.toCharArray()).anyTimes();
+ EasyMock.replay(masterService);
+ final AliasService aliasService = EasyMock.createNiceMock(AliasService.class);
+ EasyMock.replay(aliasService);
+
+ final GatewayServices gatewayServices = EasyMock.createNiceMock(GatewayServices.class);
+ final TopologyService topologyService = EasyMock.createNiceMock(TopologyService.class);
+ EasyMock.expect(topologyService.getTopologies()).andReturn(Collections.singletonList(topologyWithRole("KNOXIDF"))).anyTimes();
+ EasyMock.replay(topologyService);
+ EasyMock.expect(gatewayServices.getService(ServiceType.TOPOLOGY_SERVICE)).andReturn(topologyService).anyTimes();
+ EasyMock.expect(gatewayServices.getService(ServiceType.ALIAS_SERVICE)).andReturn(aliasService).anyTimes();
+ EasyMock.expect(gatewayServices.getService(ServiceType.MASTER_SERVICE)).andReturn(masterService).anyTimes();
+ EasyMock.replay(gatewayServices);
+
+ final GatewayConfigImpl config = EasyMock.createNiceMock(GatewayConfigImpl.class);
+ EasyMock.expect(config.getDatabaseType()).andReturn(DatabaseType.DERBY.type()).anyTimes();
+ EasyMock.expect(config.getGatewaySecurityDir()).andReturn(tempDir.getAbsolutePath()).anyTimes();
+ EasyMock.expect(config.getDatabaseName()).andReturn(Paths.get(tempDir.getAbsolutePath(), "tokens").toString()).anyTimes();
+ EasyMock.replay(config);
+
+ createdService = serviceFactory.create(gatewayServices, ServiceType.KNOXIDF_FEDERATED_IDENTITY_SERVICE, config, options, "");
+ assertTrue("Expected a self-provisioning Derby-backed federated identity service, got "
+ + createdService.getClass().getName(), createdService instanceof DerbyDBFederatedIdentityService);
+ }
+
+ private Topology topologyWithRole(String role) {
+ final Topology topology = new Topology();
+ topology.setName("topology-" + role);
+ final org.apache.knox.gateway.topology.Service service = new org.apache.knox.gateway.topology.Service();
+ service.setRole(role);
+ topology.addService(service);
+ return topology;
+ }
+
+ private GatewayServices servicesWithTopology(Topology... topologies) {
+ final TopologyService topologyService = EasyMock.createNiceMock(TopologyService.class);
+ EasyMock.expect(topologyService.getTopologies()).andReturn(Arrays.asList(topologies)).anyTimes();
+ EasyMock.replay(topologyService);
+ final GatewayServices gatewayServices = EasyMock.createNiceMock(GatewayServices.class);
+ EasyMock.expect(gatewayServices.getService(ServiceType.TOPOLOGY_SERVICE)).andReturn(topologyService).anyTimes();
+ EasyMock.replay(gatewayServices);
+ return gatewayServices;
+ }
+
+ private void writeTopologyFile(String name, String content) throws IOException {
+ Files.write(Paths.get(tempDir.getAbsolutePath(), name), content.getBytes(StandardCharsets.UTF_8));
+ }
+}
diff --git a/gateway-server/src/test/java/org/apache/knox/gateway/services/factory/TrustedOidcIssuerServiceFactoryTest.java b/gateway-server/src/test/java/org/apache/knox/gateway/services/factory/TrustedOidcIssuerServiceFactoryTest.java
new file mode 100644
index 0000000000..ff06f78256
--- /dev/null
+++ b/gateway-server/src/test/java/org/apache/knox/gateway/services/factory/TrustedOidcIssuerServiceFactoryTest.java
@@ -0,0 +1,188 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with this
+ * work for additional information regarding copyright ownership. The ASF
+ * licenses this file to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+ * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+ * License for the specific language governing permissions and limitations under
+ * the License.
+ */
+package org.apache.knox.gateway.services.factory;
+
+import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertNotNull;
+import static org.junit.Assert.assertTrue;
+
+import java.io.File;
+import java.nio.file.Paths;
+import java.util.Arrays;
+import java.util.Collections;
+import java.util.HashMap;
+import java.util.Map;
+
+import org.apache.commons.io.FileUtils;
+import org.apache.knox.gateway.config.impl.GatewayConfigImpl;
+import org.apache.knox.gateway.database.DatabaseType;
+import org.apache.knox.gateway.services.GatewayServices;
+import org.apache.knox.gateway.services.Service;
+import org.apache.knox.gateway.services.ServiceType;
+import org.apache.knox.gateway.services.knoxidf.trustedoidcissuer.DerbyDBTrustedOidcIssuerService;
+import org.apache.knox.gateway.services.knoxidf.trustedoidcissuer.EmptyTrustedOidcIssuerService;
+import org.apache.knox.gateway.services.knoxidf.trustedoidcissuer.JdbcTrustedOidcIssuerService;
+import org.apache.knox.gateway.services.security.AliasService;
+import org.apache.knox.gateway.services.security.MasterService;
+import org.apache.knox.gateway.services.topology.TopologyService;
+import org.apache.knox.gateway.topology.Topology;
+import org.apache.knox.test.TestUtils;
+import org.easymock.EasyMock;
+import org.junit.After;
+import org.junit.Test;
+
+public class TrustedOidcIssuerServiceFactoryTest {
+
+ private final TrustedOidcIssuerServiceFactory serviceFactory = new TrustedOidcIssuerServiceFactory();
+ private final Map options = new HashMap<>();
+ private File tempDir;
+ private Service createdService;
+
+ @After
+ public void tearDown() throws Exception {
+ if (createdService != null) {
+ createdService.stop();
+ }
+ if (tempDir != null) {
+ FileUtils.forceDelete(tempDir);
+ }
+ }
+
+ // ------------------------------------------------------------------
+ // Auto-implementation selection
+ // ------------------------------------------------------------------
+
+ @Test
+ public void shouldChooseDerbyWhenNoDatabaseConfigured() {
+ final GatewayConfigImpl config = EasyMock.createNiceMock(GatewayConfigImpl.class);
+ EasyMock.expect(config.getDatabaseType()).andReturn("none").anyTimes();
+ EasyMock.replay(config);
+ assertEquals(DerbyDBTrustedOidcIssuerService.class.getName(), serviceFactory.chooseAutoImplementation(config));
+ }
+
+ @Test
+ public void shouldChooseDerbyWhenDatabaseTypeIsDerby() {
+ final GatewayConfigImpl config = EasyMock.createNiceMock(GatewayConfigImpl.class);
+ EasyMock.expect(config.getDatabaseType()).andReturn(DatabaseType.DERBY.type()).anyTimes();
+ EasyMock.replay(config);
+ assertEquals(DerbyDBTrustedOidcIssuerService.class.getName(), serviceFactory.chooseAutoImplementation(config));
+ }
+
+ @Test
+ public void shouldChooseJdbcWhenExternalDatabaseConfigured() {
+ final GatewayConfigImpl config = EasyMock.createNiceMock(GatewayConfigImpl.class);
+ EasyMock.expect(config.getDatabaseType()).andReturn(DatabaseType.POSTGRESQL.type()).anyTimes();
+ EasyMock.replay(config);
+ assertEquals(JdbcTrustedOidcIssuerService.class.getName(), serviceFactory.chooseAutoImplementation(config));
+ }
+
+ // ------------------------------------------------------------------
+ // Empty (no KNOXIDF) cases
+ // ------------------------------------------------------------------
+
+ /** Zero topologies → KnoxIDF not deployed → Empty. */
+ @Test
+ public void shouldSelectEmptyWhenNoTopologies() throws Exception {
+ final GatewayServices gws = servicesWithTopology(/* no topologies */);
+ final GatewayConfigImpl config = EasyMock.createNiceMock(GatewayConfigImpl.class);
+ EasyMock.replay(config);
+ createdService = serviceFactory.create(gws, ServiceType.TRUSTED_OIDC_ISSUER_SERVICE, config, options, "");
+ assertTrue(createdService instanceof EmptyTrustedOidcIssuerService);
+ }
+
+ /** Topologies exist but none contain KNOXIDF or KNOXIDF_ADMIN → Empty. */
+ @Test
+ public void shouldSelectEmptyWhenNoKnoxIdfRole() throws Exception {
+ final GatewayServices gws = servicesWithTopology(topologyWithRole("KNOXSSO"));
+ final GatewayConfigImpl config = EasyMock.createNiceMock(GatewayConfigImpl.class);
+ EasyMock.replay(config);
+ createdService = serviceFactory.create(gws, ServiceType.TRUSTED_OIDC_ISSUER_SERVICE, config, options, "");
+ assertTrue(createdService instanceof EmptyTrustedOidcIssuerService);
+ }
+
+ /** An explicit Empty implementation is honored even when KnoxIDF is deployed. */
+ @Test
+ public void shouldHonorExplicitEmptyImplEvenWhenKnoxIdfIsDeployed() throws Exception {
+ final GatewayServices gws = servicesWithTopology(topologyWithRole("KNOXIDF"));
+ final GatewayConfigImpl config = EasyMock.createNiceMock(GatewayConfigImpl.class);
+ EasyMock.replay(config);
+ createdService = serviceFactory.create(gws, ServiceType.TRUSTED_OIDC_ISSUER_SERVICE, config, options,
+ EmptyTrustedOidcIssuerService.class.getName());
+ assertTrue(createdService instanceof EmptyTrustedOidcIssuerService);
+ }
+
+ // ------------------------------------------------------------------
+ // Derby auto-provisioning
+ // ------------------------------------------------------------------
+
+ @Test
+ public void shouldAutoSelectDerbyServiceWhenKnoxIdfDeployedWithoutExternalDatabase() throws Exception {
+ tempDir = TestUtils.createTempDir(this.getClass().getName());
+ final MasterService masterService = EasyMock.createNiceMock(MasterService.class);
+ EasyMock.expect(masterService.getMasterSecret()).andReturn("M4st3RSecret!".toCharArray()).anyTimes();
+ EasyMock.replay(masterService);
+ final AliasService aliasService = EasyMock.createNiceMock(AliasService.class);
+ EasyMock.replay(aliasService);
+
+ final TopologyService topologyService = EasyMock.createNiceMock(TopologyService.class);
+ EasyMock.expect(topologyService.getTopologies()).andReturn(Collections.singletonList(topologyWithRole("KNOXIDF"))).anyTimes();
+ EasyMock.replay(topologyService);
+ final GatewayServices gws = EasyMock.createNiceMock(GatewayServices.class);
+ EasyMock.expect(gws.getService(ServiceType.TOPOLOGY_SERVICE)).andReturn(topologyService).anyTimes();
+ EasyMock.expect(gws.getService(ServiceType.ALIAS_SERVICE)).andReturn(aliasService).anyTimes();
+ EasyMock.expect(gws.getService(ServiceType.MASTER_SERVICE)).andReturn(masterService).anyTimes();
+ EasyMock.replay(gws);
+
+ final GatewayConfigImpl config = EasyMock.createNiceMock(GatewayConfigImpl.class);
+ EasyMock.expect(config.getDatabaseType()).andReturn(DatabaseType.DERBY.type()).anyTimes();
+ EasyMock.expect(config.getGatewaySecurityDir()).andReturn(tempDir.getAbsolutePath()).anyTimes();
+ EasyMock.expect(config.getDatabaseName()).andReturn(Paths.get(tempDir.getAbsolutePath(), "tokens").toString()).anyTimes();
+ EasyMock.expect(config.getTrustedOidcIssuerMaxTrustedIssuers()).andReturn(10).anyTimes();
+ EasyMock.expect(config.getTrustedOidcIssuerDiscoveryCacheTtlSecs()).andReturn(300).anyTimes();
+ EasyMock.expect(config.getTrustedOidcIssuerDiscoveryConnectTimeoutMs()).andReturn(2000).anyTimes();
+ EasyMock.expect(config.getTrustedOidcIssuerDiscoveryReadTimeoutMs()).andReturn(2000).anyTimes();
+ EasyMock.replay(config);
+
+ createdService = serviceFactory.create(gws, ServiceType.TRUSTED_OIDC_ISSUER_SERVICE, config, options, "");
+ assertNotNull(createdService);
+ assertTrue("Expected a self-provisioning Derby-backed trusted OIDC issuer service, got "
+ + createdService.getClass().getName(), createdService instanceof DerbyDBTrustedOidcIssuerService);
+ }
+
+ // ------------------------------------------------------------------
+ // Helpers
+ // ------------------------------------------------------------------
+
+ private Topology topologyWithRole(String role) {
+ final Topology topology = new Topology();
+ topology.setName("topology-" + role);
+ final org.apache.knox.gateway.topology.Service service = new org.apache.knox.gateway.topology.Service();
+ service.setRole(role);
+ topology.addService(service);
+ return topology;
+ }
+
+ private GatewayServices servicesWithTopology(Topology... topologies) {
+ final TopologyService topologyService = EasyMock.createNiceMock(TopologyService.class);
+ EasyMock.expect(topologyService.getTopologies()).andReturn(Arrays.asList(topologies)).anyTimes();
+ EasyMock.replay(topologyService);
+ final GatewayServices gws = EasyMock.createNiceMock(GatewayServices.class);
+ EasyMock.expect(gws.getService(ServiceType.TOPOLOGY_SERVICE)).andReturn(topologyService).anyTimes();
+ EasyMock.replay(gws);
+ return gws;
+ }
+}
diff --git a/gateway-server/src/test/java/org/apache/knox/gateway/services/knoxidf/federation/DerbyDBFederatedIdentityServiceTest.java b/gateway-server/src/test/java/org/apache/knox/gateway/services/knoxidf/federation/DerbyDBFederatedIdentityServiceTest.java
new file mode 100644
index 0000000000..370e987b73
--- /dev/null
+++ b/gateway-server/src/test/java/org/apache/knox/gateway/services/knoxidf/federation/DerbyDBFederatedIdentityServiceTest.java
@@ -0,0 +1,183 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with this
+ * work for additional information regarding copyright ownership. The ASF
+ * licenses this file to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+ * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+ * License for the specific language governing permissions and limitations under
+ * the License.
+ */
+package org.apache.knox.gateway.services.knoxidf.federation;
+
+import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertFalse;
+import static org.junit.Assert.assertNotEquals;
+import static org.junit.Assert.assertSame;
+import static org.junit.Assert.assertTrue;
+
+import java.io.File;
+import java.io.IOException;
+import java.nio.file.Paths;
+import java.time.Instant;
+import java.util.Collections;
+import java.util.HashMap;
+import java.util.Map;
+import java.util.Optional;
+
+import org.apache.commons.io.FileUtils;
+import org.apache.knox.gateway.config.impl.GatewayConfigImpl;
+import org.apache.knox.gateway.database.DatabaseType;
+import org.apache.knox.gateway.services.security.AliasService;
+import org.apache.knox.gateway.services.security.MasterService;
+import org.apache.knox.test.TestUtils;
+import org.easymock.EasyMock;
+import org.junit.After;
+import org.junit.Before;
+import org.junit.Test;
+
+/**
+ * Verifies that {@link DerbyDBFederatedIdentityService} self-provisions an embedded Derby database
+ * and round-trips a federated identity through it.
+ */
+public class DerbyDBFederatedIdentityServiceTest {
+
+ private File securityDir;
+ private DerbyDBFederatedIdentityService service;
+
+ @Before
+ public void setUp() throws IOException {
+ securityDir = TestUtils.createTempDir(this.getClass().getName());
+ }
+
+ @After
+ public void tearDown() throws Exception {
+ if (service != null) {
+ service.stop();
+ }
+ if (securityDir != null) {
+ FileUtils.forceDelete(securityDir);
+ }
+ }
+
+ @Test
+ public void shouldRoundTripAFederatedIdentityOnEmbeddedDerby() throws Exception {
+ final String masterSecret = "M4st3RSecret!";
+ final MasterService masterService = EasyMock.createNiceMock(MasterService.class);
+ EasyMock.expect(masterService.getMasterSecret()).andReturn(masterSecret.toCharArray()).anyTimes();
+ EasyMock.replay(masterService);
+
+ final AliasService aliasService = EasyMock.createNiceMock(AliasService.class);
+ EasyMock.replay(aliasService);
+
+ final GatewayConfigImpl config = EasyMock.createNiceMock(GatewayConfigImpl.class);
+ EasyMock.expect(config.getGatewaySecurityDir()).andReturn(securityDir.getAbsolutePath()).anyTimes();
+ EasyMock.expect(config.getDatabaseType()).andReturn(DatabaseType.DERBY.type()).anyTimes();
+ EasyMock.expect(config.getDatabaseName()).andReturn(Paths.get(securityDir.getAbsolutePath(), "tokens").toString()).anyTimes();
+ EasyMock.replay(config);
+
+ service = new DerbyDBFederatedIdentityService();
+ service.setAliasService(aliasService);
+ service.setMasterService(masterService);
+ service.init(config, Collections.emptyMap());
+
+ final Map attributes = new HashMap<>();
+ attributes.put("email", "alice@example.com");
+ final FederatedIdentity identity = new FederatedIdentity("knox-user-1", "KEYCLOAK", "external-subject-1",
+ "https://issuer.example.com/realms/knox", Instant.now(), attributes);
+ service.addFederatedIdentity(identity);
+
+ final Optional byId = service.findById(identity.getId());
+ assertTrue("Expected the identity to be found by id", byId.isPresent());
+ assertEquals("KEYCLOAK", byId.get().getProvider());
+ assertEquals("alice@example.com", byId.get().getAttribute("email"));
+
+ final Optional byProviderAndSubject = service.findByProviderAndSubject(
+ "KEYCLOAK", "https://issuer.example.com/realms/knox", "external-subject-1");
+ assertTrue("Expected the identity to be found by provider/issuer/subject", byProviderAndSubject.isPresent());
+ assertEquals(identity.getId(), byProviderAndSubject.get().getId());
+
+ final Optional missing = service.findByProviderAndSubject(
+ "KEYCLOAK", "https://issuer.example.com/realms/knox", "no-such-subject");
+ assertFalse("Did not expect an identity for an unknown subject", missing.isPresent());
+ }
+
+ /**
+ * Regression guard for the "Table/View 'FEDERATED_IDENTITY' already exists" failure on restart:
+ * re-initialising against the same on-disk Derby database (as happens on a Knox restart) must not
+ * try to re-create the already-present tables. Before the {@code JDBCUtils.tableExists} casing
+ * fix, the lowercase {@code federated_identity} table name never matched Derby's uppercased
+ * metadata, so init re-ran the CREATE and blew up on the second boot.
+ */
+ @Test
+ public void shouldReinitializeWithoutErrorWhenTablesAlreadyExist() throws Exception {
+ service = newDerbyService();
+ final FederatedIdentity identity = new FederatedIdentity("knox-user-1", "KEYCLOAK", "external-subject-1",
+ "https://issuer.example.com/realms/knox", Instant.now(), new HashMap<>());
+ service.addFederatedIdentity(identity);
+ service.stop();
+
+ // Simulate a restart: a brand-new service instance pointing at the same Derby folder.
+ service = newDerbyService();
+ final Optional byId = service.findById(identity.getId());
+ assertTrue("Expected the previously-persisted identity to survive a restart", byId.isPresent());
+ }
+
+ /**
+ * Regression guard for the concurrent-first-login phantom-id race: two callbacks for the same
+ * external identity each build a FederatedIdentity with a distinct random primary key. The first
+ * wins the insert; the second violates UNIQUE(provider, external_issuer, external_subject).
+ * addFederatedIdentity must return the already-stored row (the winner's id), never the losing
+ * thread's in-memory object whose random id was never persisted -- otherwise the downstream auth
+ * code is keyed to an id absent from the table, surfacing later as a token-exchange 500.
+ */
+ @Test
+ public void shouldReturnPersistedRowWhenExternalIdentityAlreadyExists() throws Exception {
+ service = newDerbyService();
+
+ final FederatedIdentity first = new FederatedIdentity("knox-user-1", "KEYCLOAK", "external-subject-1",
+ "https://issuer.example.com/realms/knox", Instant.now(), new HashMap<>());
+ final FederatedIdentity firstStored = service.addFederatedIdentity(first);
+ assertSame("Happy path must return the same instance it persisted (no re-query)", first, firstStored);
+
+ // The losing thread of a concurrent first login: same external identity, brand-new object with a
+ // different random primary key that never gets persisted.
+ final FederatedIdentity duplicate = new FederatedIdentity("knox-user-1", "KEYCLOAK", "external-subject-1",
+ "https://issuer.example.com/realms/knox", Instant.now(), new HashMap<>());
+ assertNotEquals("Test setup: the duplicate must carry a different random id",
+ first.getId(), duplicate.getId());
+
+ final FederatedIdentity stored = service.addFederatedIdentity(duplicate);
+ assertEquals("On unique-constraint conflict the canonical persisted id must be returned",
+ first.getId(), stored.getId());
+ assertFalse("The losing thread's random id must not exist in the table",
+ service.findById(duplicate.getId()).isPresent());
+ }
+
+ private DerbyDBFederatedIdentityService newDerbyService() throws Exception {
+ final MasterService masterService = EasyMock.createNiceMock(MasterService.class);
+ EasyMock.expect(masterService.getMasterSecret()).andReturn("M4st3RSecret!".toCharArray()).anyTimes();
+ EasyMock.replay(masterService);
+
+ final AliasService aliasService = EasyMock.createNiceMock(AliasService.class);
+ EasyMock.replay(aliasService);
+
+ final GatewayConfigImpl config = EasyMock.createNiceMock(GatewayConfigImpl.class);
+ EasyMock.expect(config.getGatewaySecurityDir()).andReturn(securityDir.getAbsolutePath()).anyTimes();
+ EasyMock.expect(config.getDatabaseType()).andReturn(DatabaseType.DERBY.type()).anyTimes();
+ EasyMock.expect(config.getDatabaseName()).andReturn(Paths.get(securityDir.getAbsolutePath(), "tokens").toString()).anyTimes();
+ EasyMock.replay(config);
+
+ final DerbyDBFederatedIdentityService svc = new DerbyDBFederatedIdentityService();
+ svc.setAliasService(aliasService);
+ svc.setMasterService(masterService);
+ svc.init(config, Collections.emptyMap());
+ return svc;
+ }
+}
diff --git a/gateway-server/src/test/java/org/apache/knox/gateway/services/knoxidf/trustedoidcissuer/DerbyDBTrustedOidcIssuerServiceTest.java b/gateway-server/src/test/java/org/apache/knox/gateway/services/knoxidf/trustedoidcissuer/DerbyDBTrustedOidcIssuerServiceTest.java
new file mode 100644
index 0000000000..f2bc4f0815
--- /dev/null
+++ b/gateway-server/src/test/java/org/apache/knox/gateway/services/knoxidf/trustedoidcissuer/DerbyDBTrustedOidcIssuerServiceTest.java
@@ -0,0 +1,131 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with this
+ * work for additional information regarding copyright ownership. The ASF
+ * licenses this file to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+ * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+ * License for the specific language governing permissions and limitations under
+ * the License.
+ */
+package org.apache.knox.gateway.services.knoxidf.trustedoidcissuer;
+
+import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertFalse;
+import static org.junit.Assert.assertTrue;
+
+import java.io.File;
+import java.io.IOException;
+import java.nio.file.Paths;
+import java.time.Instant;
+import java.util.Collections;
+import java.util.List;
+
+import org.apache.commons.io.FileUtils;
+import org.apache.knox.gateway.config.impl.GatewayConfigImpl;
+import org.apache.knox.gateway.database.DatabaseType;
+import org.apache.knox.gateway.services.security.AliasService;
+import org.apache.knox.gateway.services.security.MasterService;
+import org.apache.knox.test.TestUtils;
+import org.easymock.EasyMock;
+import org.junit.After;
+import org.junit.Before;
+import org.junit.Test;
+
+/**
+ * Verifies that {@link DerbyDBTrustedOidcIssuerService} self-provisions an embedded Derby database
+ * and round-trips a trusted OIDC issuer through it.
+ */
+public class DerbyDBTrustedOidcIssuerServiceTest {
+
+ private File securityDir;
+ private DerbyDBTrustedOidcIssuerService service;
+
+ @Before
+ public void setUp() throws IOException {
+ securityDir = TestUtils.createTempDir(this.getClass().getName());
+ }
+
+ @After
+ public void tearDown() throws Exception {
+ if (service != null) {
+ service.stop();
+ }
+ if (securityDir != null) {
+ FileUtils.forceDelete(securityDir);
+ }
+ }
+
+ @Test
+ public void shouldRoundTripATrustedIssuerOnEmbeddedDerby() throws Exception {
+ service = newService(newConfig());
+
+ final TrustedOidcIssuer issuer = new TrustedOidcIssuer(
+ "https://issuer.example.com/realms/knox", true, "clusterA", Instant.now(), "admin");
+ service.register(issuer);
+
+ assertTrue("Expected the registered issuer to be trusted", service.isTrusted(issuer.getIssuerUrl()));
+ assertTrue("Expected the registered issuer to be dynamic-jwks", service.isDynamicJwks(issuer.getIssuerUrl()));
+ assertFalse("Did not expect an unknown issuer to be trusted", service.isTrusted("https://unknown.example.com"));
+
+ final List all = service.list();
+ assertEquals(1, all.size());
+ assertEquals(issuer.getIssuerUrl(), all.get(0).getIssuerUrl());
+
+ service.deregister(issuer.getIssuerUrl());
+ assertFalse("Expected the issuer to be gone after deregister", service.isTrusted(issuer.getIssuerUrl()));
+ }
+
+ /**
+ * Regression guard for the "Table/View 'TRUSTED_OIDC_ISSUERS' already exists" failure on restart:
+ * re-initialising against the same on-disk Derby database (as happens on a Knox restart) must not
+ * try to re-create the already-present table.
+ */
+ @Test
+ public void shouldReinitializeWithoutErrorWhenTableAlreadyExists() throws Exception {
+ service = newService(newConfig());
+ final TrustedOidcIssuer issuer = new TrustedOidcIssuer(
+ "https://issuer.example.com/realms/knox", false, null, Instant.now(), "admin");
+ service.register(issuer);
+ service.stop();
+
+ // Simulate a restart: a brand-new service instance pointing at the same Derby folder.
+ service = newService(newConfig());
+ assertTrue("Expected the previously-registered issuer to survive a restart",
+ service.isTrusted(issuer.getIssuerUrl()));
+ }
+
+ private DerbyDBTrustedOidcIssuerService newService(GatewayConfigImpl config) throws Exception {
+ final MasterService masterService = EasyMock.createNiceMock(MasterService.class);
+ EasyMock.expect(masterService.getMasterSecret()).andReturn("M4st3RSecret!".toCharArray()).anyTimes();
+ EasyMock.replay(masterService);
+
+ final AliasService aliasService = EasyMock.createNiceMock(AliasService.class);
+ EasyMock.replay(aliasService);
+
+ final DerbyDBTrustedOidcIssuerService svc = new DerbyDBTrustedOidcIssuerService();
+ svc.setAliasService(aliasService);
+ svc.setMasterService(masterService);
+ svc.init(config, Collections.emptyMap());
+ return svc;
+ }
+
+ private GatewayConfigImpl newConfig() {
+ final GatewayConfigImpl config = EasyMock.createNiceMock(GatewayConfigImpl.class);
+ EasyMock.expect(config.getGatewaySecurityDir()).andReturn(securityDir.getAbsolutePath()).anyTimes();
+ EasyMock.expect(config.getDatabaseType()).andReturn(DatabaseType.DERBY.type()).anyTimes();
+ EasyMock.expect(config.getDatabaseName()).andReturn(Paths.get(securityDir.getAbsolutePath(), "tokens").toString()).anyTimes();
+ EasyMock.expect(config.getTrustedOidcIssuerMaxTrustedIssuers()).andReturn(10).anyTimes();
+ EasyMock.expect(config.getTrustedOidcIssuerDiscoveryCacheTtlSecs()).andReturn(300).anyTimes();
+ EasyMock.expect(config.getTrustedOidcIssuerDiscoveryConnectTimeoutMs()).andReturn(2000).anyTimes();
+ EasyMock.expect(config.getTrustedOidcIssuerDiscoveryReadTimeoutMs()).andReturn(2000).anyTimes();
+ EasyMock.replay(config);
+ return config;
+ }
+}
diff --git a/gateway-server/src/test/java/org/apache/knox/gateway/services/knoxidf/trustedoidcissuer/EmptyTrustedOidcIssuerServiceTest.java b/gateway-server/src/test/java/org/apache/knox/gateway/services/knoxidf/trustedoidcissuer/EmptyTrustedOidcIssuerServiceTest.java
new file mode 100644
index 0000000000..c606010a5e
--- /dev/null
+++ b/gateway-server/src/test/java/org/apache/knox/gateway/services/knoxidf/trustedoidcissuer/EmptyTrustedOidcIssuerServiceTest.java
@@ -0,0 +1,64 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with this
+ * work for additional information regarding copyright ownership. The ASF
+ * licenses this file to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+ * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+ * License for the specific language governing permissions and limitations under
+ * the License.
+ */
+package org.apache.knox.gateway.services.knoxidf.trustedoidcissuer;
+
+import org.junit.Test;
+
+import java.time.Instant;
+
+import static org.junit.Assert.assertFalse;
+import static org.junit.Assert.assertTrue;
+
+public class EmptyTrustedOidcIssuerServiceTest {
+
+ private final EmptyTrustedOidcIssuerService service = new EmptyTrustedOidcIssuerService();
+
+ @Test
+ public void testIsTrustedReturnsFalse() {
+ assertFalse(service.isTrusted("https://any.issuer.com"));
+ }
+
+ @Test
+ public void testIsDynamicJwksReturnsFalse() {
+ assertFalse(service.isDynamicJwks("https://any.issuer.com"));
+ }
+
+ @Test
+ public void testResolveJwksUriReturnsEmpty() {
+ assertFalse(service.resolveJwksUri("https://any.issuer.com").isPresent());
+ }
+
+ @Test
+ public void testRefreshJwksUriIsNoOp() {
+ service.refreshJwksUri("https://any.issuer.com"); // must not throw
+ }
+
+ @Test
+ public void testListReturnsEmpty() {
+ assertTrue(service.list().isEmpty());
+ }
+
+ @Test(expected = UnsupportedOperationException.class)
+ public void testRegisterThrows() {
+ service.register(new TrustedOidcIssuer("https://issuer.com", false, null, Instant.now(), null));
+ }
+
+ @Test(expected = UnsupportedOperationException.class)
+ public void testDeregisterThrows() {
+ service.deregister("https://issuer.com");
+ }
+}
diff --git a/gateway-server/src/test/java/org/apache/knox/gateway/services/knoxidf/trustedoidcissuer/JdbcTrustedOidcIssuerServiceTest.java b/gateway-server/src/test/java/org/apache/knox/gateway/services/knoxidf/trustedoidcissuer/JdbcTrustedOidcIssuerServiceTest.java
new file mode 100644
index 0000000000..5e8aa1cc8c
--- /dev/null
+++ b/gateway-server/src/test/java/org/apache/knox/gateway/services/knoxidf/trustedoidcissuer/JdbcTrustedOidcIssuerServiceTest.java
@@ -0,0 +1,419 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with this
+ * work for additional information regarding copyright ownership. The ASF
+ * licenses this file to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+ * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+ * License for the specific language governing permissions and limitations under
+ * the License.
+ */
+package org.apache.knox.gateway.services.knoxidf.trustedoidcissuer;
+
+import org.apache.commons.lang3.reflect.FieldUtils;
+import org.apache.knox.gateway.config.GatewayConfig;
+import org.apache.knox.gateway.database.AbstractDataSourceFactory;
+import org.apache.knox.gateway.database.DatabaseType;
+import org.apache.knox.gateway.services.ServiceLifecycleException;
+import org.apache.knox.gateway.services.security.AliasService;
+import org.easymock.EasyMock;
+import org.junit.AfterClass;
+import org.junit.Before;
+import org.junit.BeforeClass;
+import org.junit.Test;
+
+import java.sql.Connection;
+import java.sql.DriverManager;
+import java.sql.PreparedStatement;
+import java.sql.SQLException;
+import java.time.Instant;
+import java.util.List;
+import java.util.concurrent.atomic.AtomicBoolean;
+import java.util.concurrent.locks.ReentrantLock;
+
+import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertFalse;
+import static org.junit.Assert.assertNotNull;
+import static org.junit.Assert.assertSame;
+import static org.junit.Assert.assertThrows;
+import static org.junit.Assert.assertTrue;
+
+public class JdbcTrustedOidcIssuerServiceTest {
+
+ private static final String DB_NAME = "trustedissuers_svc_test";
+ private static final String DERBY_CREATE_URL = "jdbc:derby:memory:" + DB_NAME + ";create=true";
+ private static final String DERBY_URL = "jdbc:derby:memory:" + DB_NAME;
+ private static final String DERBY_SHUTDOWN_URL = "jdbc:derby:memory:" + DB_NAME + ";shutdown=true";
+
+ private GatewayConfig gatewayConfig;
+ private AliasService aliasService;
+ private JdbcTrustedOidcIssuerService service;
+
+ @BeforeClass
+ public static void setUpClass() throws Exception {
+ // Derby 10.14 does not recognize locales like en_001; force a standard locale.
+ java.util.Locale.setDefault(java.util.Locale.US);
+ // Create the Derby in-memory DB so DerbyDataSourceFactory can connect to it
+ DriverManager.getConnection(DERBY_CREATE_URL).close();
+ }
+
+ @AfterClass
+ public static void tearDownClass() {
+ try {
+ DriverManager.getConnection(DERBY_SHUTDOWN_URL);
+ } catch (SQLException e) {
+ // Derby signals a successful in-memory shutdown as SQLState 08006 / error 45000
+ if (!(e.getErrorCode() == 45000 && "08006".equals(e.getSQLState()))) {
+ throw new RuntimeException("Unexpected Derby shutdown error", e);
+ }
+ }
+ }
+
+ @Before
+ public void setUp() throws Exception {
+ // Clear table between tests
+ try (Connection conn = DriverManager.getConnection(DERBY_URL);
+ PreparedStatement ps = conn.prepareStatement("DELETE FROM TRUSTED_OIDC_ISSUERS")) {
+ ps.executeUpdate();
+ } catch (SQLException e) {
+ // Table may not exist yet on first setUp; service.init() will create it
+ }
+
+ gatewayConfig = EasyMock.createNiceMock(GatewayConfig.class);
+ EasyMock.expect(gatewayConfig.getDatabaseType()).andReturn(DatabaseType.DERBY.type()).anyTimes();
+ EasyMock.expect(gatewayConfig.getDatabaseName()).andReturn("memory:" + DB_NAME).anyTimes();
+ EasyMock.expect(gatewayConfig.getTrustedOidcIssuerMaxTrustedIssuers() ).andReturn(10).anyTimes();
+ EasyMock.replay(gatewayConfig);
+
+ aliasService = EasyMock.createNiceMock(AliasService.class);
+ EasyMock.expect(aliasService.getPasswordFromAliasForGateway(
+ AbstractDataSourceFactory.DATABASE_USER_ALIAS_NAME)).andReturn(null).anyTimes();
+ EasyMock.expect(aliasService.getPasswordFromAliasForGateway(
+ AbstractDataSourceFactory.DATABASE_PASSWORD_ALIAS_NAME)).andReturn(null).anyTimes();
+ EasyMock.replay(aliasService);
+
+ service = new JdbcTrustedOidcIssuerService();
+ service.setAliasService(aliasService);
+ service.init(gatewayConfig, null);
+ }
+
+ // ------------------------------------------------------------------
+ // Basic CRUD and snapshot
+ // ------------------------------------------------------------------
+
+ @Test
+ public void testRegisterAndIsTrusted() {
+ service.register(issuer("https://issuer.example.com", false));
+
+ assertTrue(service.isTrusted("https://issuer.example.com"));
+ assertFalse(service.isTrusted("https://other.example.com"));
+ }
+
+ @Test
+ public void testDeregisterClearsSnapshot() {
+ service.register(issuer("https://issuer.example.com", false));
+ assertTrue(service.isTrusted("https://issuer.example.com"));
+
+ service.deregister("https://issuer.example.com");
+ assertFalse(service.isTrusted("https://issuer.example.com"));
+ }
+
+ @Test
+ public void testListReflectsSnapshot() {
+ final TrustedOidcIssuer a = issuer("https://a.example.com", false, "clusterA", "admin");
+ final TrustedOidcIssuer b = issuer("https://b.example.com", true, "clusterB", "operator");
+ service.register(a);
+ service.register(b);
+
+ final List listed = service.list();
+ assertEquals(2, listed.size());
+ assertIssuerInList(a, listed);
+ assertIssuerInList(b, listed);
+ }
+
+ @Test
+ public void testDynamicJwksFlag() {
+ service.register(issuer("https://static.example.com", false));
+ service.register(issuer("https://dynamic.example.com", true));
+
+ assertFalse(service.isDynamicJwks("https://static.example.com"));
+ assertTrue(service.isDynamicJwks("https://dynamic.example.com"));
+ assertFalse("Unregistered issuer must return false",
+ service.isDynamicJwks("https://unknown.example.com"));
+ }
+
+ /**
+ * All fields must round-trip through the DB correctly, including nullable ones.
+ */
+ @Test
+ public void testRegisterPersistsAllFields() {
+ final TrustedOidcIssuer issuer = issuer("https://issuer.example.com", true, "prod-cluster", "admin");
+ service.register(issuer);
+
+ final List listed = service.list();
+ assertEquals(1, listed.size());
+ assertIssuerEquals(issuer, listed.get(0));
+ }
+
+ @Test
+ public void testRegisterPersistsNullableFieldsAsNull() {
+ // clusterName and registeredBy may be null
+ final TrustedOidcIssuer issuer = new TrustedOidcIssuer(
+ "https://issuer.example.com", false, null, Instant.now(), null);
+ service.register(issuer);
+
+ final TrustedOidcIssuer fromList = service.list().get(0);
+ assertEquals("https://issuer.example.com", fromList.getIssuerUrl());
+ assertFalse(fromList.isDynamicJwks());
+ assertNotNull("registeredAt must always be persisted", fromList.getRegisteredAt());
+ assertTrue("clusterName round-trips as null", fromList.getClusterName() == null
+ || fromList.getClusterName().isEmpty());
+ assertTrue("registeredBy round-trips as null", fromList.getRegisteredBy() == null
+ || fromList.getRegisteredBy().isEmpty());
+ }
+
+ @Test
+ public void testRegistrySnapshotWarmOnInit() throws Exception {
+ // Pre-populate the TRUSTED_OIDC_ISSUERS table before initializing a new service
+ final String preloadedUrl = "https://preloaded.example.com";
+ try (Connection conn = DriverManager.getConnection(DERBY_URL);
+ PreparedStatement ps = conn.prepareStatement(
+ "INSERT INTO TRUSTED_OIDC_ISSUERS (issuer_url, dynamic_jwks, registered_at) "
+ + "VALUES (?, ?, ?)")) {
+ ps.setString(1, preloadedUrl);
+ ps.setBoolean(2, false);
+ ps.setTimestamp(3, java.sql.Timestamp.from(Instant.now()));
+ ps.executeUpdate();
+ }
+
+ // New service instance: snapshot must be loaded from DB on startup
+ final JdbcTrustedOidcIssuerService freshService = new JdbcTrustedOidcIssuerService();
+ freshService.setAliasService(aliasService);
+ freshService.init(gatewayConfig, null);
+
+ assertTrue("Pre-populated issuer must be trusted after init", freshService.isTrusted(preloadedUrl));
+ }
+
+ @Test(expected = RuntimeException.class)
+ public void testDuplicateRegistrationThrows() {
+ final TrustedOidcIssuer issuer = issuer("https://issuer.example.com", false);
+ service.register(issuer);
+ service.register(issuer); // duplicate primary key → RuntimeException
+ }
+
+ @Test
+ public void testReloadAfterMutation() {
+ final String url = "https://issuer.example.com";
+
+ service.register(issuer(url, false));
+ assertTrue("Snapshot must contain issuer after register", service.isTrusted(url));
+ assertEquals(1, service.list().size());
+
+ service.deregister(url);
+ assertFalse("Snapshot must not contain issuer after deregister", service.isTrusted(url));
+ assertTrue(service.list().isEmpty());
+ }
+
+ @Test
+ public void testMaxTrustedIssuers() throws ServiceLifecycleException {
+ final GatewayConfig limitedConfig = EasyMock.createNiceMock(GatewayConfig.class);
+ EasyMock.expect(limitedConfig.getDatabaseType()).andReturn(DatabaseType.DERBY.type()).anyTimes();
+ EasyMock.expect(limitedConfig.getDatabaseName()).andReturn("memory:" + DB_NAME).anyTimes();
+ EasyMock.expect(limitedConfig.getTrustedOidcIssuerMaxTrustedIssuers() ).andReturn(2).anyTimes();
+ EasyMock.replay(limitedConfig);
+
+ final JdbcTrustedOidcIssuerService limitedService = new JdbcTrustedOidcIssuerService();
+ limitedService.setAliasService(aliasService);
+ limitedService.init(limitedConfig, null);
+
+ limitedService.register(issuer("https://a.example.com", false));
+ assertEquals("First registration must succeed", 1, limitedService.list().size());
+
+ limitedService.register(issuer("https://b.example.com", false));
+ assertEquals("Second registration must succeed", 2, limitedService.list().size());
+
+ assertThrows(IllegalStateException.class,
+ () -> limitedService.register(issuer("https://c.example.com", false)));
+
+ assertEquals("Prior registrations must be unaffected by the rejected call",
+ 2, limitedService.list().size());
+ }
+
+ @Test
+ public void testDeregisterNonExistentIsNoOp() {
+ // deregister of unknown issuer must not throw
+ service.deregister("https://nonexistent.example.com");
+ assertTrue(service.list().isEmpty());
+ }
+
+ // ------------------------------------------------------------------
+ // resolveJwksUri / refreshJwksUri delegation
+ // ------------------------------------------------------------------
+
+ @Test
+ public void testResolveJwksUriForNonDynamicIssuerReturnsEmpty() {
+ service.register(issuer("https://static.example.com", false));
+ // Non-dynamic issuer: OIDCDiscoveryHelper.discoverJwksUri returns empty immediately
+ // without any HTTP call (the SSRF gate inside the helper blocks it).
+ assertFalse(service.resolveJwksUri("https://static.example.com").isPresent());
+ }
+
+ @Test
+ public void testResolveJwksUriForUnregisteredIssuerReturnsEmpty() {
+ assertFalse(service.resolveJwksUri("https://unknown.example.com").isPresent());
+ }
+
+ @Test
+ public void testRefreshJwksUriForNonDynamicIsNoOp() {
+ service.register(issuer("https://static.example.com", false));
+ // refreshJwksUri checks isDynamicJwks first; for non-dynamic it is a no-op
+ service.refreshJwksUri("https://static.example.com"); // must not throw
+ }
+
+ @Test
+ public void testRefreshJwksUriForUnregisteredIsNoOp() {
+ service.refreshJwksUri("https://unknown.example.com"); // must not throw
+ }
+
+ // ------------------------------------------------------------------
+ // SQL exception error paths
+ // ------------------------------------------------------------------
+
+ @Test(expected = RuntimeException.class)
+ public void testDeregisterSqlExceptionOnDeleteThrowsRuntimeException() throws Exception {
+ final TrustedOidcIssuerDatabase mockDb = EasyMock.createMock(TrustedOidcIssuerDatabase.class);
+ mockDb.delete(EasyMock.anyString());
+ EasyMock.expectLastCall().andThrow(new java.sql.SQLException("delete failed"));
+ EasyMock.replay(mockDb);
+ FieldUtils.writeField(service, "database", mockDb, true);
+
+ service.deregister("https://any.example.com");
+ }
+
+ @Test(expected = RuntimeException.class)
+ public void testRegisterSqlExceptionOnSnapshotReloadPropagates() throws Exception {
+ final TrustedOidcIssuerDatabase mockDb = EasyMock.createMock(TrustedOidcIssuerDatabase.class);
+ mockDb.insert(EasyMock.anyObject(TrustedOidcIssuer.class));
+ EasyMock.expectLastCall();
+ EasyMock.expect(mockDb.selectAll()).andThrow(new java.sql.SQLException("selectAll failed"));
+ EasyMock.replay(mockDb);
+ FieldUtils.writeField(service, "database", mockDb, true);
+
+ service.register(issuer("https://any.example.com", false));
+ }
+
+ @Test(expected = RuntimeException.class)
+ public void testDeregisterSqlExceptionOnSnapshotReloadPropagates() throws Exception {
+ final TrustedOidcIssuerDatabase mockDb = EasyMock.createMock(TrustedOidcIssuerDatabase.class);
+ mockDb.delete(EasyMock.anyString());
+ EasyMock.expectLastCall();
+ EasyMock.expect(mockDb.selectAll()).andThrow(new java.sql.SQLException("selectAll failed"));
+ EasyMock.replay(mockDb);
+ FieldUtils.writeField(service, "database", mockDb, true);
+
+ service.deregister("https://any.example.com");
+ }
+
+ // ------------------------------------------------------------------
+ // Init guard
+ // ------------------------------------------------------------------
+
+ @Test(expected = ServiceLifecycleException.class)
+ public void testInitFailsWithoutAliasService() throws ServiceLifecycleException {
+ final JdbcTrustedOidcIssuerService noAliasService = new JdbcTrustedOidcIssuerService();
+ // setAliasService NOT called
+ noAliasService.init(gatewayConfig, null);
+ }
+
+ /**
+ * Review finding M5: init() must re-check {@code initialized} inside the lock so a thread that
+ * blocked while another was initialising does not re-initialise (overwriting the already-built
+ * database/discoveryHelper). This deterministically reproduces the race window: the test thread
+ * holds the init lock and marks the service initialised (as a "winning" thread would) while a
+ * second init() call is blocked entering the critical section; when it proceeds, the inner recheck
+ * must make it a no-op and leave the sentinel database reference untouched.
+ */
+ @Test
+ public void testConcurrentInitDoesNotReinitialize() throws Exception {
+ final ReentrantLock initLock = (ReentrantLock) FieldUtils.readField(service, "initLock", true);
+ final AtomicBoolean initialized = (AtomicBoolean) FieldUtils.readField(service, "initialized", true);
+
+ // A sentinel that the losing init() must NOT overwrite if the inner recheck is present.
+ final TrustedOidcIssuerDatabase sentinel = EasyMock.createNiceMock(TrustedOidcIssuerDatabase.class);
+ FieldUtils.writeField(service, "database", sentinel, true);
+
+ // Simulate the pre-init state a second racing thread would have observed at the outer check.
+ initialized.set(false);
+
+ // Hold the lock first, then start the racing init(): it passes the outer !initialized check and
+ // blocks entering the critical section until we release the lock.
+ initLock.lock();
+ final AtomicBoolean workerFailed = new AtomicBoolean(false);
+ final Thread worker = new Thread(() -> {
+ try {
+ service.init(gatewayConfig, null);
+ } catch (Exception e) {
+ workerFailed.set(true);
+ }
+ });
+ try {
+ worker.start();
+ // Wait until the worker is actually blocked in the lock queue, i.e. it entered init() while
+ // initialized was still false (the exact race the inner recheck must defend against).
+ final long deadline = System.currentTimeMillis() + 10_000;
+ while (!initLock.hasQueuedThreads() && System.currentTimeMillis() < deadline) {
+ Thread.yield();
+ }
+ assertTrue("Worker should be blocked entering the init critical section", initLock.hasQueuedThreads());
+ // Mimic the winning thread finishing initialisation while we hold the lock.
+ initialized.set(true);
+ } finally {
+ initLock.unlock();
+ }
+ worker.join(10_000);
+
+ assertFalse("Racing init() must not have thrown", workerFailed.get());
+ assertFalse("Worker thread must have finished", worker.isAlive());
+ assertSame("A second init() must not rebuild the database once initialised (inner recheck)",
+ sentinel, FieldUtils.readField(service, "database", true));
+ }
+
+ // ------------------------------------------------------------------
+ // Helpers
+ // ------------------------------------------------------------------
+
+ private static TrustedOidcIssuer issuer(String url, boolean dynamicJwks) {
+ return new TrustedOidcIssuer(url, dynamicJwks, null, Instant.now(), null);
+ }
+
+ private static TrustedOidcIssuer issuer(String url, boolean dynamicJwks,
+ String clusterName, String registeredBy) {
+ return new TrustedOidcIssuer(url, dynamicJwks, clusterName, Instant.now(), registeredBy);
+ }
+
+ /**
+ * Asserts that all non-generated fields of {@code expected} match {@code actual}, and
+ * that the generated {@code registeredAt} field is non-null.
+ */
+ private static void assertIssuerEquals(TrustedOidcIssuer expected, TrustedOidcIssuer actual) {
+ assertEquals("issuerUrl", expected.getIssuerUrl(), actual.getIssuerUrl());
+ assertEquals("dynamicJwks", expected.isDynamicJwks(), actual.isDynamicJwks());
+ assertEquals("clusterName", expected.getClusterName(), actual.getClusterName());
+ assertEquals("registeredBy", expected.getRegisteredBy(), actual.getRegisteredBy());
+ assertNotNull("registeredAt must be persisted", actual.getRegisteredAt());
+ }
+
+ private static void assertIssuerInList(TrustedOidcIssuer expected, List list) {
+ final TrustedOidcIssuer found = list.stream()
+ .filter(i -> expected.getIssuerUrl().equals(i.getIssuerUrl()))
+ .findFirst()
+ .orElseThrow(() -> new AssertionError("Issuer not found in list: " + expected.getIssuerUrl()));
+ assertIssuerEquals(expected, found);
+ }
+}
diff --git a/gateway-server/src/test/java/org/apache/knox/gateway/services/knoxidf/trustedoidcissuer/OIDCDiscoveryHelperTest.java b/gateway-server/src/test/java/org/apache/knox/gateway/services/knoxidf/trustedoidcissuer/OIDCDiscoveryHelperTest.java
new file mode 100644
index 0000000000..f978a38afc
--- /dev/null
+++ b/gateway-server/src/test/java/org/apache/knox/gateway/services/knoxidf/trustedoidcissuer/OIDCDiscoveryHelperTest.java
@@ -0,0 +1,303 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with this
+ * work for additional information regarding copyright ownership. The ASF
+ * licenses this file to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+ * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+ * License for the specific language governing permissions and limitations under
+ * the License.
+ */
+package org.apache.knox.gateway.services.knoxidf.trustedoidcissuer;
+
+import org.apache.http.StatusLine;
+import org.apache.http.client.methods.CloseableHttpResponse;
+import org.apache.http.client.methods.HttpUriRequest;
+import org.apache.http.entity.StringEntity;
+import org.apache.http.impl.client.CloseableHttpClient;
+import org.easymock.Capture;
+import org.easymock.EasyMock;
+import org.junit.Test;
+
+import java.io.IOException;
+import java.util.Optional;
+
+import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertFalse;
+import static org.junit.Assert.assertTrue;
+
+public class OIDCDiscoveryHelperTest {
+
+ private static final String ISSUER = "https://issuer.example.com";
+ private static final String ISSUER_WITH_SLASH = "https://issuer.example.com/";
+ private static final String JWKS_URI = "https://issuer.example.com/jwks";
+ private static final long CACHE_TTL = 600L;
+
+ // Minimal valid OIDC discovery document (all required fields per OpenID Connect Discovery 1.0)
+ private static final String VALID_DISCOVERY_JSON = "{"
+ + "\"issuer\":\"" + ISSUER + "\","
+ + "\"authorization_endpoint\":\"https://issuer.example.com/authorize\","
+ + "\"jwks_uri\":\"" + JWKS_URI + "\","
+ + "\"response_types_supported\":[\"code\"],"
+ + "\"subject_types_supported\":[\"public\"],"
+ + "\"id_token_signing_alg_values_supported\":[\"RS256\"]"
+ + "}";
+
+ // Discovery doc where jwks_uri is absent; Nimbus throws ParseException for this.
+ private static final String DISCOVERY_JSON_NO_JWKS_URI = "{"
+ + "\"issuer\":\"" + ISSUER + "\","
+ + "\"authorization_endpoint\":\"https://issuer.example.com/authorize\","
+ + "\"response_types_supported\":[\"code\"],"
+ + "\"subject_types_supported\":[\"public\"],"
+ + "\"id_token_signing_alg_values_supported\":[\"RS256\"]"
+ + "}";
+
+ // ------------------------------------------------------------------
+ // Helpers
+ // ------------------------------------------------------------------
+
+ /** Returns a mock TrustedOidcIssuerService with fixed isTrusted / isDynamicJwks behavior. */
+ private static TrustedOidcIssuerService trustedDynamic() {
+ return stubService(true, true);
+ }
+
+ private static TrustedOidcIssuerService trustedStatic() {
+ return stubService(true, false);
+ }
+
+ private static TrustedOidcIssuerService untrusted() {
+ return stubService(false, false);
+ }
+
+ private static TrustedOidcIssuerService stubService(boolean trusted, boolean dynamicJwks) {
+ return new EmptyTrustedOidcIssuerService() {
+ @Override public boolean isTrusted(String url) { return trusted; }
+ @Override public boolean isDynamicJwks(String url) { return dynamicJwks; }
+ };
+ }
+
+ /**
+ * Returns a mock CloseableHttpResponse that yields the given status code and body.
+ * Uses a real StringEntity so EntityUtils.toString() works without deep mocking.
+ */
+ private static CloseableHttpResponse mockResponse(int statusCode, String body) throws Exception {
+ final StatusLine statusLine = EasyMock.createNiceMock(StatusLine.class);
+ EasyMock.expect(statusLine.getStatusCode()).andReturn(statusCode).anyTimes();
+ EasyMock.replay(statusLine);
+
+ final CloseableHttpResponse response = EasyMock.createNiceMock(CloseableHttpResponse.class);
+ EasyMock.expect(response.getStatusLine()).andReturn(statusLine).anyTimes();
+ if (body != null) {
+ EasyMock.expect(response.getEntity()).andReturn(new StringEntity(body, "UTF-8")).anyTimes();
+ }
+ EasyMock.replay(response);
+ return response;
+ }
+
+ /** Returns an OIDCDiscoveryHelper backed by the given mock HttpClient. */
+ private static OIDCDiscoveryHelper helper(TrustedOidcIssuerService trustedIssuers,
+ CloseableHttpClient client) {
+ return new OIDCDiscoveryHelper(trustedIssuers, CACHE_TTL, client);
+ }
+
+ // ------------------------------------------------------------------
+ // SSRF gate
+ // ------------------------------------------------------------------
+
+ /**
+ * SSRF prevention: discoverJwksUri must return empty immediately for an issuer that is
+ * not registered for dynamic JWKS and must never call HttpClient.execute.
+ */
+ @Test
+ public void testNoHttpCallForUntrustedIssuer() throws Exception {
+ // Strict mock: any unexpected call to execute() fails the test immediately.
+ final CloseableHttpClient client = EasyMock.createMock(CloseableHttpClient.class);
+ EasyMock.replay(client);
+
+ final Optional result = helper(untrusted(), client).discoverJwksUri(ISSUER);
+
+ assertFalse("Untrusted issuer must return empty", result.isPresent());
+ EasyMock.verify(client); // verifies execute() was never called
+ }
+
+ @Test
+ public void testStaticJwksIssuerMakesNoHttpCall() throws Exception {
+ final CloseableHttpClient client = EasyMock.createMock(CloseableHttpClient.class);
+ EasyMock.replay(client);
+
+ final Optional result = helper(trustedStatic(), client).discoverJwksUri(ISSUER);
+
+ assertFalse("Static-JWKS issuer must return empty", result.isPresent());
+ EasyMock.verify(client);
+ }
+
+ // ------------------------------------------------------------------
+ // Happy path
+ // ------------------------------------------------------------------
+
+ @Test
+ public void testDiscoveryReturnsJwksUri() throws Exception {
+ final CloseableHttpClient client = EasyMock.createMock(CloseableHttpClient.class);
+ EasyMock.expect(client.execute(EasyMock.isA(HttpUriRequest.class)))
+ .andReturn(mockResponse(200, VALID_DISCOVERY_JSON));
+ EasyMock.replay(client);
+
+ final Optional result = helper(trustedDynamic(), client).discoverJwksUri(ISSUER);
+
+ assertTrue(result.isPresent());
+ assertEquals(JWKS_URI, result.get());
+ EasyMock.verify(client);
+ }
+
+ // ------------------------------------------------------------------
+ // URL normalization
+ // ------------------------------------------------------------------
+
+ @Test
+ public void testDiscoveryUrlTrailingSlashStripped() throws Exception {
+ final Capture captured = EasyMock.newCapture();
+ final CloseableHttpClient client = EasyMock.createMock(CloseableHttpClient.class);
+ EasyMock.expect(client.execute(EasyMock.capture(captured)))
+ .andReturn(mockResponse(200, VALID_DISCOVERY_JSON));
+ EasyMock.replay(client);
+
+ helper(trustedDynamic(), client).discoverJwksUri(ISSUER_WITH_SLASH);
+
+ assertEquals("https://issuer.example.com/.well-known/openid-configuration",
+ captured.getValue().getURI().toString());
+ }
+
+ @Test
+ public void testDiscoveryUrlNoDoubleSlashWithoutTrailingSlash() throws Exception {
+ final Capture captured = EasyMock.newCapture();
+ final CloseableHttpClient client = EasyMock.createMock(CloseableHttpClient.class);
+ EasyMock.expect(client.execute(EasyMock.capture(captured)))
+ .andReturn(mockResponse(200, VALID_DISCOVERY_JSON));
+ EasyMock.replay(client);
+
+ helper(trustedDynamic(), client).discoverJwksUri(ISSUER);
+
+ assertEquals("https://issuer.example.com/.well-known/openid-configuration",
+ captured.getValue().getURI().toString());
+ }
+
+ // ------------------------------------------------------------------
+ // Cache behaviour
+ // ------------------------------------------------------------------
+
+ @Test
+ public void testDiscoveryDocumentCacheHit() throws Exception {
+ // Strict mock expects exactly one execute() call; a second call would throw.
+ final CloseableHttpClient client = EasyMock.createMock(CloseableHttpClient.class);
+ EasyMock.expect(client.execute(EasyMock.isA(HttpUriRequest.class)))
+ .andReturn(mockResponse(200, VALID_DISCOVERY_JSON))
+ .once();
+ EasyMock.replay(client);
+
+ final OIDCDiscoveryHelper h = helper(trustedDynamic(), client);
+ h.discoverJwksUri(ISSUER); // fetch
+ h.discoverJwksUri(ISSUER); // cache hit — must NOT call execute again
+
+ EasyMock.verify(client);
+ }
+
+ @Test
+ public void testInvalidateEvictsFromCache() throws Exception {
+ final CloseableHttpClient client = EasyMock.createMock(CloseableHttpClient.class);
+ EasyMock.expect(client.execute(EasyMock.isA(HttpUriRequest.class)))
+ .andReturn(mockResponse(200, VALID_DISCOVERY_JSON))
+ .times(2); // must be called twice after eviction
+ EasyMock.replay(client);
+
+ final OIDCDiscoveryHelper h = helper(trustedDynamic(), client);
+ h.discoverJwksUri(ISSUER); // fetch #1
+ h.invalidate(ISSUER); // evict
+ h.discoverJwksUri(ISSUER); // fetch #2
+
+ EasyMock.verify(client);
+ }
+
+ /**
+ * When fetchJwksUri returns null (any failure), Caffeine must NOT cache the null.
+ * The next call must trigger a fresh HTTP request.
+ */
+ @Test
+ public void testNullNotCachedAfterFailure() throws Exception {
+ final CloseableHttpClient client = EasyMock.createMock(CloseableHttpClient.class);
+ // First call: connection error → fetchJwksUri returns null
+ EasyMock.expect(client.execute(EasyMock.isA(HttpUriRequest.class)))
+ .andThrow(new IOException("connection refused"));
+ // Second call: succeeds
+ EasyMock.expect(client.execute(EasyMock.isA(HttpUriRequest.class)))
+ .andReturn(mockResponse(200, VALID_DISCOVERY_JSON));
+ EasyMock.replay(client);
+
+ final OIDCDiscoveryHelper h = helper(trustedDynamic(), client);
+ assertFalse(h.discoverJwksUri(ISSUER).isPresent()); // failure → empty
+ assertTrue(h.discoverJwksUri(ISSUER).isPresent()); // retry → success
+
+ EasyMock.verify(client);
+ }
+
+ // ------------------------------------------------------------------
+ // HTTP error paths
+ // ------------------------------------------------------------------
+
+ @Test
+ public void testHttpGetNon200ReturnsEmpty() throws Exception {
+ final CloseableHttpClient client = EasyMock.createMock(CloseableHttpClient.class);
+ EasyMock.expect(client.execute(EasyMock.isA(HttpUriRequest.class)))
+ .andReturn(mockResponse(404, null));
+ EasyMock.replay(client);
+
+ assertFalse(helper(trustedDynamic(), client).discoverJwksUri(ISSUER).isPresent());
+ EasyMock.verify(client);
+ }
+
+ @Test
+ public void testHttpGetConnectionExceptionReturnsEmpty() throws Exception {
+ final CloseableHttpClient client = EasyMock.createMock(CloseableHttpClient.class);
+ EasyMock.expect(client.execute(EasyMock.isA(HttpUriRequest.class)))
+ .andThrow(new IOException("connection refused"));
+ EasyMock.replay(client);
+
+ assertFalse(helper(trustedDynamic(), client).discoverJwksUri(ISSUER).isPresent());
+ EasyMock.verify(client);
+ }
+
+ // ------------------------------------------------------------------
+ // Discovery document parse errors
+ // ------------------------------------------------------------------
+
+ @Test
+ public void testMalformedDiscoveryDocumentReturnsEmpty() throws Exception {
+ final CloseableHttpClient client = EasyMock.createMock(CloseableHttpClient.class);
+ EasyMock.expect(client.execute(EasyMock.isA(HttpUriRequest.class)))
+ .andReturn(mockResponse(200, "not valid json at all"));
+ EasyMock.replay(client);
+
+ assertFalse(helper(trustedDynamic(), client).discoverJwksUri(ISSUER).isPresent());
+ EasyMock.verify(client);
+ }
+
+ /**
+ * Nimbus 11.x treats jwks_uri as required and throws ParseException when it is absent.
+ * Verifies the catch block in fetchJwksUri handles this and returns Optional.empty().
+ */
+ @Test
+ public void testMissingJwksUriReturnsEmpty() throws Exception {
+ final CloseableHttpClient client = EasyMock.createMock(CloseableHttpClient.class);
+ EasyMock.expect(client.execute(EasyMock.isA(HttpUriRequest.class)))
+ .andReturn(mockResponse(200, DISCOVERY_JSON_NO_JWKS_URI));
+ EasyMock.replay(client);
+
+ assertFalse(helper(trustedDynamic(), client).discoverJwksUri(ISSUER).isPresent());
+ EasyMock.verify(client);
+ }
+}
diff --git a/gateway-server/src/test/java/org/apache/knox/gateway/services/knoxidf/trustedoidcissuer/TrustedOidcIssuerTest.java b/gateway-server/src/test/java/org/apache/knox/gateway/services/knoxidf/trustedoidcissuer/TrustedOidcIssuerTest.java
new file mode 100644
index 0000000000..a728e99ac8
--- /dev/null
+++ b/gateway-server/src/test/java/org/apache/knox/gateway/services/knoxidf/trustedoidcissuer/TrustedOidcIssuerTest.java
@@ -0,0 +1,71 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with this
+ * work for additional information regarding copyright ownership. The ASF
+ * licenses this file to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+ * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+ * License for the specific language governing permissions and limitations under
+ * the License.
+ */
+package org.apache.knox.gateway.services.knoxidf.trustedoidcissuer;
+
+import org.junit.Test;
+
+import java.lang.reflect.Field;
+import java.lang.reflect.Method;
+import java.lang.reflect.Modifier;
+import java.time.Instant;
+
+import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertFalse;
+import static org.junit.Assert.assertNull;
+import static org.junit.Assert.assertTrue;
+
+public class TrustedOidcIssuerTest {
+
+ @Test
+ public void testGetters() {
+ Instant now = Instant.now();
+ TrustedOidcIssuer issuer = new TrustedOidcIssuer(
+ "https://issuer.example.com", true, "cluster-a", now, "admin@example.com");
+
+ assertEquals("https://issuer.example.com", issuer.getIssuerUrl());
+ assertTrue(issuer.isDynamicJwks());
+ assertEquals("cluster-a", issuer.getClusterName());
+ assertEquals(now, issuer.getRegisteredAt());
+ assertEquals("admin@example.com", issuer.getRegisteredBy());
+ }
+
+ @Test
+ public void testNullableOptionalFields() {
+ TrustedOidcIssuer issuer = new TrustedOidcIssuer(
+ "https://issuer.example.com", false, null, Instant.now(), null);
+
+ assertNull("clusterName should be nullable", issuer.getClusterName());
+ assertNull("registeredBy should be nullable", issuer.getRegisteredBy());
+ assertFalse(issuer.isDynamicJwks());
+ }
+
+ @Test
+ public void testAllFieldsAreFinal() {
+ for (Field field : TrustedOidcIssuer.class.getDeclaredFields()) {
+ assertTrue("Field '" + field.getName() + "' must be final for immutability",
+ Modifier.isFinal(field.getModifiers()));
+ }
+ }
+
+ @Test
+ public void testNoSetterMethods() {
+ for (Method method : TrustedOidcIssuer.class.getDeclaredMethods()) {
+ assertFalse("Setter found in immutable POJO: " + method.getName(),
+ method.getName().startsWith("set"));
+ }
+ }
+}
diff --git a/gateway-server/src/test/java/org/apache/knox/gateway/services/knoxidf/trustedoidcissuer/TrustedOidcIssuersSchemaTest.java b/gateway-server/src/test/java/org/apache/knox/gateway/services/knoxidf/trustedoidcissuer/TrustedOidcIssuersSchemaTest.java
new file mode 100644
index 0000000000..8645017cc5
--- /dev/null
+++ b/gateway-server/src/test/java/org/apache/knox/gateway/services/knoxidf/trustedoidcissuer/TrustedOidcIssuersSchemaTest.java
@@ -0,0 +1,123 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with this
+ * work for additional information regarding copyright ownership. The ASF
+ * licenses this file to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+ * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+ * License for the specific language governing permissions and limitations under
+ * the License.
+ */
+package org.apache.knox.gateway.services.knoxidf.trustedoidcissuer;
+
+import org.apache.commons.io.IOUtils;
+import org.apache.knox.gateway.database.AbstractDataSourceFactory;
+import org.junit.AfterClass;
+import org.junit.BeforeClass;
+import org.junit.Test;
+
+import java.io.IOException;
+import java.io.InputStream;
+import java.nio.charset.StandardCharsets;
+import java.sql.Connection;
+import java.sql.DriverManager;
+import java.sql.ResultSet;
+import java.sql.SQLException;
+import java.sql.Statement;
+
+import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertNotNull;
+import static org.junit.Assert.assertTrue;
+
+/**
+ * Validates that the TRUSTED_OIDC_ISSUERS DDL scripts parse and execute
+ * correctly against in-memory databases.
+ */
+public class TrustedOidcIssuersSchemaTest {
+
+ private static final String DERBY_DB = "trustedissuers";
+ private static final String DERBY_URL = "jdbc:derby:memory:" + DERBY_DB + ";create=true";
+ private static final String DERBY_SHUTDOWN_URL = "jdbc:derby:memory:" + DERBY_DB + ";shutdown=true";
+ private static final String HSQL_URL = "jdbc:hsqldb:mem:trustedissuersschema;ifexists=false";
+ private static final String HSQL_USER = "SA";
+ private static final String HSQL_PASSWORD = "";
+
+ private static Connection derbyConn;
+ private static Connection hsqlConn;
+
+ @BeforeClass
+ public static void setUp() throws SQLException {
+ // Derby 10.14 does not recognize locales like en_001; force a standard locale.
+ java.util.Locale.setDefault(java.util.Locale.US);
+ derbyConn = DriverManager.getConnection(DERBY_URL);
+ hsqlConn = DriverManager.getConnection(HSQL_URL, HSQL_USER, HSQL_PASSWORD);
+ }
+
+ @AfterClass
+ public static void tearDown() throws Exception {
+ // HSQLDB: follow JDBCTokenStateServiceTest pattern — new connection for SHUTDOWN
+ try (Connection conn = DriverManager.getConnection(HSQL_URL, HSQL_USER, HSQL_PASSWORD);
+ Statement stmt = conn.createStatement()) {
+ stmt.execute("SHUTDOWN");
+ }
+
+ // Derby: close the shared connection before issuing shutdown
+ if (derbyConn != null && !derbyConn.isClosed()) {
+ derbyConn.close();
+ }
+ try {
+ DriverManager.getConnection(DERBY_SHUTDOWN_URL);
+ } catch (SQLException e) {
+ // Derby signals a successful single-DB shutdown as error code 45000, state "08006"
+ if (!(e.getErrorCode() == 45000 && "08006".equals(e.getSQLState()))) {
+ throw e;
+ }
+ }
+ }
+
+ /**
+ * The Derby-dialect DDL must execute without error in a Derby in-memory
+ * database and leave the table queryable.
+ */
+ @Test
+ public void testDerbyDdlCreatesTable() throws Exception {
+ try (Statement stmt = derbyConn.createStatement()) {
+ stmt.execute(loadSql(AbstractDataSourceFactory.DERBY_KNOXIDF_TRUSTED_OIDC_ISSUERS_TABLE_SQL));
+ try (ResultSet rs = stmt.executeQuery("SELECT COUNT(*) FROM TRUSTED_OIDC_ISSUERS")) {
+ assertTrue(rs.next());
+ assertEquals(0, rs.getInt(1));
+ }
+ }
+ }
+
+ /**
+ * The standard SQL script uses IF NOT EXISTS. Running the script twice must
+ * not throw, confirming idempotency.
+ */
+ @Test
+ public void testStandardSqlIdempotent() throws Exception {
+ String sql = loadSql(AbstractDataSourceFactory.KNOXIDF_TRUSTED_OIDC_ISSUERS_TABLE_SQL);
+ try (Statement stmt = hsqlConn.createStatement()) {
+ stmt.execute(sql);
+ // Second execution must succeed due to IF NOT EXISTS
+ stmt.execute(sql);
+ try (ResultSet rs = stmt.executeQuery("SELECT COUNT(*) FROM TRUSTED_OIDC_ISSUERS")) {
+ assertTrue(rs.next());
+ assertEquals(0, rs.getInt(1));
+ }
+ }
+ }
+
+ private static String loadSql(String fileName) throws IOException {
+ try (InputStream is = TrustedOidcIssuersSchemaTest.class.getClassLoader().getResourceAsStream(fileName)) {
+ assertNotNull("SQL file not found on classpath: " + fileName, is);
+ return IOUtils.toString(is, StandardCharsets.UTF_8);
+ }
+ }
+}
diff --git a/gateway-server/src/test/java/org/apache/knox/gateway/services/ldap/KnoxLDAPServerManagerTest.java b/gateway-server/src/test/java/org/apache/knox/gateway/services/ldap/KnoxLDAPServerManagerTest.java
index 327d701c30..a5e7df664d 100644
--- a/gateway-server/src/test/java/org/apache/knox/gateway/services/ldap/KnoxLDAPServerManagerTest.java
+++ b/gateway-server/src/test/java/org/apache/knox/gateway/services/ldap/KnoxLDAPServerManagerTest.java
@@ -465,6 +465,27 @@ public void testGetUserGroupsIgnoresBareRdnWhenRolesLookupInactive() throws Exce
List.of("analysts"), groups);
}
+ @Test
+ public void testStartSetsMaxSizeAndTime() throws Exception {
+ final int expectedMaxSize = 3158;
+ final int expectedMaxTime = 245000;
+
+ GatewayConfig mockConfig = EasyMock.createNiceMock(GatewayConfig.class);
+ expect(mockConfig.getGatewayDataDir()).andReturn(tempWorkDir.getParent()).anyTimes();
+ expect(mockConfig.getLDAPPort()).andReturn(port).anyTimes();
+ expect(mockConfig.getLDAPBaseDN()).andReturn("dc=test,dc=com").anyTimes();
+ expect(mockConfig.getLDAPInterceptorNames()).andReturn(List.of()).anyTimes();
+ expect(mockConfig.getLDAPMaxSizeLimit()).andReturn(expectedMaxSize).anyTimes();
+ expect(mockConfig.getLDAPMaxTimeLimit()).andReturn(expectedMaxTime).anyTimes();
+ replay(mockConfig);
+
+ serverManager.initialize(mockConfig);
+ serverManager.start();
+
+ assertEquals(expectedMaxSize, serverManager.ldapServer.getMaxSizeLimit());
+ assertEquals(expectedMaxTime, serverManager.ldapServer.getMaxTimeLimit());
+ }
+
@Test(expected = LdapException.class)
public void testBindRequiredRejectsAnonymous() throws Exception {
useBindPassword(BIND_PASSWORD);
diff --git a/gateway-server/src/test/java/org/apache/knox/gateway/services/ldap/KnoxLDAPServiceTest.java b/gateway-server/src/test/java/org/apache/knox/gateway/services/ldap/KnoxLDAPServiceTest.java
index ce681a5617..f32c036f84 100644
--- a/gateway-server/src/test/java/org/apache/knox/gateway/services/ldap/KnoxLDAPServiceTest.java
+++ b/gateway-server/src/test/java/org/apache/knox/gateway/services/ldap/KnoxLDAPServiceTest.java
@@ -180,6 +180,8 @@ private void setupMockConfig(String backendType) throws Exception {
expect(mockConfig.getLDAPBindUser()).andReturn(null).anyTimes();
expect(mockConfig.getLDAPInterceptorNames()).andReturn(List.of("testbackend")).atLeastOnce();
expect(mockConfig.getLDAPInterceptorConfig("testbackend")).andReturn(buildBackendConfig(backendType)).atLeastOnce();
+ expect(mockConfig.getLDAPMaxSizeLimit()).andReturn(1000).atLeastOnce();
+ expect(mockConfig.getLDAPMaxTimeLimit()).andReturn(60000).atLeastOnce();
replay(mockConfig);
}
diff --git a/gateway-server/src/test/java/org/apache/knox/gateway/services/ldap/backend/LdapProxyBackendSslTest.java b/gateway-server/src/test/java/org/apache/knox/gateway/services/ldap/backend/LdapProxyBackendSslTest.java
index 96b8e5a8f3..3ae14d812f 100644
--- a/gateway-server/src/test/java/org/apache/knox/gateway/services/ldap/backend/LdapProxyBackendSslTest.java
+++ b/gateway-server/src/test/java/org/apache/knox/gateway/services/ldap/backend/LdapProxyBackendSslTest.java
@@ -158,7 +158,8 @@ public void testGetUserOverLdaps() throws Exception {
assertEquals("ldaptest1", entry.get("uid").getString());
validateMemberOf(entry, Set.of(
"cn=group1,ou=groups,dc=hadoop,dc=apache,dc=org",
- "cn=group2,ou=groups,dc=hadoop,dc=apache,dc=org"));
+ "cn=group2,ou=groups,dc=hadoop,dc=apache,dc=org",
+ "cn=group3,ou=groups,dc=hadoop,dc=apache,dc=org"));
}
@Test
@@ -168,6 +169,7 @@ public void testGetUserGroupsOverLdaps() throws Exception {
List groups = ldapProxyBackend.getUserGroups("ldaptest1", schemaManager);
assertTrue(groups.contains("group1"));
assertTrue(groups.contains("group2"));
+ assertTrue(groups.contains("group3"));
}
@Test
diff --git a/gateway-server/src/test/java/org/apache/knox/gateway/services/ldap/backend/LdapProxyBackendTest.java b/gateway-server/src/test/java/org/apache/knox/gateway/services/ldap/backend/LdapProxyBackendTest.java
index 58432f1374..7264527db8 100644
--- a/gateway-server/src/test/java/org/apache/knox/gateway/services/ldap/backend/LdapProxyBackendTest.java
+++ b/gateway-server/src/test/java/org/apache/knox/gateway/services/ldap/backend/LdapProxyBackendTest.java
@@ -25,6 +25,7 @@
import org.apache.directory.api.ldap.model.entry.Entry;
import org.apache.directory.api.ldap.model.entry.Value;
+import org.apache.directory.api.ldap.model.message.SearchRequest;
import org.apache.directory.api.ldap.model.message.SearchScope;
import org.apache.directory.api.ldap.model.name.Dn;
import org.apache.directory.api.ldap.model.schema.SchemaManager;
@@ -37,6 +38,8 @@
import org.apache.directory.server.core.factory.PartitionFactory;
import org.apache.directory.server.core.partition.ldif.LdifPartition;
import org.apache.directory.server.ldap.LdapServer;
+import org.apache.directory.server.ldap.LdapSession;
+import org.apache.directory.server.ldap.handlers.LdapRequestHandler;
import org.apache.directory.server.protocol.shared.store.LdifFileLoader;
import org.apache.directory.server.protocol.shared.transport.TcpTransport;
import org.apache.knox.gateway.security.ldap.SimpleDirectoryService;
@@ -47,6 +50,8 @@
import org.junit.Test;
import java.io.File;
+import java.util.ArrayList;
+import java.util.Collections;
import java.util.HashMap;
import java.util.HashSet;
import java.util.List;
@@ -57,12 +62,15 @@
import java.util.concurrent.atomic.AtomicInteger;
public class LdapProxyBackendTest {
+ private static final int PAGE_SIZE = 2;
+
private static Map ldapBackendConfig;
private static TcpTransport transport;
private static DirectoryService directoryService;
private static LdapServer ldapServer;
private static SchemaManager schemaManager;
+ private static CapturingSearchRequestHandler capturingSearchRequestHandler;
private LdapProxyBackend ldapProxyBackend;
@@ -110,10 +118,19 @@ public static void setupBeforeClass() throws Exception {
// Create and start the LDAP server
ldapServer = new LdapServer();
+
ldapServer.setTransports(transport);
ldapServer.setDirectoryService(directoryService);
+
ldapServer.start();
+ capturingSearchRequestHandler = new CapturingSearchRequestHandler(ldapServer.getSearchRequestHandler());
+ ldapServer.setSearchHandlers(
+ capturingSearchRequestHandler,
+ ldapServer.getSearchResultEntryHandler(),
+ ldapServer.getSearchResultReferenceHandler(),
+ ldapServer.getSearchResultDoneHandler());
+
// Setup common backend config values for tests
ldapBackendConfig = Map.of(
"baseDn", "dc=hadoop,dc=apache,dc=org",
@@ -143,6 +160,7 @@ public static void tearDownAfterClass() throws Exception {
@After
public void tearDown() throws Exception {
+ capturingSearchRequestHandler.reset();
if (ldapProxyBackend != null) {
ldapProxyBackend.close();
}
@@ -157,7 +175,8 @@ public void testGetUserByDefaultUserSearchFilter() throws Exception {
validateUserEntry(entry, "ldaptest1", "TestCn1", "ldaptest1@example.com", "Test user ldaptest1");
validateMemberOf(entry, Set.of(
"cn=group1,ou=groups,dc=hadoop,dc=apache,dc=org",
- "cn=group2,ou=groups,dc=hadoop,dc=apache,dc=org"));
+ "cn=group2,ou=groups,dc=hadoop,dc=apache,dc=org",
+ "cn=group3,ou=groups,dc=hadoop,dc=apache,dc=org"));
}
@Test
@@ -177,7 +196,8 @@ public void testGetUserByUID() throws Exception {
validateUserEntry(entry, "ldaptest1", "TestCn1", "ldaptest1@example.com", "Test user ldaptest1");
validateMemberOf(entry, Set.of(
"cn=group1,ou=groups,dc=hadoop,dc=apache,dc=org",
- "cn=group2,ou=groups,dc=hadoop,dc=apache,dc=org"));
+ "cn=group2,ou=groups,dc=hadoop,dc=apache,dc=org",
+ "cn=group3,ou=groups,dc=hadoop,dc=apache,dc=org"));
}
@Test
@@ -189,7 +209,8 @@ public void testGetUserByCN() throws Exception {
validateUserEntry(entry, "ldaptest1", "TestCn1", "ldaptest1@example.com", "Test user ldaptest1");
validateMemberOf(entry, Set.of(
"cn=group1,ou=groups,dc=hadoop,dc=apache,dc=org",
- "cn=group2,ou=groups,dc=hadoop,dc=apache,dc=org"));
+ "cn=group2,ou=groups,dc=hadoop,dc=apache,dc=org",
+ "cn=group3,ou=groups,dc=hadoop,dc=apache,dc=org"));
}
@Test
@@ -211,7 +232,8 @@ public void testGetUserBySAMAccountName() throws Exception {
assertEquals("TestSam1", entry.get("sAMAccountName").getString());
validateMemberOf(entry, Set.of(
"cn=group1,ou=groups,dc=hadoop,dc=apache,dc=org",
- "cn=group2,ou=groups,dc=hadoop,dc=apache,dc=org"));
+ "cn=group2,ou=groups,dc=hadoop,dc=apache,dc=org",
+ "cn=group3,ou=groups,dc=hadoop,dc=apache,dc=org"));
}
@Test
@@ -230,8 +252,8 @@ public void testGetUserUseMemberOf() throws Exception {
config.put("useMemberOf", "true");
ldapProxyBackend = new LdapProxyBackend("testbackend", config);
- Entry entry = ldapProxyBackend.getUser("ldaptest2", schemaManager);
- validateUserEntry(entry, "ldaptest2", "TestCn2", "ldaptest2@example.com", "Test user ldaptest2");
+ Entry entry = ldapProxyBackend.getUser("ldapmemberof", schemaManager);
+ validateUserEntry(entry, "ldapmemberof", "TestMemberOf", "ldapmemberof@example.com", "Test user ldapmemberof");
validateMemberOf(entry, Set.of(
"cn=groupMemberOf1,ou=groups,dc=hadoop,dc=apache,dc=org",
"cn=groupMemberOf2,ou=groups,dc=hadoop,dc=apache,dc=org"));
@@ -244,6 +266,38 @@ public void testGetUserGroups() throws Exception {
List userGroups = ldapProxyBackend.getUserGroups("ldaptest1", schemaManager);
assertTrue(userGroups.contains("group1"));
assertTrue(userGroups.contains("group2"));
+ assertTrue(userGroups.contains("group3"));
+ }
+
+ @Test
+ public void testGetUserGroupsPaging() throws Exception {
+ Map config = new HashMap<>(ldapBackendConfig);
+ config.put("pageSize", Integer.toString(PAGE_SIZE));
+ ldapProxyBackend = new LdapProxyBackend("testbackend", config);
+
+ List userGroups = ldapProxyBackend.getUserGroups("ldaptest1", schemaManager);
+ assertEquals(3, userGroups.size());
+ int matchingRequests = (int) capturingSearchRequestHandler.getRequests().stream()
+ .filter(request -> request.getBase().getName().equals("ou=groups,dc=hadoop,dc=apache,dc=org") &&
+ request.getFilter().toString().contains("ldaptest1"))
+ .count();
+ assertEquals(2, matchingRequests);
+ }
+
+ @Test
+ public void testGetUserGroupsPagingExceedsMaxResultSetSize() throws Exception {
+ Map config = new HashMap<>(ldapBackendConfig);
+ config.put("pageSize", Integer.toString(PAGE_SIZE));
+ config.put("maxResultSetSize", "1");
+ ldapProxyBackend = new LdapProxyBackend("testbackend", config);
+
+ List userGroups = ldapProxyBackend.getUserGroups("ldaptest1", schemaManager);
+ assertEquals(PAGE_SIZE, userGroups.size()); // only retrieve 1 page because that will exceed the maxResultSetSize
+ int matchingRequests = (int) capturingSearchRequestHandler.getRequests().stream()
+ .filter(request -> request.getBase().getName().equals("ou=groups,dc=hadoop,dc=apache,dc=org") &&
+ request.getFilter().toString().contains("ldaptest1"))
+ .count();
+ assertEquals(1, matchingRequests);
}
@Test
@@ -268,7 +322,7 @@ public void testGetUserGroupsUseMemberOf() throws Exception {
config.put("useMemberOf", "true");
ldapProxyBackend = new LdapProxyBackend("testbackend", config);
- List userGroups = ldapProxyBackend.getUserGroups("ldaptest2", schemaManager);
+ List userGroups = ldapProxyBackend.getUserGroups("ldapmemberof", schemaManager);
assertTrue(userGroups.contains("groupMemberOf1"));
assertTrue(userGroups.contains("groupMemberOf2"));
}
@@ -323,13 +377,42 @@ public void testGetUserGroupsUseMemberOfRecursiveDepth2() throws Exception {
@Test
public void testSearchUsers() throws Exception {
ldapProxyBackend = new LdapProxyBackend("testbackend", ldapBackendConfig);
- validateUserSearch("*", 3, Set.of("ldaptest1", "ldaptest2", "guest"));
+ validateUserSearch("*", 4, Set.of("ldaptest1", "ldaptest2", "ldapmemberof", "guest"));
+ }
+
+ @Test
+ public void testSearchUsersWithPaging() throws Exception {
+ Map config = new HashMap<>(ldapBackendConfig);
+ config.put("pageSize", Integer.toString(PAGE_SIZE));
+ ldapProxyBackend = new LdapProxyBackend("testbackend", config);
+ validateUserSearch("*", 4, Set.of("ldaptest1", "ldaptest2", "ldapmemberof", "guest"));
+ int matchingRequests = (int) capturingSearchRequestHandler.getRequests().stream()
+ .filter(request -> request.getBase().getName().equals("ou=people,dc=hadoop,dc=apache,dc=org") &&
+ request.getFilter().toString().contains("uid=*"))
+ .count();
+ assertEquals(2, matchingRequests);
+ }
+
+ @Test
+ public void testSearchUsersWithPagingExceedsMaxResultSetSize() throws Exception {
+ Map config = new HashMap<>(ldapBackendConfig);
+ config.put("pageSize", Integer.toString(PAGE_SIZE));
+ config.put("maxResultSetSize", "1");
+ ldapProxyBackend = new LdapProxyBackend("testbackend", config);
+
+ List entries = ldapProxyBackend.searchUsers("*", schemaManager);
+ assertEquals(PAGE_SIZE, entries.size()); // only expect 1 page of results
+ int matchingRequests = (int) capturingSearchRequestHandler.getRequests().stream()
+ .filter(request -> request.getBase().getName().equals("ou=people,dc=hadoop,dc=apache,dc=org") &&
+ request.getFilter().toString().contains("uid=*"))
+ .count();
+ assertEquals(1, matchingRequests);
}
@Test
public void testSearchUsersPartial() throws Exception {
ldapProxyBackend = new LdapProxyBackend("testbackend", ldapBackendConfig);
- validateUserSearch("ldap*", 2, Set.of("ldaptest1", "ldaptest2"));
+ validateUserSearch("ldap*", 3, Set.of("ldaptest1", "ldaptest2", "ldapmemberof"));
}
@Test
@@ -343,7 +426,7 @@ public void testSearchUsersNoneFound() throws Exception {
public void testSearchUsersByCn() throws Exception {
Map config = createConfigWithUserAttr("cn");
ldapProxyBackend = new LdapProxyBackend("testbackend", config);
- validateUserSearch("*", 4, Set.of("ldaptest1", "ldaptest2", "Guest", "TestCn3"));
+ validateUserSearch("*", 5, Set.of("ldaptest1", "ldaptest2", "ldapmemberof", "Guest", "TestCn3"));
}
@Test
@@ -365,7 +448,7 @@ public void testSearchUsersNoneFoundByCn() throws Exception {
public void testSearchUsersBySAMAccountName() throws Exception {
Map config = createConfigWithUserAttr("sAMAccountName");
ldapProxyBackend = new LdapProxyBackend("testbackend", config);
- validateUserSearch("*", 3, Set.of("ldaptest1", "ldaptest2", "TestSam3"));
+ validateUserSearch("*", 4, Set.of("ldaptest1", "ldaptest2", "ldapmemberof", "TestSam3"));
}
@Test
@@ -451,7 +534,7 @@ public void testSearchRecursiveWithSharedGroups() throws Exception {
@Test
public void testSearchObjectClassInetOrgPerson() throws Exception {
ldapProxyBackend = new LdapProxyBackend("testbackend", ldapBackendConfig);
- validateSearch("ou=people,dc=hadoop,dc=apache,dc=org", "(objectClass=inetOrgPerson)", 4, Set.of("ldaptest1", "ldaptest2", "guest", "TestCn3"));
+ validateSearch("ou=people,dc=hadoop,dc=apache,dc=org", "(objectClass=inetOrgPerson)", 5, Set.of("ldaptest1", "ldaptest2", "ldapmemberof", "guest", "TestCn3"));
}
@Test
@@ -463,19 +546,47 @@ public void testSearchByUid() throws Exception {
@Test
public void testSearchByUidWildcard() throws Exception {
ldapProxyBackend = new LdapProxyBackend("testbackend", ldapBackendConfig);
- validateSearch("ou=people,dc=hadoop,dc=apache,dc=org", "(uid=*)", 3, Set.of("ldaptest1", "ldaptest2", "guest"));
+ validateSearch("ou=people,dc=hadoop,dc=apache,dc=org", "(uid=*)", 4, Set.of("ldaptest1", "ldaptest2", "ldapmemberof", "guest"));
+ }
+
+ @Test
+ public void testSearchWithPaging() throws Exception {
+ Map config = new HashMap<>(ldapBackendConfig);
+ config.put("pageSize", Integer.toString(PAGE_SIZE));
+ ldapProxyBackend = new LdapProxyBackend("testbackend", config);
+ validateSearch("ou=people,dc=hadoop,dc=apache,dc=org", "(uid=*)", 4, Set.of("ldaptest1", "ldaptest2", "ldapmemberof", "guest"));
+ int matchingRequests = (int) capturingSearchRequestHandler.getRequests().stream()
+ .filter(request -> request.getBase().getName().equals("ou=people,dc=hadoop,dc=apache,dc=org") &&
+ request.getFilter().toString().contains("uid=*"))
+ .count();
+ assertEquals(2, matchingRequests);
+ }
+
+ @Test
+ public void testSearchWithPagingExceedsMaxResultSize() throws Exception {
+ Map config = new HashMap<>(ldapBackendConfig);
+ config.put("pageSize", Integer.toString(PAGE_SIZE));
+ config.put("maxResultSetSize", "1");
+ ldapProxyBackend = new LdapProxyBackend("testbackend", config);
+ List entries = ldapProxyBackend.search("ou=people,dc=hadoop,dc=apache,dc=org", SearchScope.SUBTREE, "(uid=*)", schemaManager);
+ assertEquals(PAGE_SIZE, entries.size()); // only expect 1 page because that will exceed the maxResultSetSize
+ int matchingRequests = (int) capturingSearchRequestHandler.getRequests().stream()
+ .filter(request -> request.getBase().getName().equals("ou=people,dc=hadoop,dc=apache,dc=org") &&
+ request.getFilter().toString().contains("uid=*"))
+ .count();
+ assertEquals(1, matchingRequests);
}
@Test
public void testSearchByUidSubstringWildcard() throws Exception {
ldapProxyBackend = new LdapProxyBackend("testbackend", ldapBackendConfig);
- validateSearch("ou=people,dc=hadoop,dc=apache,dc=org", "(uid=ldap*)", 2, Set.of("ldaptest1", "ldaptest2"));
+ validateSearch("ou=people,dc=hadoop,dc=apache,dc=org", "(uid=ldap*)", 3, Set.of("ldaptest1", "ldaptest2", "ldapmemberof"));
}
@Test
public void testSearchObjectClassGroupOfNames() throws Exception {
ldapProxyBackend = new LdapProxyBackend("testbackend", ldapBackendConfig);
- validateSearch("ou=groups,dc=hadoop,dc=apache,dc=org", "(objectClass=groupOfNames)", 3, Set.of("group1", "group2", "nameddifferently"));
+ validateSearch("ou=groups,dc=hadoop,dc=apache,dc=org", "(objectClass=groupOfNames)", 4, Set.of("group1", "group2", "group3", "nameddifferently"));
}
@Test
@@ -487,19 +598,19 @@ public void testSearchByCn() throws Exception {
@Test
public void testSearchByCnWildcard() throws Exception {
ldapProxyBackend = new LdapProxyBackend("testbackend", ldapBackendConfig);
- validateSearch("ou=groups,dc=hadoop,dc=apache,dc=org", "(cn=*)", 3, Set.of("group1", "group2", "nameddifferently"));
+ validateSearch("ou=groups,dc=hadoop,dc=apache,dc=org", "(cn=*)", 4, Set.of("group1", "group2", "group3", "nameddifferently"));
}
@Test
public void testSearchByCnWSubstringildcard() throws Exception {
ldapProxyBackend = new LdapProxyBackend("testbackend", ldapBackendConfig);
- validateSearch("ou=groups,dc=hadoop,dc=apache,dc=org", "(cn=group*)", 2, Set.of("group1", "group2"));
+ validateSearch("ou=groups,dc=hadoop,dc=apache,dc=org", "(cn=group*)", 3, Set.of("group1", "group2", "group3"));
}
@Test
public void testSearchByUidOrCnWildcard() throws Exception {
ldapProxyBackend = new LdapProxyBackend("testbackend", ldapBackendConfig);
- validateSearch("dc=hadoop,dc=apache,dc=org", "(|(uid=ldap*)(cn=group*))", 4, Set.of("ldaptest1", "ldaptest2", "group1", "group2"));
+ validateSearch("dc=hadoop,dc=apache,dc=org", "(|(uid=ldap*)(cn=group*))", 6, Set.of("ldaptest1", "ldaptest2", "ldapmemberof", "group1", "group2", "group3"));
}
@Test
@@ -809,4 +920,27 @@ public Set get(Object key) {
// For the second user, many groups should have been found in the cache.
assertEquals("Expected " + expectedCacheHits + " cache hits for shared groups, but got " + cacheHits.get(), expectedCacheHits, cacheHits.get());
}
+
+ private static class CapturingSearchRequestHandler extends LdapRequestHandler {
+ private final LdapRequestHandler delegate;
+ private final List requests = Collections.synchronizedList(new ArrayList<>());
+
+ CapturingSearchRequestHandler(LdapRequestHandler delegate) {
+ this.delegate = delegate;
+ }
+
+ public void reset() {
+ requests.clear();
+ }
+
+ public List getRequests() {
+ return List.copyOf(requests);
+ }
+
+ @Override
+ public void handle(LdapSession session, SearchRequest message) throws Exception {
+ requests.add(message);
+ delegate.handle(session, message);
+ }
+ }
}
diff --git a/gateway-server/src/test/java/org/apache/knox/gateway/services/token/impl/DefaultTokenAuthorityServiceTest.java b/gateway-server/src/test/java/org/apache/knox/gateway/services/token/impl/DefaultTokenAuthorityServiceTest.java
index a11db4f103..4682db8f54 100644
--- a/gateway-server/src/test/java/org/apache/knox/gateway/services/token/impl/DefaultTokenAuthorityServiceTest.java
+++ b/gateway-server/src/test/java/org/apache/knox/gateway/services/token/impl/DefaultTokenAuthorityServiceTest.java
@@ -18,15 +18,21 @@
package org.apache.knox.gateway.services.token.impl;
import java.io.File;
+import java.security.KeyPair;
+import java.security.KeyPairGenerator;
+import java.security.KeyStore;
import java.security.Principal;
import java.security.interfaces.RSAPublicKey;
+import java.util.Arrays;
import java.util.Collections;
import java.util.HashMap;
import java.util.Optional;
+import com.nimbusds.jose.crypto.RSASSASigner;
import org.apache.knox.gateway.config.GatewayConfig;
import org.apache.knox.gateway.services.ServiceLifecycleException;
import org.apache.knox.gateway.services.security.AliasService;
+import org.apache.knox.gateway.services.security.KeystoreService;
import org.apache.knox.gateway.services.security.MasterService;
import org.apache.knox.gateway.services.security.impl.DefaultKeystoreService;
import org.apache.knox.gateway.services.security.token.impl.JWT;
@@ -34,6 +40,8 @@
import org.apache.knox.gateway.services.security.token.JWTokenAttributes;
import org.apache.knox.gateway.services.security.token.JWTokenAttributesBuilder;
import org.apache.knox.gateway.services.security.token.TokenServiceException;
+import org.apache.knox.gateway.services.security.token.TokenUtils;
+import org.apache.knox.gateway.util.X509CertificateUtil;
import org.easymock.EasyMock;
import org.junit.Test;
@@ -592,6 +600,62 @@ public void testServiceInvalidKeyPassword() throws Exception {
EasyMock.verify(config, ms, as);
}
+ /**
+ * A token signed by a rotated-out key still verifies as long as that key's alias remains
+ * configured as an additional signing-key alias: verification selects the key by the token's
+ * {@code kid} header. Without that alias configured (single-key), the same token is rejected.
+ */
+ @Test
+ public void testVerifyTokenSelectsKeyByKidAcrossRotation() throws Exception {
+ final KeyPairGenerator kpg = KeyPairGenerator.getInstance("RSA");
+ kpg.initialize(2048);
+ final KeyPair currentPair = kpg.generateKeyPair();
+ final KeyPair rotatedOutPair = kpg.generateKeyPair();
+
+ final KeyStore signingKeystore = KeyStore.getInstance("JKS");
+ signingKeystore.load(null, null);
+ signingKeystore.setCertificateEntry("gateway-identity",
+ X509CertificateUtil.generateCertificate("CN=current", currentPair, 365, "SHA256withRSA"));
+ signingKeystore.setCertificateEntry("old-signing-key",
+ X509CertificateUtil.generateCertificate("CN=old", rotatedOutPair, 365, "SHA256withRSA"));
+
+ final KeystoreService ks = EasyMock.createNiceMock(KeystoreService.class);
+ EasyMock.expect(ks.getSigningKeystore()).andReturn(signingKeystore).anyTimes();
+ final AliasService as = EasyMock.createNiceMock(AliasService.class);
+
+ // A token signed by the rotated-out key, stamped with that key's kid (as issueToken would).
+ final String rotatedOutKid = TokenUtils.getThumbprint((RSAPublicKey) rotatedOutPair.getPublic(), "SHA-256");
+ final JWT token = new JWTToken(new JWTokenAttributesBuilder().setAlgorithm("RS256").setKid(rotatedOutKid)
+ .setAudiences(Collections.emptyList()).build());
+ token.sign(new RSASSASigner(rotatedOutPair.getPrivate(), true));
+
+ // (1) Rotated-out alias still configured -> kid selection picks it -> verifies.
+ final GatewayConfig multiKeyConfig = EasyMock.createNiceMock(GatewayConfig.class);
+ EasyMock.expect(multiKeyConfig.getSigningKeyAlias()).andReturn("gateway-identity").anyTimes();
+ EasyMock.expect(multiKeyConfig.getSigningKeyAliases())
+ .andReturn(Arrays.asList("gateway-identity", "old-signing-key")).anyTimes();
+ EasyMock.replay(ks, as, multiKeyConfig);
+
+ DefaultTokenAuthorityService ta = new DefaultTokenAuthorityService();
+ ta.setKeystoreService(ks);
+ ta.setAliasService(as);
+ ta.init(multiKeyConfig, new HashMap<>());
+ assertTrue("Token signed by a still-configured rotated key must verify", ta.verifyToken(token));
+
+ // (2) Only the current key configured (single-key) -> the rotated key's token is rejected.
+ final GatewayConfig singleKeyConfig = EasyMock.createNiceMock(GatewayConfig.class);
+ EasyMock.expect(singleKeyConfig.getSigningKeyAlias()).andReturn("gateway-identity").anyTimes();
+ EasyMock.expect(singleKeyConfig.getSigningKeyAliases())
+ .andReturn(Collections.singletonList("gateway-identity")).anyTimes();
+ EasyMock.replay(singleKeyConfig);
+
+ ta = new DefaultTokenAuthorityService();
+ ta.setKeystoreService(ks);
+ ta.setAliasService(as);
+ ta.init(singleKeyConfig, new HashMap<>());
+ assertFalse("Without the rotated key configured, its token must not verify", ta.verifyToken(token));
+ }
+
/**
* Test getSigningCertKid() function
* @throws Exception
diff --git a/gateway-server/src/test/java/org/apache/knox/gateway/services/token/impl/DefaultTokenStateServiceTest.java b/gateway-server/src/test/java/org/apache/knox/gateway/services/token/impl/DefaultTokenStateServiceTest.java
index 419d077c67..3cb0b27381 100644
--- a/gateway-server/src/test/java/org/apache/knox/gateway/services/token/impl/DefaultTokenStateServiceTest.java
+++ b/gateway-server/src/test/java/org/apache/knox/gateway/services/token/impl/DefaultTokenStateServiceTest.java
@@ -162,6 +162,42 @@ public void testIsExpired_Revoked() throws Exception {
tss.isExpired(token);
}
+ @Test
+ public void testConsumeToken_SingleUse() throws Exception {
+ // Single-use semantics for auth codes: the first consume wins, a second consume of the same
+ // id loses (the token is already gone), and the token state is actually removed.
+ final JWTToken token = createMockToken(System.currentTimeMillis() + TimeUnit.SECONDS.toMillis(60));
+ final TokenStateService tss = createTokenStateService();
+ final String tokenId = TokenUtils.getTokenId(token);
+
+ addToken(tss, token, System.currentTimeMillis());
+
+ assertTrue("First consume should win.", tss.consumeToken(tokenId));
+ assertFalse("Second consume of the same token must lose.", tss.consumeToken(tokenId));
+ }
+
+ @Test(expected = UnknownTokenException.class)
+ public void testConsumeToken_RemovesState() throws Exception {
+ final JWTToken token = createMockToken(System.currentTimeMillis() + TimeUnit.SECONDS.toMillis(60));
+ final TokenStateService tss = createTokenStateService();
+ final String tokenId = TokenUtils.getTokenId(token);
+
+ addToken(tss, token, System.currentTimeMillis());
+ assertTrue(tss.consumeToken(tokenId));
+
+ // The token must no longer be known after being consumed.
+ tss.getTokenExpiration(tokenId);
+ }
+
+ @Test
+ public void testConsumeToken_UnknownToken() throws Exception {
+ // An id that was never stored cannot be "won" - consume reports false rather than throwing.
+ final JWTToken token = createMockToken(System.currentTimeMillis() + TimeUnit.SECONDS.toMillis(60));
+ final TokenStateService tss = createTokenStateService();
+
+ assertFalse(tss.consumeToken(TokenUtils.getTokenId(token)));
+ }
+
@Test
public void testRenewal() throws Exception {
final JWTToken token = createMockToken(System.currentTimeMillis() - TimeUnit.SECONDS.toMillis(60));
diff --git a/gateway-server/src/test/java/org/apache/knox/gateway/services/topology/DefaultTopologyServiceTest.java b/gateway-server/src/test/java/org/apache/knox/gateway/services/topology/DefaultTopologyServiceTest.java
index bf7cf976c0..e428d1e84f 100644
--- a/gateway-server/src/test/java/org/apache/knox/gateway/services/topology/DefaultTopologyServiceTest.java
+++ b/gateway-server/src/test/java/org/apache/knox/gateway/services/topology/DefaultTopologyServiceTest.java
@@ -595,6 +595,45 @@ public void testConfigurationCRUDAPI() throws Exception {
}
}
+ @Test
+ public void testDeployRejectsPathTraversal() throws Exception {
+ File dir = createDir();
+ File topologyDir = new File(dir, "topologies");
+ topologyDir.mkdirs();
+
+ File descriptorsDir = new File(dir, "descriptors");
+ descriptorsDir.mkdirs();
+
+ File sharedProvidersDir = new File(dir, "shared-providers");
+ sharedProvidersDir.mkdirs();
+
+ try {
+ TopologyService ts = new DefaultTopologyService();
+ Map c = new HashMap<>();
+
+ GatewayConfig config = EasyMock.createNiceMock(GatewayConfig.class);
+ EasyMock.expect(config.getReadOnlyOverrideTopologyNames()).andReturn(Collections.emptyList()).anyTimes();
+ EasyMock.expect(config.getGatewayTopologyDir()).andReturn(topologyDir.getAbsolutePath()).anyTimes();
+ EasyMock.expect(config.getGatewayConfDir()).andReturn(descriptorsDir.getParentFile().getAbsolutePath()).anyTimes();
+ EasyMock.replay(config);
+
+ ts.init(config, c);
+
+ final String traversalName = "../../evil.json";
+ final File escapeTarget = new File(dir.getParentFile(), "evil.json");
+ assertFalse("precondition: escape target must not pre-exist", escapeTarget.exists());
+
+ assertFalse("deployProviderConfiguration must reject a path-traversal name",
+ ts.deployProviderConfiguration(traversalName, "malicious"));
+ assertFalse("deployDescriptor must reject a path-traversal name",
+ ts.deployDescriptor(traversalName, "malicious"));
+
+ assertFalse("no file may be written outside the managed directory", escapeTarget.exists());
+ } finally {
+ FileUtils.deleteQuietly(dir);
+ }
+ }
+
@Test
public void testProviderParamsOrderIsPreserved() {
diff --git a/gateway-server/src/test/java/org/apache/knox/gateway/websockets/GatewayWebsocketHandlerTest.java b/gateway-server/src/test/java/org/apache/knox/gateway/websockets/GatewayWebsocketHandlerTest.java
index 47331b8071..dab6288d9e 100644
--- a/gateway-server/src/test/java/org/apache/knox/gateway/websockets/GatewayWebsocketHandlerTest.java
+++ b/gateway-server/src/test/java/org/apache/knox/gateway/websockets/GatewayWebsocketHandlerTest.java
@@ -27,6 +27,9 @@
import org.apache.knox.gateway.i18n.messages.MessagesFactory;
import org.apache.knox.gateway.provider.federation.jwt.JWTMessages;
import org.apache.knox.gateway.services.GatewayServices;
+import org.apache.knox.gateway.services.ServiceType;
+import org.apache.knox.gateway.services.security.AliasService;
+import org.apache.knox.gateway.services.security.KeystoreService;
import org.apache.knox.gateway.webshell.WebshellWebSocketAdapter;
import org.easymock.EasyMock;
import org.eclipse.jetty.websocket.servlet.ServletUpgradeRequest;
@@ -44,8 +47,10 @@
import org.powermock.core.classloader.annotations.PrepareForTest;
import org.powermock.modules.junit4.PowerMockRunner;
+import java.security.KeyStore;
import java.util.Collections;
import java.util.Enumeration;
+import java.util.HashMap;
import java.util.Locale;
import java.util.Map;
import java.util.concurrent.ExecutorService;
@@ -168,6 +173,100 @@ public void testDisabledWebShell() throws Exception{
gatewayWebsocketHandler.createWebSocket(req,resp);
}
+ @Test
+ public void testConfigureClientIdentityTwoWaySslGatewayIdentity() throws Exception {
+ GatewayConfig gatewayConfig = EasyMock.createNiceMock(GatewayConfig.class);
+ EasyMock.expect(gatewayConfig.isHttpClientTwoWaySslEnabled()).andReturn(true).anyTimes();
+ EasyMock.expect(gatewayConfig.isSingleEkuEnabled()).andReturn(false).anyTimes();
+
+ KeyStore identity = KeyStore.getInstance(KeyStore.getDefaultType());
+ identity.load(null, null);
+ char[] passphrase = "gateway-secret".toCharArray();
+
+ KeystoreService keystoreService = EasyMock.createNiceMock(KeystoreService.class);
+ EasyMock.expect(keystoreService.getKeystoreForGateway()).andReturn(identity).anyTimes();
+ AliasService aliasService = EasyMock.createNiceMock(AliasService.class);
+ EasyMock.expect(aliasService.getGatewayIdentityPassphrase()).andReturn(passphrase).anyTimes();
+
+ GatewayServices services = EasyMock.createNiceMock(GatewayServices.class);
+ EasyMock.expect(services.getService(ServiceType.KEYSTORE_SERVICE)).andReturn(keystoreService).anyTimes();
+ EasyMock.expect(services.getService(ServiceType.ALIAS_SERVICE)).andReturn(aliasService).anyTimes();
+ EasyMock.replay(gatewayConfig, keystoreService, aliasService, services);
+
+ GatewayWebsocketHandler handler = new GatewayWebsocketHandler(gatewayConfig, services);
+ Map props = new HashMap<>();
+ handler.configureClientIdentity(props);
+
+ Assert.assertSame(identity, props.get(GatewayWebsocketHandler.KEYSTORE_USER_PROPERTY));
+ Assert.assertSame(passphrase, props.get(GatewayWebsocketHandler.KEYSTORE_KEY_PASSPHRASE_USER_PROPERTY));
+ }
+
+ @Test
+ public void testConfigureClientIdentityTwoWaySslSingleEku() throws Exception {
+ GatewayConfig gatewayConfig = EasyMock.createNiceMock(GatewayConfig.class);
+ EasyMock.expect(gatewayConfig.isHttpClientTwoWaySslEnabled()).andReturn(true).anyTimes();
+ EasyMock.expect(gatewayConfig.isSingleEkuEnabled()).andReturn(true).anyTimes();
+
+ KeyStore clientIdentity = KeyStore.getInstance(KeyStore.getDefaultType());
+ clientIdentity.load(null, null);
+ char[] passphrase = "client-secret".toCharArray();
+
+ KeystoreService keystoreService = EasyMock.createNiceMock(KeystoreService.class);
+ EasyMock.expect(keystoreService.getKeystoreForHttpClient()).andReturn(clientIdentity).anyTimes();
+ AliasService aliasService = EasyMock.createNiceMock(AliasService.class);
+ EasyMock.expect(aliasService.getHttpClientKeyPassphrase()).andReturn(passphrase).anyTimes();
+
+ GatewayServices services = EasyMock.createNiceMock(GatewayServices.class);
+ EasyMock.expect(services.getService(ServiceType.KEYSTORE_SERVICE)).andReturn(keystoreService).anyTimes();
+ EasyMock.expect(services.getService(ServiceType.ALIAS_SERVICE)).andReturn(aliasService).anyTimes();
+ EasyMock.replay(gatewayConfig, keystoreService, aliasService, services);
+
+ GatewayWebsocketHandler handler = new GatewayWebsocketHandler(gatewayConfig, services);
+ Map props = new HashMap<>();
+ handler.configureClientIdentity(props);
+
+ Assert.assertSame(clientIdentity, props.get(GatewayWebsocketHandler.KEYSTORE_USER_PROPERTY));
+ Assert.assertSame(passphrase, props.get(GatewayWebsocketHandler.KEYSTORE_KEY_PASSPHRASE_USER_PROPERTY));
+ }
+
+ @Test
+ public void testConfigureClientIdentityDisabledWhenNotTwoWaySsl() throws Exception {
+ GatewayConfig gatewayConfig = EasyMock.createNiceMock(GatewayConfig.class);
+ EasyMock.expect(gatewayConfig.isHttpClientTwoWaySslEnabled()).andReturn(false).anyTimes();
+ GatewayServices services = EasyMock.createNiceMock(GatewayServices.class);
+ EasyMock.replay(gatewayConfig, services);
+
+ GatewayWebsocketHandler handler = new GatewayWebsocketHandler(gatewayConfig, services);
+ Map props = new HashMap<>();
+ handler.configureClientIdentity(props);
+
+ Assert.assertFalse(props.containsKey(GatewayWebsocketHandler.KEYSTORE_USER_PROPERTY));
+ Assert.assertFalse(props.containsKey(GatewayWebsocketHandler.KEYSTORE_KEY_PASSPHRASE_USER_PROPERTY));
+ }
+
+ @Test
+ public void testConfigureClientIdentityTwoWaySslNullKeystoreContributesNothing() throws Exception {
+ GatewayConfig gatewayConfig = EasyMock.createNiceMock(GatewayConfig.class);
+ EasyMock.expect(gatewayConfig.isHttpClientTwoWaySslEnabled()).andReturn(true).anyTimes();
+ EasyMock.expect(gatewayConfig.isSingleEkuEnabled()).andReturn(false).anyTimes();
+
+ KeystoreService keystoreService = EasyMock.createNiceMock(KeystoreService.class);
+ EasyMock.expect(keystoreService.getKeystoreForGateway()).andReturn(null).anyTimes();
+ AliasService aliasService = EasyMock.createNiceMock(AliasService.class);
+
+ GatewayServices services = EasyMock.createNiceMock(GatewayServices.class);
+ EasyMock.expect(services.getService(ServiceType.KEYSTORE_SERVICE)).andReturn(keystoreService).anyTimes();
+ EasyMock.expect(services.getService(ServiceType.ALIAS_SERVICE)).andReturn(aliasService).anyTimes();
+ EasyMock.replay(gatewayConfig, keystoreService, aliasService, services);
+
+ GatewayWebsocketHandler handler = new GatewayWebsocketHandler(gatewayConfig, services);
+ Map props = new HashMap<>();
+ handler.configureClientIdentity(props);
+
+ Assert.assertFalse(props.containsKey(GatewayWebsocketHandler.KEYSTORE_USER_PROPERTY));
+ Assert.assertFalse(props.containsKey(GatewayWebsocketHandler.KEYSTORE_KEY_PASSPHRASE_USER_PROPERTY));
+ }
+
private ServletUpgradeRequest createServletUpgradeRequest(String url) throws Exception {
HttpServletRequest mockRequest = new org.apache.knox.test.mock.MockHttpServletRequest() {
@Override
diff --git a/gateway-server/src/test/java/org/apache/knox/gateway/websockets/ProxyWebSocketAdapterTest.java b/gateway-server/src/test/java/org/apache/knox/gateway/websockets/ProxyWebSocketAdapterTest.java
new file mode 100644
index 0000000000..7fb659fd3c
--- /dev/null
+++ b/gateway-server/src/test/java/org/apache/knox/gateway/websockets/ProxyWebSocketAdapterTest.java
@@ -0,0 +1,78 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.knox.gateway.websockets;
+
+import org.eclipse.jetty.util.ssl.SslContextFactory;
+import org.junit.Assert;
+import org.junit.Test;
+
+import javax.websocket.ClientEndpointConfig;
+import java.security.KeyStore;
+
+public class ProxyWebSocketAdapterTest {
+
+ private static KeyStore emptyKeyStore() throws Exception {
+ KeyStore keyStore = KeyStore.getInstance(KeyStore.getDefaultType());
+ keyStore.load(null, null);
+ return keyStore;
+ }
+
+ @Test
+ public void testConfigureSslAppliesKeystoreAndTruststore() throws Exception {
+ KeyStore identity = emptyKeyStore();
+ KeyStore truststore = emptyKeyStore();
+ ClientEndpointConfig clientConfig = ClientEndpointConfig.Builder.create().build();
+ clientConfig.getUserProperties().put(GatewayWebsocketHandler.TRUSTSTORE_USER_PROPERTY, truststore);
+ clientConfig.getUserProperties().put(GatewayWebsocketHandler.KEYSTORE_USER_PROPERTY, identity);
+ clientConfig.getUserProperties().put(GatewayWebsocketHandler.KEYSTORE_KEY_PASSPHRASE_USER_PROPERTY, "secret".toCharArray());
+
+ SslContextFactory sslContextFactory = new SslContextFactory.Client();
+ ProxyWebSocketAdapter.configureSsl(sslContextFactory, clientConfig);
+
+ Assert.assertSame(identity, sslContextFactory.getKeyStore());
+ Assert.assertSame(truststore, sslContextFactory.getTrustStore());
+ }
+
+ @Test
+ public void testConfigureSslNoKeystoreWhenAbsent() throws Exception {
+ KeyStore truststore = emptyKeyStore();
+ ClientEndpointConfig clientConfig = ClientEndpointConfig.Builder.create().build();
+ clientConfig.getUserProperties().put(GatewayWebsocketHandler.TRUSTSTORE_USER_PROPERTY, truststore);
+
+ SslContextFactory sslContextFactory = new SslContextFactory.Client();
+ ProxyWebSocketAdapter.configureSsl(sslContextFactory, clientConfig);
+
+ Assert.assertNull(sslContextFactory.getKeyStore());
+ Assert.assertSame(truststore, sslContextFactory.getTrustStore());
+ }
+
+ @Test
+ public void testConfigureSslKeystorePresentNullPassphrase() throws Exception {
+ KeyStore identity = emptyKeyStore();
+ KeyStore truststore = emptyKeyStore();
+ ClientEndpointConfig clientConfig = ClientEndpointConfig.Builder.create().build();
+ clientConfig.getUserProperties().put(GatewayWebsocketHandler.TRUSTSTORE_USER_PROPERTY, truststore);
+ clientConfig.getUserProperties().put(GatewayWebsocketHandler.KEYSTORE_USER_PROPERTY, identity);
+
+ SslContextFactory sslContextFactory = new SslContextFactory.Client();
+ ProxyWebSocketAdapter.configureSsl(sslContextFactory, clientConfig);
+
+ Assert.assertSame(identity, sslContextFactory.getKeyStore());
+ Assert.assertSame(truststore, sslContextFactory.getTrustStore());
+ }
+}
diff --git a/gateway-server/src/test/resources/ldap-proxy-backend-test.ldif b/gateway-server/src/test/resources/ldap-proxy-backend-test.ldif
index 91fb4136c9..456105f986 100644
--- a/gateway-server/src/test/resources/ldap-proxy-backend-test.ldif
+++ b/gateway-server/src/test/resources/ldap-proxy-backend-test.ldif
@@ -58,6 +58,12 @@ objectclass:groupOfNames
cn: group2
member: uid=ldaptest1,ou=people,dc=hadoop,dc=apache,dc=org
+dn: cn=group3,ou=groups,dc=hadoop,dc=apache,dc=org
+objectclass:top
+objectclass:groupOfNames
+cn: group3
+member: uid=ldaptest1,ou=people,dc=hadoop,dc=apache,dc=org
+
dn: cn=nameddifferently,ou=groups,dc=hadoop,dc=apache,dc=org
objectclass:top
objectclass:groupOfNames
@@ -89,6 +95,19 @@ sAMAccountName: TestSam2
userPassword: 12345
mail: ldaptest2@example.com
description: Test user ldaptest2
+
+dn: uid=ldapmemberof,ou=people,dc=hadoop,dc=apache,dc=org
+objectclass:top
+objectclass:person
+objectclass:organizationalPerson
+objectclass:inetOrgPerson
+cn: TestMemberOf
+sn: Ldap
+uid: ldapmemberof
+sAMAccountName: TestMemberOf
+userPassword: 12345
+mail: ldapmemberof@example.com
+description: Test user ldapmemberof
memberOf: cn=groupMemberOf1,ou=groups,dc=hadoop,dc=apache,dc=org
memberOf: cn=groupMemberOf2,ou=groups,dc=hadoop,dc=apache,dc=org
diff --git a/gateway-service-admin/src/main/java/org/apache/knox/gateway/service/admin/TopologiesResource.java b/gateway-service-admin/src/main/java/org/apache/knox/gateway/service/admin/TopologiesResource.java
index 2c66faafd2..98279a5798 100644
--- a/gateway-service-admin/src/main/java/org/apache/knox/gateway/service/admin/TopologiesResource.java
+++ b/gateway-service-admin/src/main/java/org/apache/knox/gateway/service/admin/TopologiesResource.java
@@ -43,6 +43,7 @@
import javax.ws.rs.PathParam;
import javax.ws.rs.Produces;
import javax.ws.rs.QueryParam;
+import javax.ws.rs.WebApplicationException;
import javax.ws.rs.core.Context;
import javax.ws.rs.core.HttpHeaders;
import javax.ws.rs.core.MediaType;
@@ -55,8 +56,6 @@
import java.io.IOException;
import java.net.URI;
import java.net.URISyntaxException;
-import java.net.URLDecoder;
-import java.nio.charset.StandardCharsets;
import java.util.ArrayList;
import java.util.Collection;
import java.util.Comparator;
@@ -90,7 +89,7 @@ public class TopologiesResource {
private static final String SINGLE_DESCRIPTOR_API_PATH = DESCRIPTORS_API_PATH + "/{name}";
private static final int RESOURCE_NAME_LENGTH_MAX = 100;
- private static final Pattern RESOURCE_NAME_PATTERN = Pattern.compile("^[\\w-/.]+$");
+ private static final Pattern RESOURCE_NAME_PATTERN = Pattern.compile("^[\\w.-]+$");
private static GatewaySpiMessages log = MessagesFactory.get(GatewaySpiMessages.class);
@@ -171,12 +170,6 @@ public SimpleTopologyWrapper getTopologies() {
public Topology uploadTopology(@PathParam("id") String id, Topology t) {
Topology result = null;
- try {
- id = URLDecoder.decode(id, StandardCharsets.UTF_8.name());
- } catch (Exception e) {
- // Ignore
- }
-
if (!isValidResourceName(id)) {
log.invalidResourceName(id);
throw new BadRequestException("Invalid topology name: " + id);
@@ -188,6 +181,17 @@ public Topology uploadTopology(@PathParam("id") String id, Topology t) {
t.setName(id);
TopologyService ts = gs.getService(ServiceType.TOPOLOGY_SERVICE);
+ GatewayConfig config =
+ (GatewayConfig) request.getServletContext().getAttribute(GatewayConfig.GATEWAY_CONFIG_ATTRIBUTE);
+ if (config != null &&
+ config.getReadOnlyOverrideTopologyNames().contains(FilenameUtils.getBaseName(id))) {
+ log.disallowedOverwritingReadOnlyTopology(id);
+ throw new WebApplicationException(
+ status(Response.Status.FORBIDDEN)
+ .entity("{ \"error\" : \"Cannot overwrite read-only topology: " + id + "\" }")
+ .build());
+ }
+
// Check for existing topology with the same name, to see if it had been generated
boolean existingGenerated = false;
for (org.apache.knox.gateway.topology.Topology existingTopology : ts.getTopologies()) {
@@ -338,12 +342,6 @@ public Response deleteSimpleDescriptor(@PathParam("name") String name) {
public Response uploadProviderConfiguration(@PathParam("name") String name, @Context HttpHeaders headers, String content) {
Response response = null;
- try {
- name = URLDecoder.decode(name, StandardCharsets.UTF_8.name());
- } catch (Exception e) {
- // Ignore
- }
-
if (!isValidResourceName(name)) {
log.invalidResourceName(name);
throw new BadRequestException("Invalid provider configuration name: " + name);
@@ -393,12 +391,6 @@ public Response uploadSimpleDescriptor(@PathParam("name") String name,
String content) {
Response response = null;
- try {
- name = URLDecoder.decode(name, StandardCharsets.UTF_8.name());
- } catch (Exception e) {
- // Ignore
- }
-
if (!isValidResourceName(name)) {
log.invalidResourceName(name);
throw new BadRequestException("Invalid descriptor name: " + name);
@@ -554,8 +546,9 @@ private File getExistingConfigFile(Collection existing, String candidateNa
return result;
}
- private static boolean isValidResourceName(final String name) {
+ static boolean isValidResourceName(final String name) {
return name != null && name.length() <= RESOURCE_NAME_LENGTH_MAX &&
+ !name.contains("..") &&
RESOURCE_NAME_PATTERN.matcher(name).matches();
}
diff --git a/gateway-service-admin/src/test/java/org/apache/knox/gateway/service/admin/TopologyResourceTest.java b/gateway-service-admin/src/test/java/org/apache/knox/gateway/service/admin/TopologyResourceTest.java
index e49015e1f9..d0e225ed13 100644
--- a/gateway-service-admin/src/test/java/org/apache/knox/gateway/service/admin/TopologyResourceTest.java
+++ b/gateway-service-admin/src/test/java/org/apache/knox/gateway/service/admin/TopologyResourceTest.java
@@ -19,7 +19,18 @@
import org.apache.knox.gateway.topology.Topology;
import org.apache.knox.gateway.config.GatewayConfig;
+import org.apache.knox.gateway.services.GatewayServices;
+import org.apache.knox.gateway.services.ServiceType;
+import org.apache.knox.gateway.services.topology.TopologyService;
+
+import javax.servlet.ServletContext;
import javax.servlet.http.HttpServletRequest;
+import javax.ws.rs.WebApplicationException;
+import javax.ws.rs.core.Response;
+
+import java.lang.reflect.Field;
+import java.util.Collections;
+import java.util.List;
import org.easymock.EasyMock;
import org.junit.Test;
@@ -27,6 +38,9 @@
import static org.hamcrest.MatcherAssert.assertThat;
import static org.hamcrest.CoreMatchers.containsString;
import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertFalse;
+import static org.junit.Assert.assertTrue;
+import static org.junit.Assert.fail;
public class TopologyResourceTest {
@@ -174,6 +188,28 @@ public void testTopologyURLMethods(){
}
+ @Test
+ public void testResourceNameValidation() {
+ assertTrue(TopologiesResource.isValidResourceName("foo"));
+ assertTrue(TopologiesResource.isValidResourceName("foo.json"));
+ assertTrue(TopologiesResource.isValidResourceName("my-provider_1"));
+ assertTrue(TopologiesResource.isValidResourceName("a.b.c"));
+
+ assertFalse(TopologiesResource.isValidResourceName("../../etc/passwd"));
+ assertFalse(TopologiesResource.isValidResourceName(".."));
+ assertFalse(TopologiesResource.isValidResourceName("foo/bar"));
+ assertFalse(TopologiesResource.isValidResourceName("a/../../b"));
+ assertFalse(TopologiesResource.isValidResourceName("foo..bar"));
+
+ assertFalse(TopologiesResource.isValidResourceName("%2f"));
+ assertFalse(TopologiesResource.isValidResourceName("%252f"));
+
+ assertFalse(TopologiesResource.isValidResourceName(null));
+ assertFalse(TopologiesResource.isValidResourceName(""));
+ assertFalse(TopologiesResource.isValidResourceName("a".repeat(101)));
+ assertTrue(TopologiesResource.isValidResourceName("a".repeat(100)));
+ }
+
private void setDefaultExpectations(HttpServletRequest request){
EasyMock.expect( request.getPathInfo() ).andReturn( pathInfo ).anyTimes();
EasyMock.expect( request.getContextPath() ).andReturn( reqContext ).anyTimes();
@@ -186,4 +222,76 @@ private void setMockRequestHeader(HttpServletRequest request, String header, Str
EasyMock.expect( request.getHeader( header ) ).andReturn( expected ).anyTimes();
}
+ @Test
+ public void testUploadTopologyRefusesReadOnlyOverride() throws Exception {
+ TopologyService ts = EasyMock.createMock(TopologyService.class);
+
+ GatewayServices gs = EasyMock.createNiceMock(GatewayServices.class);
+ EasyMock.expect(gs.getService(ServiceType.TOPOLOGY_SERVICE)).andReturn(ts).anyTimes();
+
+ GatewayConfig config = EasyMock.createNiceMock(GatewayConfig.class);
+ EasyMock.expect(config.getReadOnlyOverrideTopologyNames())
+ .andReturn(List.of("manager")).anyTimes();
+
+ HttpServletRequest request = mockRequest(gs, config);
+
+ EasyMock.replay(ts, gs, config, request);
+
+ TopologiesResource res = new TopologiesResource();
+ setRequestField(res, request);
+
+ try {
+ res.uploadTopology("manager", new org.apache.knox.gateway.service.admin.beans.Topology());
+ fail("Expected WebApplicationException for read-only override topology");
+ } catch (WebApplicationException e) {
+ assertEquals(Response.Status.FORBIDDEN.getStatusCode(), e.getResponse().getStatus());
+ }
+
+ EasyMock.verify(ts);
+ }
+
+ @Test
+ public void testUploadTopologyAllowedWhenNotReadOnly() throws Exception {
+ TopologyService ts = EasyMock.createMock(TopologyService.class);
+ EasyMock.expect(ts.getTopologies()).andReturn(Collections.emptyList()).anyTimes();
+ ts.deployTopology(EasyMock.anyObject(Topology.class));
+ EasyMock.expectLastCall().once();
+
+ GatewayServices gs = EasyMock.createNiceMock(GatewayServices.class);
+ EasyMock.expect(gs.getService(ServiceType.TOPOLOGY_SERVICE)).andReturn(ts).anyTimes();
+
+ GatewayConfig config = EasyMock.createNiceMock(GatewayConfig.class);
+ EasyMock.expect(config.getReadOnlyOverrideTopologyNames())
+ .andReturn(Collections.emptyList()).anyTimes();
+
+ HttpServletRequest request = mockRequest(gs, config);
+
+ EasyMock.replay(ts, gs, config, request);
+
+ TopologiesResource res = new TopologiesResource();
+ setRequestField(res, request);
+
+ res.uploadTopology("sandbox", new org.apache.knox.gateway.service.admin.beans.Topology());
+
+ EasyMock.verify(ts);
+ }
+
+ private HttpServletRequest mockRequest(GatewayServices gs, GatewayConfig config) {
+ ServletContext context = EasyMock.createNiceMock(ServletContext.class);
+ EasyMock.expect(context.getAttribute(GatewayServices.GATEWAY_SERVICES_ATTRIBUTE))
+ .andReturn(gs).anyTimes();
+ EasyMock.expect(context.getAttribute(GatewayConfig.GATEWAY_CONFIG_ATTRIBUTE))
+ .andReturn(config).anyTimes();
+ HttpServletRequest request = EasyMock.createNiceMock(HttpServletRequest.class);
+ EasyMock.expect(request.getServletContext()).andReturn(context).anyTimes();
+ EasyMock.replay(context);
+ return request;
+ }
+
+ private void setRequestField(TopologiesResource res, HttpServletRequest request) throws Exception {
+ Field f = TopologiesResource.class.getDeclaredField("request");
+ f.setAccessible(true);
+ f.set(res, request);
+ }
+
}
diff --git a/gateway-service-auth/src/main/java/org/apache/knox/gateway/service/auth/AbstractAuthResource.java b/gateway-service-auth/src/main/java/org/apache/knox/gateway/service/auth/AbstractAuthResource.java
index 8ed3aa660e..358b68b0f3 100644
--- a/gateway-service-auth/src/main/java/org/apache/knox/gateway/service/auth/AbstractAuthResource.java
+++ b/gateway-service-auth/src/main/java/org/apache/knox/gateway/service/auth/AbstractAuthResource.java
@@ -43,6 +43,7 @@
public abstract class AbstractAuthResource {
public static final String AUTH_ACTOR_ID_HEADER_NAME = "preauth.auth.header.actor.id.name";
+ public static final String AUTH_ACTOR_GROUPS_HEADER_NAME = "preauth.auth.header.actor.groups";
public static final String AUTH_ACTOR_GROUPS_HEADER_PREFIX = "preauth.auth.header.actor.groups.prefix";
public static final String GROUP_HEADER_LENGTH_LIMIT = "preauth.auth.header.groups.length.limit";
public static final String GROUP_HEADER_SIZE_LIMIT = "preauth.auth.header.groups.size.limit";
@@ -60,6 +61,7 @@ public abstract class AbstractAuthResource {
private static final String ACTOR_GROUPS_HEADER_FORMAT = "%s-%d";
protected String authHeaderActorIDName;
+ protected String authHeaderActorGroupsName;
protected String authHeaderActorGroupsPrefix;
private int groupHeaderLengthLimit;
private int groupHeaderSizeLimit;
@@ -69,6 +71,7 @@ public abstract class AbstractAuthResource {
protected void initialize() {
authHeaderActorIDName = getInitParameter(AUTH_ACTOR_ID_HEADER_NAME, DEFAULT_AUTH_ACTOR_ID_HEADER_NAME);
+ authHeaderActorGroupsName = getInitParameter(AUTH_ACTOR_GROUPS_HEADER_NAME, null);
authHeaderActorGroupsPrefix = getInitParameter(AUTH_ACTOR_GROUPS_HEADER_PREFIX, DEFAULT_AUTH_ACTOR_GROUPS_HEADER_PREFIX);
groupHeaderLengthLimit = Integer.parseInt(getInitParameter(GROUP_HEADER_LENGTH_LIMIT, DEFAULT_GROUP_HEADER_LENGTH_LIMIT));
groupHeaderSizeLimit = Integer.parseInt(getInitParameter(GROUP_HEADER_SIZE_LIMIT, DEFAULT_GROUP_HEADER_SIZE_LIMIT));
@@ -114,13 +117,23 @@ public Response doGetImpl() {
final boolean useRoles = !roles.isEmpty();
final List groupStrings = GroupUtils.getGroupStrings(useRoles ? roles : matchingGroupNames, groupHeaderLengthLimit, groupHeaderSizeLimit);
for (int i = 0; i < groupStrings.size(); i++) {
- final String headerName = useRoles || rolesLookupExecuted() ? authHeaderActorGroupsPrefix : String.format(Locale.ROOT, ACTOR_GROUPS_HEADER_FORMAT, authHeaderActorGroupsPrefix, i + 1);
- getResponse().addHeader(headerName, groupStrings.get(i));
+ getResponse().addHeader(createGroupsHeaderName(useRoles, i), groupStrings.get(i));
}
}
return ok().build();
}
+ private String createGroupsHeaderName(boolean useRoles, int index) {
+ if (authHeaderActorGroupsName != null) {
+ // explicit groups header takes precedence over the prefix and is used directly, without an index suffix
+ return authHeaderActorGroupsName;
+ } else if (useRoles || rolesLookupExecuted()) {
+ return authHeaderActorGroupsPrefix;
+ } else {
+ return String.format(Locale.ROOT, ACTOR_GROUPS_HEADER_FORMAT, authHeaderActorGroupsPrefix, index + 1);
+ }
+ }
+
private Collection lookupRoles(String userName, Collection groups) {
Collection roles = null;
try {
diff --git a/gateway-service-auth/src/test/java/org/apache/knox/gateway/service/auth/PreAuthResourceTest.java b/gateway-service-auth/src/test/java/org/apache/knox/gateway/service/auth/PreAuthResourceTest.java
index 5e1496c832..136b0ed39a 100644
--- a/gateway-service-auth/src/test/java/org/apache/knox/gateway/service/auth/PreAuthResourceTest.java
+++ b/gateway-service-auth/src/test/java/org/apache/knox/gateway/service/auth/PreAuthResourceTest.java
@@ -169,6 +169,33 @@ public void testPopulatingCustomGroupsHeader() throws Exception {
EasyMock.verify(response);
}
+ @Test
+ public void testExplicitGroupsHeaderTakesPrecedenceOverPrefix() throws Exception {
+ final String explicitGroupsHeader = "X-Knox-Actor-Groups";
+ subject.getPrincipals().add(new GroupPrincipal("group1"));
+
+ context = EasyMock.createNiceMock(ServletContext.class);
+ EasyMock.expect(context.getInitParameter(PreAuthResource.AUTH_ACTOR_GROUPS_HEADER_NAME)).andReturn(explicitGroupsHeader).anyTimes();
+ // a prefix is configured as well, to prove the explicit header wins and no index suffix is appended
+ EasyMock.expect(context.getInitParameter(PreAuthResource.AUTH_ACTOR_GROUPS_HEADER_PREFIX)).andReturn("X-Knox-Prefixed-Groups").anyTimes();
+ request = EasyMock.createNiceMock(HttpServletRequest.class);
+ EasyMock.expect(request.getAttribute(AbstractIdentityAssertionBase.ROLES_LOOKUP_EXECUTED)).andReturn(false).anyTimes();
+ response = EasyMock.createNiceMock(HttpServletResponse.class);
+ response.setHeader(PreAuthResource.DEFAULT_AUTH_ACTOR_ID_HEADER_NAME, USER_NAME);
+ EasyMock.expectLastCall();
+ // the explicit header name is used directly, without an index suffix
+ response.addHeader(EasyMock.eq(explicitGroupsHeader), EasyMock.anyString());
+ EasyMock.expectLastCall().times(1);
+ EasyMock.replay(context, request, response);
+
+ final PreAuthResource preAuthResource = new PreAuthResource();
+ preAuthResource.context = context;
+ preAuthResource.response = response;
+ preAuthResource.request = request;
+ executeResourceWithSubject(preAuthResource);
+ EasyMock.verify(response);
+ }
+
@Test
public void testPopulatingGroupsWithRoles() throws Exception {
final String rolesHeader = "X-Knox-Roles";
diff --git a/gateway-service-knoxidf/pom.xml b/gateway-service-knoxidf/pom.xml
new file mode 100644
index 0000000000..3c5fbce588
--- /dev/null
+++ b/gateway-service-knoxidf/pom.xml
@@ -0,0 +1,115 @@
+
+
+
+ 4.0.0
+
+ org.apache.knox
+ gateway
+ 3.0.0-SNAPSHOT
+
+
+ gateway-service-knoxidf
+ gateway-service-knoxidf
+
+
+
+ org.apache.knox
+ gateway-i18n
+
+
+ org.apache.knox
+ gateway-spi
+
+
+ org.apache.knox
+ gateway-provider-jersey
+
+
+ org.apache.knox
+ gateway-util-common
+
+
+ org.apache.knox
+ gateway-service-knoxtoken
+
+
+
+ javax.annotation
+ javax.annotation-api
+
+
+ javax.ws.rs
+ javax.ws.rs-api
+
+
+ javax.servlet
+ javax.servlet-api
+
+
+
+ com.google.guava
+ guava
+
+
+ commons-io
+ commons-io
+
+
+ com.fasterxml.jackson.core
+ jackson-annotations
+
+
+ com.fasterxml.jackson.core
+ jackson-databind
+
+
+ com.fasterxml.uuid
+ java-uuid-generator
+
+
+ com.nimbusds
+ nimbus-jose-jwt
+
+
+ com.github.ben-manes.caffeine
+ caffeine
+
+
+ org.apache.commons
+ commons-lang3
+
+
+ org.apache.commons
+ commons-text
+
+
+ org.apache.httpcomponents
+ httpclient
+
+
+ org.apache.httpcomponents
+ httpcore
+
+
+ org.glassfish.jersey.core
+ jersey-common
+
+
+
diff --git a/gateway-service-knoxidf/src/main/java/org/apache/knox/gateway/service/knoxidf/AuthConsentServlet.java b/gateway-service-knoxidf/src/main/java/org/apache/knox/gateway/service/knoxidf/AuthConsentServlet.java
new file mode 100644
index 0000000000..6b1b946cb2
--- /dev/null
+++ b/gateway-service-knoxidf/src/main/java/org/apache/knox/gateway/service/knoxidf/AuthConsentServlet.java
@@ -0,0 +1,133 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with this
+ * work for additional information regarding copyright ownership. The ASF
+ * licenses this file to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+ * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+ * License for the specific language governing permissions and limitations under
+ * the License.
+ */
+package org.apache.knox.gateway.service.knoxidf;
+
+import org.apache.commons.text.StringEscapeUtils;
+
+import javax.servlet.http.HttpServlet;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+import javax.ws.rs.core.Context;
+import javax.ws.rs.core.UriInfo;
+import java.io.IOException;
+import java.io.PrintWriter;
+import java.util.Arrays;
+import java.util.HashSet;
+import java.util.Locale;
+import java.util.Set;
+
+import static org.apache.knox.gateway.util.knoxidf.KnoxIDFUtils.getRequestParamSafe;
+
+
+public class AuthConsentServlet extends HttpServlet {
+
+ @Context
+ UriInfo uriInfo;
+
+ @Override
+ protected void doGet(HttpServletRequest request, HttpServletResponse response) throws IOException {
+ response.setContentType("text/html;charset=UTF-8");
+ final String clientId = getRequestParamSafe(request, "client_id");
+ final String state = getRequestParamSafe(request, "state");
+ final String scope = getRequestParamSafe(request, "scope");
+ final Set scopes = new HashSet<>(Arrays.asList(scope.split("\\s+")));
+
+ try (PrintWriter out = response.getWriter()) {
+ out.println("");
+ out.println("Consent Required");
+ out.println("");
+ out.println("");
+ out.println("");
+ out.println("
Application Consent Required
");
+ out.printf(Locale.US, "
The application %s is requesting access to your account.
%n", clientId);
+
+ if (!scopes.isEmpty()) {
+ out.println("
This application will be able to:
");
+ out.println("
");
+ for (String s : scopes) {
+ out.printf(Locale.US, "- %s
%n", describeScope(s));
+ }
+ out.println("
");
+ }
+
+ // Accept/deny POST directly to the JAX-RS consent endpoints (which require POST) via each
+ // button's formaction, so accepting consent is never triggerable by a passive GET (prefetch,
+ // history re-nav, a leaked consent-state URL). The base path is derived from the servlet
+ // context and a compile-time constant, so it needs no escaping.
+ final String consentBasePath = request.getServletContext().getContextPath() + "/" + AuthorizeResource.RESOURCE_PATH;
+ out.println("
");
+ out.println("
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+ * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+ * License for the specific language governing permissions and limitations under
+ * the License.
+ */
+package org.apache.knox.gateway.service.knoxidf;
+
+import com.fasterxml.uuid.Generators;
+import com.fasterxml.uuid.impl.NameBasedGenerator;
+import com.nimbusds.jose.JOSEObjectType;
+import com.nimbusds.jose.KeyLengthException;
+import com.nimbusds.jose.proc.DefaultJOSEObjectTypeVerifier;
+import com.nimbusds.jose.proc.JOSEObjectTypeVerifier;
+import com.nimbusds.jose.proc.SecurityContext;
+import org.apache.commons.lang3.StringUtils;
+import org.apache.commons.lang3.tuple.Pair;
+import org.apache.http.NameValuePair;
+import org.apache.http.client.config.RequestConfig;
+import org.apache.http.client.entity.UrlEncodedFormEntity;
+import org.apache.http.client.methods.CloseableHttpResponse;
+import org.apache.http.client.methods.HttpPost;
+import org.apache.http.impl.client.CloseableHttpClient;
+import org.apache.http.impl.client.HttpClients;
+import org.apache.http.message.BasicNameValuePair;
+import org.apache.http.util.EntityUtils;
+import org.apache.knox.gateway.config.GatewayConfig;
+import org.apache.knox.gateway.audit.api.Action;
+import org.apache.knox.gateway.audit.api.ActionOutcome;
+import org.apache.knox.gateway.audit.api.ResourceType;
+import org.apache.knox.gateway.security.SubjectUtils;
+import org.apache.knox.gateway.service.knoxtoken.PasscodeTokenResourceBase;
+import org.apache.knox.gateway.services.GatewayServices;
+import org.apache.knox.gateway.services.ServiceLifecycleException;
+import org.apache.knox.gateway.services.ServiceType;
+import org.apache.http.ssl.SSLContexts;
+import org.apache.knox.gateway.services.knoxidf.federation.FederatedIdentity;
+import org.apache.knox.gateway.services.knoxidf.federation.FederatedIdentityService;
+import org.apache.knox.gateway.services.security.AliasService;
+import org.apache.knox.gateway.services.security.AliasServiceException;
+import org.apache.knox.gateway.services.security.KeystoreService;
+import org.apache.knox.gateway.services.security.token.JWTokenAuthority;
+import org.apache.knox.gateway.services.security.token.TokenMetadata;
+import org.apache.knox.gateway.services.security.token.TokenMetadataType;
+import org.apache.knox.gateway.services.security.token.TokenServiceException;
+import org.apache.knox.gateway.services.security.token.UnknownTokenException;
+import org.apache.knox.gateway.services.security.token.impl.JWT;
+import org.apache.knox.gateway.services.security.token.impl.JWTToken;
+import org.apache.knox.gateway.util.JsonUtils;
+import org.apache.knox.gateway.util.knoxidf.AuthorizeRequestMetadata;
+import org.apache.knox.gateway.util.knoxidf.AuthorizeRequestMetadataStore;
+import org.apache.knox.gateway.util.knoxidf.FederatedNonceStore;
+import org.apache.knox.gateway.util.knoxidf.FederatedOpConfiguration;
+import org.apache.knox.gateway.util.knoxidf.FederatedOpConfigurationStore;
+
+import javax.annotation.PostConstruct;
+import javax.servlet.ServletContext;
+import javax.servlet.ServletException;
+import javax.servlet.http.HttpServletRequest;
+import javax.ws.rs.GET;
+import javax.ws.rs.POST;
+import javax.ws.rs.Path;
+import javax.ws.rs.core.Context;
+import javax.ws.rs.core.Response;
+import javax.net.ssl.SSLContext;
+import java.io.UnsupportedEncodingException;
+import java.net.URI;
+import java.security.KeyStore;
+import java.security.MessageDigest;
+import java.security.NoSuchAlgorithmException;
+import java.net.URISyntaxException;
+import java.net.URLEncoder;
+import java.nio.charset.StandardCharsets;
+import java.time.Instant;
+import java.util.ArrayList;
+import java.util.Arrays;
+import java.util.Collections;
+import java.util.HashMap;
+import java.util.HashSet;
+import java.util.List;
+import java.util.Locale;
+import java.util.Map;
+import java.util.Set;
+import java.util.UUID;
+import java.util.stream.Collectors;
+
+import static org.apache.knox.gateway.security.CommonTokenConstants.CLIENT_SECRET;
+import static org.apache.knox.gateway.security.CommonTokenConstants.GRANT_TYPE;
+import static org.apache.knox.gateway.util.knoxidf.KnoxIDFConstants.ALLOWED_SCOPES;
+import static org.apache.knox.gateway.util.knoxidf.KnoxIDFConstants.BASE_RESOURCE_PATH;
+import static org.apache.knox.gateway.util.knoxidf.KnoxIDFConstants.CLIENT_ID;
+import static org.apache.knox.gateway.util.knoxidf.KnoxIDFConstants.CODE;
+import static org.apache.knox.gateway.util.knoxidf.KnoxIDFConstants.CODE_CHALLENGE;
+import static org.apache.knox.gateway.util.knoxidf.KnoxIDFConstants.CODE_CHALLENGE_METHOD;
+import static org.apache.knox.gateway.util.knoxidf.KnoxIDFConstants.DEFAULT_SCOPES;
+import static org.apache.knox.gateway.util.knoxidf.KnoxIDFConstants.FEDERATED_IDENTITY_ID;
+import static org.apache.knox.gateway.util.knoxidf.KnoxIDFConstants.NONCE;
+import static org.apache.knox.gateway.util.knoxidf.KnoxIDFConstants.OFFLINE_ACCESS_SCOPE;
+import static org.apache.knox.gateway.util.knoxidf.KnoxIDFConstants.PKCE_METHOD_S256;
+import static org.apache.knox.gateway.util.knoxidf.KnoxIDFConstants.REDIRECT_URI;
+import static org.apache.knox.gateway.util.knoxidf.KnoxIDFConstants.REDIRECT_URIS;
+import static org.apache.knox.gateway.util.knoxidf.KnoxIDFConstants.RESPONSE_TYPE;
+import static org.apache.knox.gateway.util.knoxidf.KnoxIDFConstants.SCOPE;
+import static org.apache.knox.gateway.util.knoxidf.KnoxIDFConstants.STATE;
+import static org.apache.knox.gateway.util.knoxidf.KnoxIDFUtils.error;
+
+
+@Path(AuthorizeResource.RESOURCE_PATH)
+public class AuthorizeResource extends PasscodeTokenResourceBase {
+ static final String RESOURCE_PATH = BASE_RESOURCE_PATH + "/authorize";
+ // RFC 4122 "URL" namespace UUID. Used as the fixed namespace for deriving a STABLE Knox
+ // subject (UUIDv5) from a federated identity's issuer+subject (see deriveKnoxSubject), so the
+ // same upstream user always maps to the same Knox 'sub' across logins and gateway restarts.
+ // Must not change once federated identities are persisted -- it would rewrite every existing
+ // federated user's subject.
+ private static final UUID KNOX_NAMESPACE = UUID.fromString("6ba7b811-9dad-11d1-80b4-00c04fd430c8");
+ private static final NameBasedGenerator UUID_V5 = Generators.nameBasedGenerator(KNOX_NAMESPACE);
+ public static final Set ALLOWED_CLAIMS = Set.of("preferred_username", "email", "email_verified",
+ "given_name", "family_name", "name", "locale");
+
+ private static final String UTF_8 = StandardCharsets.UTF_8.name();
+ private AuthorizeRequestMetadataStore authorizeRequestMetadataStore;
+ private final FederatedOpConfigurationStore federatedOpConfigurationStore = FederatedOpConfigurationStore.getInstance(120000L);
+ private final FederatedNonceStore federatedNonceStore = FederatedNonceStore.getInstance(120000L);
+
+ @Context
+ private HttpServletRequest request;
+
+ @Context
+ private ServletContext servletContext;
+
+ private FederatedIdentityService federatedIdentityService;
+ private boolean autoConsentEnabled;
+
+ @Override
+ public String getPrefix() {
+ return "knoxidf.";
+ }
+
+ @PostConstruct
+ @Override
+ public void init() throws ServletException, AliasServiceException, ServiceLifecycleException, KeyLengthException {
+ super.init();
+ this.authorizeRequestMetadataStore = AuthorizeRequestMetadataStore.getInstance(tokenTTL);
+ final GatewayServices services = (GatewayServices) servletContext.getAttribute(GatewayServices.GATEWAY_SERVICES_ATTRIBUTE);
+ federatedIdentityService = services.getService(ServiceType.KNOXIDF_FEDERATED_IDENTITY_SERVICE);
+ // Skipping user consent is a server-side deployment decision, never a client-supplied
+ // request parameter: a client must not be able to bypass the consent screen by sending
+ // auto_consent=true.
+ this.autoConsentEnabled = "true".equalsIgnoreCase(servletContext.getInitParameter("knoxidf.auto.consent.enabled"));
+ }
+
+ @Override
+ @GET
+ public Response doGet() {
+ return authorize();
+ }
+
+ @Override
+ @POST
+ public Response doPost() {
+ return authorize();
+ }
+
+ private Response authorize() {
+ return authorize(request.getParameter(RESPONSE_TYPE), request.getParameter(CLIENT_ID), request.getParameter(REDIRECT_URI),
+ request.getParameter(SCOPE), request.getParameter(STATE), request.getParameter(NONCE),
+ request.getParameter(CODE_CHALLENGE), request.getParameter(CODE_CHALLENGE_METHOD));
+ }
+
+ private Response authorize(String responseType,
+ String clientId,
+ String redirectUri,
+ String scope,
+ String state,
+ String nonce,
+ String codeChallenge,
+ String codeChallengeMethod) {
+ final String subject = SubjectUtils.getCurrentEffectivePrincipalName();
+ // DEFAULT_SCOPES is an ImmutableSet; copy it into a mutable set so downstream mutation is safe.
+ final Set requestedScopes = StringUtils.isBlank(scope) ? new HashSet<>(DEFAULT_SCOPES) : new HashSet<>(Arrays.asList(scope.split("\\s+")));
+ final AuthorizeRequestMetadata authorizeRequestMetadata = new AuthorizeRequestMetadata(clientId, subject, responseType, redirectUri, requestedScopes, state, nonce, codeChallenge, codeChallengeMethod);
+ final Response verificationErrorResponse = verifyParams(authorizeRequestMetadata);
+ if (verificationErrorResponse != null) {
+ // The authorization request was rejected (unknown client_id, bad redirect_uri, disallowed
+ // scope, or unsupported PKCE method). Record the rejection with the masked client_id.
+ KnoxIDFAudit.audit(Action.AUTHORIZATION, KnoxIDFAudit.mask(clientId), ResourceType.PRINCIPAL,
+ ActionOutcome.FAILURE, "event=authorize subject=" + KnoxIDFAudit.subjectLabel(subject)
+ + " reason=request_rejected");
+ return verificationErrorResponse;
+ }
+
+ if (!hasConsent(authorizeRequestMetadata)) {
+ if (autoConsentEnabled) {
+ markConsentAccepted(authorizeRequestMetadata);
+ } else {
+ final String consentAuthState = UUID.randomUUID().toString();
+ authorizeRequestMetadataStore.put(consentAuthState, authorizeRequestMetadata);
+ final String baseUri = servletContext.getContextPath() + "/authConsent";
+ // Every value placed into the consent redirect's query string must be percent-encoded;
+ // a client_id containing '&', '=' or '#' would otherwise split or corrupt the URL.
+ final String clientIdParam = URLEncoder.encode(clientId, StandardCharsets.UTF_8);
+ final String scopeParam = URLEncoder.encode(authorizeRequestMetadata.getJoinedRequestedScopes(), StandardCharsets.UTF_8);
+ final String redirect = String.format(Locale.US, "%s?client_id=%s&state=%s&scope=%s", baseUri, clientIdParam, consentAuthState, scopeParam);
+ return Response.seeOther(java.net.URI.create(redirect)).build();
+ }
+ }
+ return getAuthCodeFromKnox(authorizeRequestMetadata, null);
+ }
+
+ private boolean hasConsent(final AuthorizeRequestMetadata authorizeRequestMetadata) {
+ try {
+ final TokenMetadata tokenMetadata = tokenStateService.getTokenMetadata(authorizeRequestMetadata.getClientId());
+ final String consentKey = consentMetadataKey(authorizeRequestMetadata.getSubject());
+ final String storedScopes = tokenMetadata.getMetadataMap().get(consentKey);
+ if (storedScopes == null || storedScopes.isEmpty()) {
+ return false;
+ }
+ final Set storedScopeSet = new HashSet<>(Arrays.asList(storedScopes.split("\\s+")));
+ return storedScopeSet.containsAll(authorizeRequestMetadata.getRequestedScopes());
+ } catch (UnknownTokenException e) {
+ //this should not happen as we validated the client_id already
+ return false;
+ }
+ }
+
+ private void markConsentAccepted(AuthorizeRequestMetadata authorizeRequestMetadata) {
+ final TokenMetadata consentAcceptedMetadata = new TokenMetadata();
+ consentAcceptedMetadata.add(consentMetadataKey(authorizeRequestMetadata.getSubject()), authorizeRequestMetadata.getJoinedRequestedScopes());
+ tokenStateService.addMetadata(authorizeRequestMetadata.getClientId(), consentAcceptedMetadata);
+ }
+
+ /**
+ * Derives the metadata key under which a subject's granted consent scopes are stored. Consent is
+ * persisted in {@code KNOX_TOKEN_METADATA.md_name}, which is {@code VARCHAR(32)}; the previous
+ * {@code "consentAccepted_" + subject} key overflowed that for realistic subjects (federated
+ * UUID subjects, long usernames), silently truncating or failing the write on strict dialects.
+ * This derives a fixed-width key {@code "consent_" + first-20-hex-chars(SHA-256(subject))} = 28
+ * chars, comfortably within the column. ~80 bits of hash is collision-safe for any realistic
+ * user population, and the derivation is uniform for plain usernames and UUID subjects alike.
+ * {@link #hasConsent} and {@link #markConsentAccepted} both route through here so read and write
+ * always agree on the key.
+ */
+ static String consentMetadataKey(final String subject) {
+ try {
+ final MessageDigest digest = MessageDigest.getInstance("SHA-256");
+ final byte[] hash = digest.digest((subject == null ? "" : subject).getBytes(StandardCharsets.UTF_8));
+ final StringBuilder hex = new StringBuilder("consent_");
+ for (int i = 0; i < 10; i++) { // 10 bytes -> 20 hex chars
+ hex.append(String.format(Locale.US, "%02x", hash[i]));
+ }
+ return hex.toString();
+ } catch (NoSuchAlgorithmException e) {
+ // SHA-256 is a required algorithm on every JRE; its absence is unrecoverable.
+ throw new IllegalStateException("SHA-256 is required but unavailable", e);
+ }
+ }
+
+ private Response getAuthCodeFromKnox(final AuthorizeRequestMetadata authorizeRequestMetadata, final Pair federatedTokens) {
+ final String clientId = authorizeRequestMetadata.getClientId();
+ final String subject = KnoxIDFAudit.subjectLabel(authorizeRequestMetadata.getSubject());
+ final Response tokenResponse = getAuthenticationToken();
+ if (tokenResponse.getStatus() == Response.Status.OK.getStatusCode()) {
+ final Map tokenResponseMap = JsonUtils.getMapFromJsonString(tokenResponse.getEntity().toString());
+ final String tokenId = tokenResponseMap.get(TOKEN_ID);
+ decorateAuthCodeToken(tokenId, authorizeRequestMetadata, federatedTokens);
+ // An authorization code was issued to the client for this subject. The code is masked;
+ // it is a single-use credential and its full value must never appear in the audit log.
+ KnoxIDFAudit.audit(Action.AUTHORIZATION, KnoxIDFAudit.mask(clientId), ResourceType.PRINCIPAL,
+ ActionOutcome.SUCCESS, "event=authorize subject=" + subject + " code=" + KnoxIDFAudit.mask(tokenId)
+ + (federatedTokens == null ? "" : " federated=true") + " reason=code_issued");
+ return redirectToAuthSuccess(authorizeRequestMetadata, tokenId);
+ }
+ KnoxIDFAudit.audit(Action.AUTHORIZATION, KnoxIDFAudit.mask(clientId), ResourceType.PRINCIPAL,
+ ActionOutcome.FAILURE, "event=authorize subject=" + subject + " reason=code_issuance_failed");
+ return tokenResponse;
+ }
+
+ private Response redirectToAuthSuccess(final AuthorizeRequestMetadata authorizeRequestMetadata, final String code) {
+ try {
+ final String redirectLocation = buildSuccessRedirect(
+ authorizeRequestMetadata.getRedirectUri(), code, authorizeRequestMetadata.getState());
+ return Response.seeOther(URI.create(redirectLocation)).build();
+ } catch (UnsupportedEncodingException e) {
+ throw new RuntimeException(e); //This should never happen with UTF-8
+ }
+ }
+
+ /**
+ * Appends the {@code code} and {@code state} authorization-response params to the client's
+ * registered redirect_uri. Uses {@code &} as the separator when the redirect_uri already carries
+ * a query string and {@code ?} otherwise, so a registered URI such as
+ * {@code https://app.example/cb?ui=1} produces {@code ...?ui=1&code=...&state=...} rather than a
+ * malformed second {@code ?} that the client would fail to parse. Package-private for testing.
+ */
+ static String buildSuccessRedirect(final String redirectUri, final String code, final String state)
+ throws UnsupportedEncodingException {
+ final String separator = redirectUri.contains("?") ? "&" : "?";
+ return redirectUri
+ + separator + "code=" + URLEncoder.encode(code, UTF_8)
+ + "&state=" + URLEncoder.encode(state, UTF_8);
+ }
+
+ @GET
+ @Path("/callback")
+ public Response authCallback() throws Exception {
+ //This is the callback for the federated OP
+ final String federatedAuthCode = request.getParameter(CODE);
+ final String state = request.getParameter(STATE);
+ // Audit the federated-OP login callback exactly once. The resource is the federated OP name
+ // (once known); the reason distinguishes the failure modes. The federated auth code and the
+ // OP tokens are never logged.
+ String opName = KnoxIDFAudit.UNKNOWN;
+ String outcome = ActionOutcome.FAILURE;
+ String detail = "reason=unknown";
+ try {
+ if (StringUtils.isBlank(state) || StringUtils.isBlank(federatedAuthCode)) {
+ detail = "reason=missing_state_or_code";
+ return error("invalid_request", "Missing state or code");
+ }
+ final AuthorizeRequestMetadata authorizeRequestMetadata = authorizeRequestMetadataStore.get(state);
+ if (authorizeRequestMetadata == null) {
+ detail = "reason=unknown_state";
+ return error("invalid_request", "Unknown or expired state");
+ }
+ final Set opConfigs = federatedOpConfigurationStore.get(state);
+ final FederatedOpConfiguration federatedOpConfiguration = opConfigs == null ? null : opConfigs.stream().findFirst().orElse(null);
+ if (federatedOpConfiguration == null) {
+ detail = "reason=no_op_configuration";
+ return error("invalid_request", "No federated OP configuration available for the request");
+ }
+ opName = federatedOpConfiguration.getName();
+ // The federated callback state is single-use: invalidate it in both stores now that it has
+ // been validated and captured, so a replayed callback with the same state is rejected. The
+ // nonce Knox sent to the OP was stashed under the same key (the login-session id == state);
+ // retrieve and invalidate it too so it cannot be reused.
+ authorizeRequestMetadataStore.remove(state);
+ federatedOpConfigurationStore.remove(state);
+ final String expectedNonce = federatedNonceStore.get(state);
+ federatedNonceStore.remove(state);
+ final Pair federatedTokens;
+ try {
+ federatedTokens = exchangeFederatedAuthCodeToTokens(federatedAuthCode, federatedOpConfiguration);
+ } catch (ClientSecretResolutionException e) {
+ // A configured client-secret alias could not be resolved. This is a server-side
+ // misconfiguration, not a client error, and we deliberately never made the OP call.
+ detail = "reason=client_secret_unresolved";
+ return error("server_error", e.getMessage());
+ } catch (FederatedTokenExchangeException e) {
+ // The OP's token endpoint returned a non-200. Audit the real cause (the OP status,
+ // without its response body) and return a generic server_error instead of letting the
+ // exception escape as a 500 that could leak the OP's error body.
+ detail = "reason=federated_token_exchange_failed op_status=" + e.getOpStatus();
+ return error("server_error", "Federated authentication failed");
+ }
+ if (StringUtils.isBlank(federatedTokens.getLeft())) {
+ detail = "reason=no_id_token";
+ return error("invalid_request", "Federated OP did not return an id_token");
+ }
+ final JWT federatedIdToken = new JWTToken(federatedTokens.getLeft());
+ // Verify the OP's id_token (signature/issuer/audience/expiry) before trusting any claim in it.
+ final Response validationError = validateFederatedIdToken(federatedIdToken, federatedOpConfiguration);
+ if (validationError != null) {
+ detail = "reason=id_token_validation_failed";
+ return validationError;
+ }
+ // Bind the (now signature-verified) id_token to this authorization request (OIDC Core 3.1.2.1):
+ // its nonce claim must equal the nonce Knox generated and sent to the OP for this login session.
+ // This is checked only after the token's authenticity is established, so a forged token cannot
+ // supply its own matching nonce. A missing expected nonce (e.g. expired/replayed state) or a
+ // mismatch fails the flow.
+ final Response nonceError = verifyFederatedNonce(expectedNonce, federatedIdToken);
+ if (nonceError != null) {
+ detail = "reason=nonce_mismatch";
+ return nonceError;
+ }
+ final FederatedIdentity federatedIdentity = resolveFederatedIdentity(federatedIdToken, federatedOpConfiguration.getName());
+ outcome = ActionOutcome.SUCCESS;
+ detail = "reason=federated_identity_resolved subject=" + KnoxIDFAudit.subjectLabel(federatedIdentity.getId());
+ return getAuthCodeFromKnox(authorizeRequestMetadata, Pair.of(federatedIdentity.getId(), federatedTokens.getRight()));
+ } finally {
+ KnoxIDFAudit.audit(Action.AUTHENTICATION, opName, ResourceType.TRUSTED_ISSUER, outcome,
+ "event=federated_callback op=" + opName + " " + detail);
+ }
+ }
+
+ // POST, not GET: accepting consent persists a consent record and issues an authorization code, so
+ // it must not be triggerable by passive browser navigation (img/link prefetch, history re-nav) or
+ // by a leaked consent-state URL. Requiring a form POST puts it under the browser's same-origin/CSRF
+ // model.
+ @POST
+ @Path("/consentAccepted")
+ public Response consentAccepted() throws Exception {
+ final String state = request.getParameter(STATE);
+ final AuthorizeRequestMetadata authorizeRequestMetadata = authorizeRequestMetadataStore.get(state);
+ if (authorizeRequestMetadata == null) {
+ KnoxIDFAudit.audit(Action.AUTHORIZATION, KnoxIDFAudit.UNKNOWN, ResourceType.PRINCIPAL,
+ ActionOutcome.FAILURE, "event=consent reason=invalid_or_expired_state");
+ return error("invalid_request", "Invalid state");
+ }
+
+ // Bind consent to the subject that initiated the authorization request. Without this, user B
+ // (authenticated) could replay user A's consent-state URL and have consent recorded for A while
+ // an auth code is minted for B and sent to A's redirect_uri (cross-user consent / mis-routed
+ // code). The consent state is single-use, so consume it before rejecting a mismatch too.
+ final String currentSubject = SubjectUtils.getCurrentEffectivePrincipalName();
+ if (currentSubject == null || !currentSubject.equals(authorizeRequestMetadata.getSubject())) {
+ authorizeRequestMetadataStore.remove(state);
+ KnoxIDFAudit.audit(Action.AUTHORIZATION, KnoxIDFAudit.mask(authorizeRequestMetadata.getClientId()),
+ ResourceType.PRINCIPAL, ActionOutcome.FAILURE, "event=consent subject="
+ + KnoxIDFAudit.subjectLabel(currentSubject) + " reason=subject_mismatch");
+ return error("access_denied", "Consent subject mismatch");
+ }
+
+ // Single-use consent state: invalidate it so the accepted-consent redirect cannot be replayed.
+ authorizeRequestMetadataStore.remove(state);
+ markConsentAccepted(authorizeRequestMetadata);
+ // Consent was granted by the subject for this client; the ensuing authorize() call audits the
+ // resulting code issuance separately.
+ KnoxIDFAudit.audit(Action.AUTHORIZATION, KnoxIDFAudit.mask(authorizeRequestMetadata.getClientId()),
+ ResourceType.PRINCIPAL, ActionOutcome.SUCCESS, "event=consent subject="
+ + KnoxIDFAudit.subjectLabel(authorizeRequestMetadata.getSubject()) + " reason=consent_granted");
+ return authorize(authorizeRequestMetadata.getResponseType(),
+ authorizeRequestMetadata.getClientId(),
+ authorizeRequestMetadata.getRedirectUri(),
+ authorizeRequestMetadata.getJoinedRequestedScopes(),
+ authorizeRequestMetadata.getState(),
+ authorizeRequestMetadata.getNonce(),
+ authorizeRequestMetadata.getCodeChallenge(),
+ authorizeRequestMetadata.getCodeChallengeMethod());
+ }
+
+ @POST
+ @Path("/consentDenied")
+ public Response consentDenied() throws Exception {
+ KnoxIDFAudit.audit(Action.AUTHORIZATION,
+ KnoxIDFAudit.subjectLabel(SubjectUtils.getCurrentEffectivePrincipalName()), ResourceType.PRINCIPAL,
+ ActionOutcome.FAILURE, "event=consent reason=consent_denied");
+ return Response.status(Response.Status.FORBIDDEN).entity("Consent denied!").build();
+ }
+
+ private void decorateAuthCodeToken(final String tokenId, final AuthorizeRequestMetadata authorizeRequestMetadata, final Pair federatedTokens) {
+ final Map authCodeTokenMap = new HashMap<>();
+ authCodeTokenMap.put(TokenMetadata.TYPE, TokenMetadataType.AUTH_CODE.name());
+ authCodeTokenMap.put(CLIENT_ID, authorizeRequestMetadata.getClientId());
+ authCodeTokenMap.put(REDIRECT_URI, authorizeRequestMetadata.getRedirectUri());
+ authCodeTokenMap.put(TokenMetadata.USER_NAME, authorizeRequestMetadata.getSubject());
+ authCodeTokenMap.put(SCOPE, authorizeRequestMetadata.getJoinedRequestedScopes());
+ if (authorizeRequestMetadata.getRequestedScopes().contains(OFFLINE_ACCESS_SCOPE)) {
+ authCodeTokenMap.put(OFFLINE_ACCESS_SCOPE, "true");
+ }
+ if (StringUtils.isNotBlank(authorizeRequestMetadata.getNonce())) {
+ authCodeTokenMap.put(NONCE, authorizeRequestMetadata.getNonce());
+ }
+ if (StringUtils.isNotBlank(authorizeRequestMetadata.getCodeChallenge())) {
+ authCodeTokenMap.put(CODE_CHALLENGE, authorizeRequestMetadata.getCodeChallenge());
+ // Method is validated to be S256 in verifyParams; store it as-is (no 'plain' default).
+ authCodeTokenMap.put(CODE_CHALLENGE_METHOD, authorizeRequestMetadata.getCodeChallengeMethod());
+ }
+ if (federatedTokens != null) {
+ // Persist only the pointer to the (separately stored) federated identity. The OP's
+ // access token (federatedTokens.getRight()) is deliberately NOT persisted: nothing reads
+ // it back, and storing an OP bearer secret in plaintext token metadata is a secret-at-rest
+ // exposure. If a future feature needs it, store it encrypted, not in the clear.
+ authCodeTokenMap.put(FEDERATED_IDENTITY_ID, federatedTokens.getLeft());
+ }
+ tokenStateService.addMetadata(tokenId, new TokenMetadata(authCodeTokenMap));
+ }
+
+ private Response verifyParams(final AuthorizeRequestMetadata authorizeRequestMetadata) {
+ final Response basicVerificationResponse = authorizeRequestMetadata.verify();
+ if (basicVerificationResponse == null) {
+ final TokenMetadata tokenMetadata;
+ // Verify client ID
+ try {
+ //This is ok for a POC, but we should cache that later
+ tokenMetadata = tokenStateService.getTokenMetadata(authorizeRequestMetadata.getClientId());
+ } catch (UnknownTokenException e) {
+ return error("invalid_request", "Unknown client_id");
+ }
+
+ // Verify redirect URI
+ final String storedRedirectUris = tokenMetadata.getMetadata(REDIRECT_URIS);
+ if (StringUtils.isBlank(storedRedirectUris)) {
+ return error("invalid_request", "Missing stored redirect_uris, cannot authorize the request");
+ }
+ final Set registeredRedirectUris = new HashSet<>(Arrays.asList(storedRedirectUris.split(",")));
+ if (!matchesRedirectUri(authorizeRequestMetadata.getRedirectUri(), registeredRedirectUris)) {
+ return error("invalid_request", "Invalid redirect_uri");
+ }
+
+ // Verify scope(s)
+ final String storedAllowedScopes = tokenMetadata.getMetadata(ALLOWED_SCOPES);
+ if (StringUtils.isBlank(storedAllowedScopes)) {
+ return error("invalid_scope", "Missing stored allowed_scopes, cannot authorize the request");
+ }
+ final Set registeredScopes = new HashSet<>(Arrays.asList(storedAllowedScopes.trim().split("\\s+")));
+ if (authorizeRequestMetadata.getRequestedScopes().stream().anyMatch(scope -> !registeredScopes.contains(scope))) {
+ return error("invalid_scope", "One or more requested scopes are not allowed");
+ }
+
+ // PKCE: only the S256 challenge method is supported. 'plain' (and an unspecified method,
+ // which OAuth would default to 'plain') offers no protection and is rejected.
+ if (StringUtils.isNotBlank(authorizeRequestMetadata.getCodeChallenge())
+ && !PKCE_METHOD_S256.equals(authorizeRequestMetadata.getCodeChallengeMethod())) {
+ return error("invalid_request", "Unsupported code_challenge_method; only S256 is supported");
+ }
+
+ return null;
+ }
+ return basicVerificationResponse;
+ }
+
+ // Package-private for testability (wildcard path-traversal matching is exercised by
+ // AuthorizeResourceRedirectUriMatchTest); not part of the public resource API.
+ boolean matchesRedirectUri(String requestedUri, Set registeredUris) {
+ final URI requested = parseUri(requestedUri);
+ if (requested == null) {
+ return false;
+ }
+ for (String registered : registeredUris) {
+ if (registered.endsWith("*")) {
+ // Wildcard is a path-prefix match, but the origin (scheme/host/port) must match
+ // exactly. Comparing parsed components prevents a bare startsWith from letting
+ // "https://good.example*" match "https://good.example.evil.com".
+ final URI base = parseUri(registered.substring(0, registered.length() - 1));
+ if (base != null && sameOrigin(base, requested)) {
+ // Normalize the requested path before the prefix compare so a traversal segment
+ // cannot escape the registered prefix: a raw startsWith would let
+ // ".../callback/../admin" match ".../callback/*" and deliver the code to /admin.
+ // normalize() collapses "/callback/../admin" to "/admin", which no longer matches.
+ final String basePath = base.normalize().getPath() == null ? "" : base.normalize().getPath();
+ final String reqPath = requested.normalize().getPath() == null ? "" : requested.normalize().getPath();
+ if (reqPath.startsWith(basePath)) {
+ return true;
+ }
+ }
+ } else if (registered.equals(requestedUri)) {
+ return true;
+ }
+ }
+ return false;
+ }
+
+ private static URI parseUri(String value) {
+ if (StringUtils.isBlank(value)) {
+ return null;
+ }
+ try {
+ return new URI(value);
+ } catch (URISyntaxException e) {
+ return null;
+ }
+ }
+
+ private static boolean sameOrigin(URI a, URI b) {
+ return a.getScheme() != null && a.getScheme().equalsIgnoreCase(b.getScheme())
+ && a.getHost() != null && a.getHost().equalsIgnoreCase(b.getHost())
+ && a.getPort() == b.getPort();
+ }
+
+ private Pair exchangeFederatedAuthCodeToTokens(String federatedAuthCode, FederatedOpConfiguration opConfig) {
+ String federatedIdToken = null;
+ String federatedAccessToken = null;
+ final Response federatedTokenExchangeResponse = fetchFederatedTokens(federatedAuthCode, opConfig);
+ if (federatedTokenExchangeResponse.getStatus() == Response.Status.OK.getStatusCode()) {
+ final Map federatedTokenExchangeResponseBodyMap = JsonUtils.getMapFromJsonString((String) federatedTokenExchangeResponse.getEntity());
+ federatedIdToken = federatedTokenExchangeResponseBodyMap.get("id_token");
+ federatedAccessToken = federatedTokenExchangeResponseBodyMap.get("access_token");
+ return Pair.of(federatedIdToken, federatedAccessToken);
+ } else {
+ // Do not embed the OP's response body in the exception: it can carry internal diagnostic
+ // codes and would otherwise surface in the audit log or a leaked 500 body. Carry only the
+ // HTTP status, which the caller audits and maps to a generic server_error.
+ throw new FederatedTokenExchangeException(federatedTokenExchangeResponse.getStatus());
+ }
+ }
+
+ /**
+ * Resolves the federated OP's client secret for the back-channel token request. An
+ * {@code AliasService} credential alias ({@code federated.op..clientSecret.alias}) is the
+ * preferred, secure source and takes precedence: when it resolves to a value, that value is
+ * used and the plaintext {@code clientSecret} topology param is never consulted. The plaintext
+ * param remains supported as a fallback only when no alias is configured, so existing
+ * deployments keep working. If an alias is configured but cannot be resolved we fail closed by
+ * throwing {@link ClientSecretResolutionException} rather than returning {@code null} (which the
+ * form encoder would have serialized to a literal {@code client_secret=null} sent to the OP) or
+ * silently leaking through to the plaintext param. The caller aborts the exchange before any
+ * HTTP request, so a misconfigured alias surfaces as a clear error instead of a bogus OP call.
+ */
+ private String resolveClientSecret(final FederatedOpConfiguration opConfig) {
+ final String alias = opConfig.getClientSecretAlias();
+ if (StringUtils.isBlank(alias)) {
+ return opConfig.getClientSecret();
+ }
+ char[] secret = null;
+ try {
+ final AliasService aliasService = getGatewayServices().getService(ServiceType.ALIAS_SERVICE);
+ String clusterName = (String) servletContext.getAttribute(GatewayServices.GATEWAY_CLUSTER_ATTRIBUTE);
+ if (StringUtils.isBlank(clusterName)) {
+ clusterName = AliasService.NO_CLUSTER_NAME;
+ }
+ secret = aliasService.getPasswordFromAliasForCluster(clusterName, alias, false);
+ } catch (AliasServiceException e) {
+ // Fall through to the fail-closed check below; an alias was configured but its lookup failed.
+ secret = null;
+ }
+ return requireResolvedAliasSecret(alias, secret);
+ }
+
+ /**
+ * Fail-closed guard for an explicitly configured client-secret alias: returns the resolved secret
+ * or throws {@link ClientSecretResolutionException} when it is absent/empty. Package-private and
+ * pure so the fail-closed decision is unit-testable without a live {@code AliasService}.
+ */
+ static String requireResolvedAliasSecret(final String alias, final char[] secret) {
+ if (secret == null || secret.length == 0) {
+ throw new ClientSecretResolutionException(
+ "Federated OP client secret alias '" + alias + "' is configured but could not be resolved; "
+ + "refusing to contact the OP without the intended secret");
+ }
+ return new String(secret);
+ }
+
+ /** Signals that a configured client-secret alias could not be resolved; the exchange must abort. */
+ static final class ClientSecretResolutionException extends RuntimeException {
+ ClientSecretResolutionException(final String message) {
+ super(message);
+ }
+ }
+
+ /**
+ * Signals that the federated OP's token endpoint returned a non-200 response. Carries only the
+ * HTTP status (safe to audit); the OP's response body is deliberately not propagated so it cannot
+ * leak into the audit log or an error response.
+ */
+ static final class FederatedTokenExchangeException extends RuntimeException {
+ private final int opStatus;
+
+ FederatedTokenExchangeException(final int opStatus) {
+ super("Federated OP token endpoint returned HTTP " + opStatus);
+ this.opStatus = opStatus;
+ }
+
+ int getOpStatus() {
+ return opStatus;
+ }
+ }
+
+ private Response fetchFederatedTokens(final String code, FederatedOpConfiguration opConfig) {
+ final List params = new ArrayList<>();
+ params.add(new BasicNameValuePair(CODE, code));
+ params.add(new BasicNameValuePair(REDIRECT_URI, opConfig.getAuthorizeCallback()));
+ params.add(new BasicNameValuePair(GRANT_TYPE, "authorization_code"));
+ params.add(new BasicNameValuePair(CLIENT_ID, opConfig.getClientId()));
+ params.add(new BasicNameValuePair(CLIENT_SECRET, resolveClientSecret(opConfig)));
+
+ try (CloseableHttpClient httpClient = createFederatedHttpClient()) {
+ HttpPost post = new HttpPost(opConfig.getTokenEndpoint());
+ post.setHeader("Content-Type", "application/x-www-form-urlencoded");
+ post.setEntity(new UrlEncodedFormEntity(params, StandardCharsets.UTF_8));
+
+ try (CloseableHttpResponse response = httpClient.execute(post)) {
+ int status = response.getStatusLine().getStatusCode();
+ String body = EntityUtils.toString(response.getEntity(), StandardCharsets.UTF_8);
+ return Response.status(status).entity(body).build();
+ }
+ } catch (Exception e) {
+ return Response.status(Response.Status.INTERNAL_SERVER_ERROR).entity("{\"error\":\"" + e.getMessage() + "\"}").build();
+ }
+ }
+
+ /**
+ * Builds the HTTP client used for the back-channel token request to the federated OP. The
+ * OP's TLS certificate must be validated against the Gateway's configured truststore
+ * ({@code gateway.truststore.*}) rather than the process-wide default, so this mirrors the
+ * outbound-dispatch clients. When no Gateway truststore is configured we fall back to the
+ * default client (JVM default trust material), never to an unvalidated client.
+ */
+ private CloseableHttpClient createFederatedHttpClient() throws Exception {
+ final KeystoreService keystoreService = getGatewayServices().getService(ServiceType.KEYSTORE_SERVICE);
+ final KeyStore trustStore = keystoreService.getTruststoreForHttpClient();
+ // Bound every back-channel call to the OP: without connect/socket timeouts an unresponsive
+ // external OP token endpoint pins the calling request thread indefinitely, so enough hung
+ // federated logins can exhaust the gateway's request threads (availability DoS). Mirrors the
+ // timeout handling of the trusted-issuer discovery client (OIDCDiscoveryHelper).
+ final RequestConfig requestConfig = federatedRequestConfig();
+ if (trustStore != null) {
+ final SSLContext sslContext = SSLContexts.custom().loadTrustMaterial(trustStore, null).build();
+ return HttpClients.custom().setSSLContext(sslContext).setDefaultRequestConfig(requestConfig).build();
+ }
+ return HttpClients.custom().setDefaultRequestConfig(requestConfig).build();
+ }
+
+ private RequestConfig federatedRequestConfig() {
+ final GatewayConfig config = servletContext == null
+ ? null
+ : (GatewayConfig) servletContext.getAttribute(GatewayConfig.GATEWAY_CONFIG_ATTRIBUTE);
+ final int connectTimeoutMs = config == null
+ ? GatewayConfig.KNOXIDF_FEDERATED_OP_CONNECT_TIMEOUT_MS_DEFAULT
+ : config.getKnoxIDFFederatedOpConnectTimeoutMs();
+ final int readTimeoutMs = config == null
+ ? GatewayConfig.KNOXIDF_FEDERATED_OP_READ_TIMEOUT_MS_DEFAULT
+ : config.getKnoxIDFFederatedOpReadTimeoutMs();
+ return RequestConfig.custom()
+ .setConnectTimeout(connectTimeoutMs)
+ .setConnectionRequestTimeout(connectTimeoutMs)
+ .setSocketTimeout(readTimeoutMs)
+ .build();
+ }
+
+ /**
+ * Verifies the federated OP's id_token before any claim in it is trusted:
+ *
+ * - signature against the OP's JWKS and {@code exp}/{@code nbf} (via {@link JWTokenAuthority});
+ * - {@code iss} equals the configured OP issuer;
+ * - {@code aud} contains our client_id registered at the OP.
+ *
+ * Fails closed: if the OP is not configured with a JWKS endpoint, expected issuer and client_id,
+ * the token cannot be verified and the federated login is refused.
+ *
+ * @return an error {@link Response} if verification fails, or {@code null} if the token is valid.
+ */
+ private Response validateFederatedIdToken(final JWT idToken, final FederatedOpConfiguration opConfig) {
+ final String jwksEndpoint = opConfig.getJwksEndpoint();
+ final String expectedIssuer = opConfig.getIssuer();
+ final String expectedAudience = opConfig.getClientId();
+ if (StringUtils.isBlank(jwksEndpoint) || StringUtils.isBlank(expectedIssuer) || StringUtils.isBlank(expectedAudience)) {
+ return error("invalid_request", "Federated OP is missing jwks.endpoint/issuer/clientId configuration; cannot verify id_token");
+ }
+
+ try {
+ final JWTokenAuthority authority = getGatewayServices().getService(ServiceType.TOKEN_SERVICE);
+ // A non-null JWS type verifier is required: federated OP id_tokens carry a "typ" header
+ // (Keycloak and most OPs set typ=JWT), and the shared token authority rejects any typ'd
+ // token outright when no verifier is supplied. Accept "JWT" and a missing typ (typ is
+ // optional per RFC 7519) so we interoperate with the range of conformant OPs.
+ final JOSEObjectTypeVerifier typeVerifier =
+ new DefaultJOSEObjectTypeVerifier<>(new HashSet<>(Arrays.asList(JOSEObjectType.JWT, null)));
+ // Verifies the signature against the OP's JWKS and checks exp/nbf.
+ if (!authority.verifyToken(idToken, Collections.singleton(new URI(jwksEndpoint)), opConfig.getSignatureAlgorithm(), typeVerifier)) {
+ return error("invalid_request", "Federated id_token signature or expiry verification failed");
+ }
+ } catch (URISyntaxException e) {
+ return error("invalid_request", "Invalid jwks.endpoint configured for federated OP");
+ } catch (TokenServiceException e) {
+ return error("invalid_request", "Federated id_token verification error");
+ }
+
+ if (!expectedIssuer.equals(idToken.getIssuer())) {
+ return error("invalid_request", "Federated id_token issuer mismatch");
+ }
+
+ final String[] audiences = idToken.getAudienceClaims();
+ if (audiences == null || !Arrays.asList(audiences).contains(expectedAudience)) {
+ return error("invalid_request", "Federated id_token audience mismatch");
+ }
+
+ return requireFederatedSubject(idToken);
+ }
+
+ /**
+ * Verifies the OIDC {@code nonce} binding for a federated login (OIDC Core 3.1.2.1). The
+ * {@code expectedNonce} is the value Knox generated for this login session and sent to the OP;
+ * it must equal the {@code nonce} claim of the (already signature-verified) id_token. Callers
+ * must invoke this only after {@link #validateFederatedIdToken} succeeds so a forged token cannot
+ * assert its own nonce.
+ *
+ * @return an error {@link Response} on absence/mismatch, or {@code null} when the nonce matches.
+ */
+ Response verifyFederatedNonce(final String expectedNonce, final JWT idToken) {
+ if (StringUtils.isBlank(expectedNonce)) {
+ return error("invalid_request", "Missing or expired federated login nonce");
+ }
+ if (!expectedNonce.equals(idToken.getClaim(NONCE))) {
+ return error("invalid_request", "Federated id_token nonce mismatch");
+ }
+ return null;
+ }
+
+ /**
+ * Enforces that a verified federated id_token carries the {@code sub} claim, which OIDC Core 2
+ * marks REQUIRED. Knox derives both the Knox subject and the federated-identity primary key from
+ * it, and the identity tables declare {@code external_subject NOT NULL}. A broken or hostile OP
+ * that omits {@code sub} would otherwise drive a NOT NULL insert failure -> HTTP 500 on every
+ * callback through that OP; reject it as a client/OP error instead. Call only after
+ * {@link #validateFederatedIdToken} has established the token's authenticity.
+ *
+ * @return an error {@link Response} when {@code sub} is absent/blank, or {@code null} otherwise.
+ */
+ Response requireFederatedSubject(final JWT idToken) {
+ if (StringUtils.isBlank(idToken.getSubject())) {
+ return error("invalid_request", "Federated id_token is missing the required sub claim");
+ }
+ return null;
+ }
+
+ private FederatedIdentity resolveFederatedIdentity(final JWT jwt, String opName) {
+ final String issuer = jwt.getIssuer();
+ final String subject = jwt.getSubject();
+ return federatedIdentityService.findByProviderAndSubject(opName.toUpperCase(Locale.US), issuer, subject).orElseGet(() -> persistFederatedIdentity(jwt, opName));
+ }
+
+ private FederatedIdentity persistFederatedIdentity(final JWT jwt, String opName) {
+ final Map attributes = jwt.getJWTClaimsSet().getClaims().entrySet().stream()
+ .filter(e -> ALLOWED_CLAIMS.contains(e.getKey()))
+ .filter(e -> e.getValue() != null)
+ .collect(Collectors.toMap(
+ Map.Entry::getKey,
+ e -> String.valueOf(e.getValue()),
+ (a, b) -> a, // defensive: ignore duplicates
+ HashMap::new
+ ));
+ final FederatedIdentity federatedIdentity = new FederatedIdentity(
+ deriveKnoxSubject(jwt.getSubject(), jwt.getIssuer()), // internal user id (generated)
+ opName.toUpperCase(Locale.US), // provider
+ jwt.getSubject(), // external subject
+ jwt.getIssuer(), // external issuer
+ Instant.now(), // createdAt
+ attributes
+ );
+
+ // Return whatever the service persisted: on a concurrent first-login race this is the row the
+ // winning request inserted, not our local copy, so the downstream auth code is keyed to the id
+ // that actually exists in the identity table.
+ return federatedIdentityService.addFederatedIdentity(federatedIdentity);
+ }
+
+ private String deriveKnoxSubject(String subject, String issuer) {
+ final String name = issuer + "|" + subject;
+ final UUID uuid = UUID_V5.generate(name.getBytes(StandardCharsets.UTF_8));
+ return uuid.toString();
+ }
+}
diff --git a/gateway-service-knoxidf/src/main/java/org/apache/knox/gateway/service/knoxidf/DiscoveryResource.java b/gateway-service-knoxidf/src/main/java/org/apache/knox/gateway/service/knoxidf/DiscoveryResource.java
new file mode 100644
index 0000000000..276ca8e8af
--- /dev/null
+++ b/gateway-service-knoxidf/src/main/java/org/apache/knox/gateway/service/knoxidf/DiscoveryResource.java
@@ -0,0 +1,97 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with this
+ * work for additional information regarding copyright ownership. The ASF
+ * licenses this file to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+ * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+ * License for the specific language governing permissions and limitations under
+ * the License.
+ */
+package org.apache.knox.gateway.service.knoxidf;
+
+import org.apache.knox.gateway.services.GatewayServices;
+import org.apache.knox.gateway.util.JsonUtils;
+import org.apache.knox.gateway.util.knoxidf.KnoxIDFConstants;
+
+import javax.annotation.PostConstruct;
+import javax.servlet.ServletContext;
+import javax.ws.rs.GET;
+import javax.ws.rs.Path;
+import javax.ws.rs.Produces;
+import javax.ws.rs.core.Context;
+import javax.ws.rs.core.MediaType;
+import javax.ws.rs.core.Response;
+import javax.ws.rs.core.UriInfo;
+import java.util.HashMap;
+import java.util.Map;
+
+import static org.apache.knox.gateway.util.knoxidf.KnoxIDFConstants.BASE_RESOURCE_PATH;
+import static org.apache.knox.gateway.util.knoxidf.KnoxIDFConstants.TOKEN_EXCHANGE_TOPOLOGY_NAME;
+
+@Path(BASE_RESOURCE_PATH + "/.well-known/openid-configuration")
+@Produces(MediaType.APPLICATION_JSON)
+public class DiscoveryResource {
+ private String currentTopologyName;
+ private String tokenExchangeTopologyName;
+
+ @Context
+ private ServletContext servletContext;
+
+ @PostConstruct
+ public void init() {
+ tokenExchangeTopologyName = servletContext.getInitParameter(TOKEN_EXCHANGE_TOPOLOGY_NAME);
+ currentTopologyName = (String) servletContext.getAttribute(GatewayServices.GATEWAY_CLUSTER_ATTRIBUTE);
+ }
+
+ @GET
+ public Response getConfig(@Context UriInfo uriInfo) {
+ final String baseUrl = uriInfo.getBaseUri().toString();
+ final Map config = new HashMap<>();
+ config.put("issuer", baseUrl + "knoxidf");
+ config.put("authorization_endpoint", baseUrl + AuthorizeResource.RESOURCE_PATH);
+ String tokenEndpoint = baseUrl + TokenResource.RESOURCE_PATH;
+ String userInfoEndpoint = baseUrl + UserInfoResource.RESOURCE_PATH;
+ if (tokenExchangeTopologyName != null) {
+ // Literal substitution: the topology name is data, not a regex. replaceAll would treat
+ // any regex metacharacter in the topology name as a pattern.
+ tokenEndpoint = tokenEndpoint.replace(currentTopologyName, tokenExchangeTopologyName);
+ userInfoEndpoint = userInfoEndpoint.replace(currentTopologyName, tokenExchangeTopologyName);
+ }
+ config.put("token_endpoint", tokenEndpoint);
+ config.put("userinfo_endpoint", userInfoEndpoint);
+ // Dynamic client registration is served on the current topology (no token-exchange
+ // substitution); advertise it so clients can discover it per OIDC Dynamic Client Registration.
+ config.put("registration_endpoint", baseUrl + RegistrationResource.RESOURCE_PATH + "/register");
+ config.put("jwks_uri", baseUrl + JwksResource.RESOURCE_PATH);
+ config.put("response_types_supported", new String[]{KnoxIDFConstants.CODE});
+ // REQUIRED by OpenID Connect Discovery 1.0. Knox derives 'sub' as a deterministic UUIDv5 over
+ // a fixed namespace and the user identity -- the same for every client -- so the subject
+ // identifier type is "public" (not "pairwise").
+ config.put("subject_types_supported", new String[]{"public"});
+ // The token endpoint reads client credentials only from request parameters (no HTTP Basic):
+ // confidential clients send client_secret in the body (client_secret_post); public clients
+ // authenticate with PKCE and no secret ("none"). client_secret_basic is intentionally absent
+ // because it is not honored.
+ config.put("token_endpoint_auth_methods_supported", new String[]{"client_secret_post", "none"});
+ // Explicitly false: Knox does not resolve an HTTPS-URL client_id to a fetched Client ID
+ // Metadata Document (OAuth CIMD draft, referenced by MCP). This is the spec default when the
+ // field is absent, but stating it tells MCP clients to use dynamic client registration
+ // (registration_endpoint) rather than a URL client_id. Flip to true only if CIMD is implemented.
+ config.put("client_id_metadata_document_supported", Boolean.FALSE);
+ config.put("grant_types_supported", new String[]{KnoxIDFConstants.AUTH_CODE, KnoxIDFConstants.REFRESH_TOKEN});
+ config.put("scopes_supported", KnoxIDFConstants.DEFAULT_SCOPES);
+ config.put("id_token_signing_alg_values_supported", new String[]{"RS256"});
+ // Advertise only S256: AuthorizeResource rejects any other code_challenge_method (including
+ // "plain"), so discovery must not claim "plain" support it does not honor.
+ config.put("code_challenge_methods_supported", new String[]{KnoxIDFConstants.PKCE_METHOD_S256});
+ return Response.ok(JsonUtils.renderAsJsonString(config)).build();
+ }
+
+}
diff --git a/gateway-service-knoxidf/src/main/java/org/apache/knox/gateway/service/knoxidf/JwksResource.java b/gateway-service-knoxidf/src/main/java/org/apache/knox/gateway/service/knoxidf/JwksResource.java
new file mode 100644
index 0000000000..1dbca3c8eb
--- /dev/null
+++ b/gateway-service-knoxidf/src/main/java/org/apache/knox/gateway/service/knoxidf/JwksResource.java
@@ -0,0 +1,39 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with this
+ * work for additional information regarding copyright ownership. The ASF
+ * licenses this file to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+ * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+ * License for the specific language governing permissions and limitations under
+ * the License.
+ */
+package org.apache.knox.gateway.service.knoxidf;
+
+import org.apache.knox.gateway.service.knoxtoken.JWKSResource;
+
+import javax.ws.rs.GET;
+import javax.ws.rs.Path;
+import javax.ws.rs.Produces;
+import javax.ws.rs.core.MediaType;
+import javax.ws.rs.core.Response;
+
+import static org.apache.knox.gateway.util.knoxidf.KnoxIDFConstants.BASE_RESOURCE_PATH;
+
+@Path(JwksResource.RESOURCE_PATH)
+@Produces(MediaType.APPLICATION_JSON)
+public class JwksResource extends JWKSResource {
+ static final String RESOURCE_PATH = BASE_RESOURCE_PATH + "/jwks";
+
+ @GET
+ public Response getKeys() {
+ return getJwksResponse();
+ }
+}
+
diff --git a/gateway-service-knoxidf/src/main/java/org/apache/knox/gateway/service/knoxidf/KnoxIDFAudit.java b/gateway-service-knoxidf/src/main/java/org/apache/knox/gateway/service/knoxidf/KnoxIDFAudit.java
new file mode 100644
index 0000000000..62b49cdf29
--- /dev/null
+++ b/gateway-service-knoxidf/src/main/java/org/apache/knox/gateway/service/knoxidf/KnoxIDFAudit.java
@@ -0,0 +1,91 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with this
+ * work for additional information regarding copyright ownership. The ASF
+ * licenses this file to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+ * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+ * License for the specific language governing permissions and limitations under
+ * the License.
+ */
+package org.apache.knox.gateway.service.knoxidf;
+
+import org.apache.commons.lang3.StringUtils;
+import org.apache.knox.gateway.audit.api.AuditServiceFactory;
+import org.apache.knox.gateway.audit.api.Auditor;
+import org.apache.knox.gateway.audit.log4j.audit.AuditConstants;
+import org.apache.knox.gateway.util.Tokens;
+
+/**
+ * Centralized audit emission for the KnoxIDF OAuth2/OIDC endpoints
+ * ({@link AuthorizeResource}, {@link TokenResource}, {@link RegistrationResource},
+ * {@link UserInfoResource}).
+ *
+ * Every security-relevant decision on these endpoints — an authorization request accepted or
+ * rejected, consent shown/granted/denied, an authorization code issued, a code or refresh token
+ * redeemed or replayed, a client registered, a federated callback validated, user info served — is
+ * recorded through this class so the records share a single {@link Auditor} instance, a consistent
+ * action/outcome/resource shape and, crucially, a single masking rule: credentials and full tokens
+ * are NEVER written to the audit log. Token identifiers and JWTs are always passed through
+ * {@link #mask(String)} first, and {@code client_secret}/{@code code_verifier}/raw refresh tokens
+ * are never logged at all.
+ *
+ * The {@link Auditor} field mirrors {@link TrustedOidcIssuersResource}: it is package-private and
+ * non-final so a unit test can inject a capturing mock and assert the emitted record.
+ */
+final class KnoxIDFAudit {
+
+ /** Placeholder used when a resource/subject identifier is absent or cannot be masked. */
+ static final String UNKNOWN = "UNKNOWN";
+
+ /** Placeholder for an unauthenticated caller. */
+ static final String ANONYMOUS = "ANONYMOUS";
+
+ // Non-final and package-private to allow test injection of a mock Auditor (see the sibling
+ // TrustedOidcIssuersResource, which uses the same idiom).
+ static Auditor auditor = AuditServiceFactory.getAuditService()
+ .getAuditor(AuditConstants.DEFAULT_AUDITOR_NAME,
+ AuditConstants.KNOX_SERVICE_NAME, AuditConstants.KNOX_COMPONENT_NAME);
+
+ private KnoxIDFAudit() {
+ }
+
+ /**
+ * Emits an audit record via the shared {@link Auditor}. The {@code resource} is used verbatim, so
+ * callers that pass a token identifier or JWT MUST first mask it with {@link #mask(String)}. A
+ * blank {@code resource} is normalized to {@link #UNKNOWN} because the underlying auditor rejects a
+ * null resource name.
+ */
+ static void audit(final String action, final String resource, final String resourceType,
+ final String outcome, final String message) {
+ auditor.audit(action, StringUtils.isBlank(resource) ? UNKNOWN : resource, resourceType, outcome, message);
+ }
+
+ /**
+ * Masks a token or token identifier for safe logging. A Knox token UUID is rendered via
+ * {@link Tokens#getTokenIDDisplayText(String)} and a JWT via {@link Tokens#getTokenDisplayText(String)};
+ * both keep only a short prefix/suffix so the full secret never reaches the log. Returns
+ * {@link #UNKNOWN} for a blank or unmaskable value. This method never returns the raw input.
+ */
+ static String mask(final String tokenOrId) {
+ if (StringUtils.isBlank(tokenOrId)) {
+ return UNKNOWN;
+ }
+ String display = Tokens.getTokenIDDisplayText(tokenOrId);
+ if (display == null) {
+ display = Tokens.getTokenDisplayText(tokenOrId);
+ }
+ return display == null ? UNKNOWN : display;
+ }
+
+ /** Renders a subject/principal name for logging, mapping a blank/absent principal to {@link #ANONYMOUS}. */
+ static String subjectLabel(final String subject) {
+ return StringUtils.isBlank(subject) ? ANONYMOUS : subject;
+ }
+}
diff --git a/gateway-service-knoxidf/src/main/java/org/apache/knox/gateway/service/knoxidf/OIDCScope.java b/gateway-service-knoxidf/src/main/java/org/apache/knox/gateway/service/knoxidf/OIDCScope.java
new file mode 100644
index 0000000000..d673f3f454
--- /dev/null
+++ b/gateway-service-knoxidf/src/main/java/org/apache/knox/gateway/service/knoxidf/OIDCScope.java
@@ -0,0 +1,66 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with this
+ * work for additional information regarding copyright ownership. The ASF
+ * licenses this file to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+ * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+ * License for the specific language governing permissions and limitations under
+ * the License.
+ */
+package org.apache.knox.gateway.service.knoxidf;
+
+import org.apache.commons.lang3.StringUtils;
+
+import java.util.Arrays;
+import java.util.Collections;
+import java.util.HashSet;
+import java.util.Locale;
+import java.util.Set;
+
+public enum OIDCScope {
+ OPENID(new HashSet<>(Collections.singletonList("sub"))),
+ PROFILE(new HashSet<>(Arrays.asList(
+ "name", "family_name", "given_name",
+ "middle_name", "nickname", "preferred_username",
+ "profile", "picture", "website", "gender",
+ "birthdate", "zoneinfo", "locale", "updated_at"
+ ))),
+ EMAIL(new HashSet<>(Arrays.asList("email", "email_verified"))),
+ ADDRESS(new HashSet<>(Collections.singletonList("address"))),
+ PHONE(new HashSet<>(Arrays.asList("phone_number", "phone_number_verified"))),
+ ROLES(new HashSet<>(Collections.singletonList("roles"))); // custom extension
+
+ private final Set claims;
+
+ OIDCScope(Set claims) {
+ this.claims = Collections.unmodifiableSet(new HashSet<>(claims));
+ }
+
+ public Set getClaims() {
+ return claims;
+ }
+
+ public static Set claimsForScopes(String scopeString) {
+ Set result = new HashSet<>();
+ if (StringUtils.isEmpty(scopeString)) {
+ return result;
+ }
+
+ for (String s : scopeString.split("\\s+")) {
+ try {
+ OIDCScope scope = OIDCScope.valueOf(s.toUpperCase(Locale.US));
+ result.addAll(scope.getClaims());
+ } catch (IllegalArgumentException ignored) {
+ // ignore unknown scopes
+ }
+ }
+ return result;
+ }
+}
diff --git a/gateway-service-knoxidf/src/main/java/org/apache/knox/gateway/service/knoxidf/RegisterIssuerRequest.java b/gateway-service-knoxidf/src/main/java/org/apache/knox/gateway/service/knoxidf/RegisterIssuerRequest.java
new file mode 100644
index 0000000000..eeb83c74f0
--- /dev/null
+++ b/gateway-service-knoxidf/src/main/java/org/apache/knox/gateway/service/knoxidf/RegisterIssuerRequest.java
@@ -0,0 +1,54 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with this
+ * work for additional information regarding copyright ownership. The ASF
+ * licenses this file to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+ * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+ * License for the specific language governing permissions and limitations under
+ * the License.
+ */
+package org.apache.knox.gateway.service.knoxidf;
+
+import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
+
+/**
+ * Request body for registering a trusted OIDC issuer via {@link TrustedOidcIssuersResource#registerIssuer(String)}.
+ */
+@JsonIgnoreProperties(ignoreUnknown = true)
+public class RegisterIssuerRequest {
+
+ private String issuerUrl;
+ private boolean dynamicJwks;
+ private String clusterName;
+
+ public String getIssuerUrl() {
+ return issuerUrl;
+ }
+
+ public void setIssuerUrl(String issuerUrl) {
+ this.issuerUrl = issuerUrl;
+ }
+
+ public boolean isDynamicJwks() {
+ return dynamicJwks;
+ }
+
+ public void setDynamicJwks(boolean dynamicJwks) {
+ this.dynamicJwks = dynamicJwks;
+ }
+
+ public String getClusterName() {
+ return clusterName;
+ }
+
+ public void setClusterName(String clusterName) {
+ this.clusterName = clusterName;
+ }
+}
diff --git a/gateway-service-knoxidf/src/main/java/org/apache/knox/gateway/service/knoxidf/RegistrationResource.java b/gateway-service-knoxidf/src/main/java/org/apache/knox/gateway/service/knoxidf/RegistrationResource.java
new file mode 100644
index 0000000000..1a18e4e868
--- /dev/null
+++ b/gateway-service-knoxidf/src/main/java/org/apache/knox/gateway/service/knoxidf/RegistrationResource.java
@@ -0,0 +1,299 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with this
+ * work for additional information regarding copyright ownership. The ASF
+ * licenses this file to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+ * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+ * License for the specific language governing permissions and limitations under
+ * the License.
+ */
+package org.apache.knox.gateway.service.knoxidf;
+
+import com.nimbusds.jose.KeyLengthException;
+import org.apache.commons.lang3.StringUtils;
+import org.apache.knox.gateway.audit.api.Action;
+import org.apache.knox.gateway.audit.api.ActionOutcome;
+import org.apache.knox.gateway.audit.api.ResourceType;
+import org.apache.knox.gateway.security.SubjectUtils;
+import org.apache.knox.gateway.service.knoxtoken.ClientCredentialsResource;
+import org.apache.knox.gateway.services.ServiceLifecycleException;
+import org.apache.knox.gateway.services.security.AliasServiceException;
+import org.apache.knox.gateway.services.security.token.TokenMetadata;
+import org.glassfish.jersey.process.internal.RequestScoped;
+
+import javax.annotation.PostConstruct;
+import javax.servlet.ServletContext;
+import javax.servlet.ServletException;
+import javax.ws.rs.Consumes;
+import javax.ws.rs.FormParam;
+import javax.ws.rs.GET;
+import javax.ws.rs.POST;
+import javax.ws.rs.Path;
+import javax.ws.rs.core.Context;
+import javax.ws.rs.core.MediaType;
+import javax.ws.rs.core.Response;
+import java.net.URI;
+import java.net.URISyntaxException;
+import java.util.Arrays;
+import java.util.HashSet;
+import java.util.List;
+import java.util.Locale;
+import java.util.Map;
+import java.util.Optional;
+import java.util.Set;
+import java.util.stream.Collectors;
+
+import static org.apache.knox.gateway.util.knoxidf.KnoxIDFConstants.BASE_RESOURCE_PATH;
+import static org.apache.knox.gateway.util.knoxidf.KnoxIDFConstants.CLIENT_REGISTRATION_ALLOWED_SCOPES;
+import static org.apache.knox.gateway.util.knoxidf.KnoxIDFConstants.CLIENT_REGISTRATION_ANONYMOUS_ALLOWED;
+import static org.apache.knox.gateway.util.knoxidf.KnoxIDFConstants.CLIENT_REGISTRATION_CUSTOM_LOOPBACK_HOSTS;
+import static org.apache.knox.gateway.util.knoxidf.KnoxIDFConstants.DEFAULT_SCOPES;
+import static org.apache.knox.gateway.util.knoxidf.KnoxIDFConstants.OIDC_STANDARD_SCOPES;
+import static org.apache.knox.gateway.util.knoxidf.KnoxIDFUtils.error;
+
+@Path(RegistrationResource.RESOURCE_PATH)
+@RequestScoped //this is important because redirectUris/allowedScopes are part of the state of this class
+public class RegistrationResource extends ClientCredentialsResource {
+
+ static final String RESOURCE_PATH = BASE_RESOURCE_PATH + "/client";
+ private static final String ANONYMOUS_PRINCIPAL = "anonymous";
+ static final Set DEFAULT_LOOPBACK_HOSTS = Set.of("localhost", "127.0.0.1", "::1");
+
+ private List redirectUris;
+ private List allowedScopes;
+ boolean anonymousRegistrationAllowed;
+ Set loopbackHosts;
+ Set registerableScopes;
+
+ @Context
+ private ServletContext servletContext;
+
+ @Override
+ public String getPrefix() {
+ return "knoxidf.";
+ }
+
+ @PostConstruct
+ @Override
+ public void init() throws ServletException, AliasServiceException, ServiceLifecycleException, KeyLengthException {
+ super.init();
+ // Secure by default: unless the deployment explicitly opts in, an anonymous caller cannot
+ // register a client even when the topology wires this endpoint as 'anon'.
+ this.anonymousRegistrationAllowed = Boolean.parseBoolean(servletContext.getInitParameter(CLIENT_REGISTRATION_ANONYMOUS_ALLOWED));
+ this.loopbackHosts = parseLoopbackHosts(servletContext.getInitParameter(CLIENT_REGISTRATION_CUSTOM_LOOPBACK_HOSTS));
+ this.registerableScopes = parseRegisterableScopes(servletContext.getInitParameter(CLIENT_REGISTRATION_ALLOWED_SCOPES));
+ }
+
+ // Build the set of scopes a client is permitted to register: the operator-configured whitelist
+ // (comma-separated, trimmed, blanks dropped) or, when unset/blank, the OIDC-standard scope set.
+ // 'openid' is always registerable regardless of the configured value.
+ static Set parseRegisterableScopes(String configured) {
+ if (StringUtils.isBlank(configured)) {
+ return OIDC_STANDARD_SCOPES;
+ }
+ final Set scopes = new HashSet<>();
+ for (String s : configured.split(",")) {
+ final String trimmed = s.trim();
+ if (!trimmed.isEmpty()) {
+ scopes.add(trimmed);
+ }
+ }
+ scopes.add("openid");
+ return scopes;
+ }
+
+ // Build the loopback-host set: the hard-coded defaults plus any admin-configured extra hosts from the
+ // comma-separated config (trimmed, lowercased, blanks dropped). Null/blank config => defaults only.
+ static Set parseLoopbackHosts(String customLoopbackHosts) {
+ if (StringUtils.isBlank(customLoopbackHosts)) {
+ return DEFAULT_LOOPBACK_HOSTS;
+ }
+ final Set hosts = new HashSet<>(DEFAULT_LOOPBACK_HOSTS);
+ for (String h : customLoopbackHosts.split(",")) {
+ final String trimmed = h.trim();
+ if (!trimmed.isEmpty()) {
+ hosts.add(trimmed.toLowerCase(Locale.ROOT));
+ }
+ }
+ return hosts;
+ }
+
+ @Override
+ @GET
+ public Response doGet() {
+ throw new UnsupportedOperationException("Not supported yet.");
+ }
+
+ @Override
+ @POST
+ public Response doPost() {
+ throw new UnsupportedOperationException("Not supported yet.");
+ }
+
+ @Path("/register")
+ @POST
+ @Consumes(MediaType.APPLICATION_FORM_URLENCODED)
+ public Response registerClient(@FormParam("redirect_uris") String redirectUris,
+ @FormParam("allowed_scopes") String allowedScopes) {
+ // Audit the outcome of every dynamic client-registration attempt exactly once, recording the
+ // caller principal and the reason for a rejection. No secret (the minted client_secret) is
+ // ever logged — only that a client was registered.
+ final String caller = KnoxIDFAudit.subjectLabel(SubjectUtils.getCurrentEffectivePrincipalName());
+ String outcome = ActionOutcome.FAILURE;
+ String detail = "reason=unknown";
+ try {
+ if (anonymousRegistrationDenied()) {
+ detail = "reason=anonymous_denied";
+ return error("access_denied", "Anonymous client registration is disabled. Set '"
+ + CLIENT_REGISTRATION_ANONYMOUS_ALLOWED + "' to true in the KNOXIDF service configuration to enable it.");
+ }
+ if (StringUtils.isBlank(redirectUris)) {
+ detail = "reason=missing_redirect_uris";
+ return error("invalid_request", "redirect_uris must be provided");
+ }
+ this.redirectUris = Arrays.asList(redirectUris.split(","));
+ final Response redirectUriVerificationResponse = verifyRedirectUris();
+ if (redirectUriVerificationResponse != null) {
+ detail = "reason=invalid_redirect_uris";
+ return redirectUriVerificationResponse;
+ }
+
+ if (StringUtils.isBlank(allowedScopes)) {
+ // No scopes requested: grant the built-in defaults, bounded by the server-side
+ // whitelist so a narrower operator policy is honored even for the default case.
+ this.allowedScopes = DEFAULT_SCOPES.stream()
+ .filter(registerableScopes::contains)
+ .collect(Collectors.toList());
+ } else {
+ final List requestedScopes = Arrays.asList(allowedScopes.split(","));
+ if (!requestedScopes.contains("openid")) {
+ detail = "reason=invalid_scope";
+ return error("invalid_request", "allowed_scopes must include 'openid'");
+ }
+ // Server-side whitelist: a client cannot self-assign a scope outside the registerable
+ // set, so it cannot mint tokens carrying a privileged scope a downstream service trusts.
+ final Optional disallowedScope = requestedScopes.stream()
+ .map(String::trim)
+ .filter(scope -> !scope.isEmpty())
+ .filter(scope -> !registerableScopes.contains(scope))
+ .findFirst();
+ if (disallowedScope.isPresent()) {
+ detail = "reason=scope_not_registerable";
+ return error("invalid_scope", "Scope '" + disallowedScope.get() + "' is not permitted for registration");
+ }
+ this.allowedScopes = requestedScopes;
+ }
+ final Response response = super.doPost();
+ outcome = ActionOutcome.SUCCESS;
+ detail = "reason=client_registered";
+ return response;
+ } finally {
+ KnoxIDFAudit.audit(Action.AUTHENTICATION, caller, ResourceType.PRINCIPAL, outcome,
+ "event=client_registration " + detail);
+ }
+ }
+
+ /**
+ * @return {@code true} when the request must be rejected because an anonymous caller is
+ * attempting to register a client while open registration has not been explicitly enabled.
+ */
+ boolean anonymousRegistrationDenied() {
+ return !anonymousRegistrationAllowed && isAnonymousCaller();
+ }
+
+ private boolean isAnonymousCaller() {
+ return ANONYMOUS_PRINCIPAL.equalsIgnoreCase(SubjectUtils.getCurrentEffectivePrincipalName());
+ }
+
+ private Response verifyRedirectUris() {
+ return verifyRedirectUris(redirectUris, loopbackHosts);
+ }
+
+ // Package-private and list-parameterized so the redirect-URI policy (https-only except loopback,
+ // no wildcard host, restricted path/query/fragment wildcards) is unit-testable in isolation.
+ static Response verifyRedirectUris(List redirectUris) {
+ return verifyRedirectUris(redirectUris, DEFAULT_LOOPBACK_HOSTS);
+ }
+
+ // loopbackHosts: normalized (lowercase) hosts allowed to use a plain-HTTP redirect_uri.
+ static Response verifyRedirectUris(List redirectUris, Set loopbackHosts) {
+ if (redirectUris == null || redirectUris.isEmpty()) {
+ return error("invalid_request", "redirect_uris must be provided");
+ }
+
+ for (String uriStr : redirectUris) {
+ URI uri;
+ try {
+ uri = new URI(uriStr);
+ } catch (URISyntaxException e) {
+ return error("invalid_request", "Invalid redirect URI: " + uriStr);
+ }
+
+ // Host check (no wildcard allowed)
+ if (uri.getHost() == null || uri.getHost().contains("*")) {
+ return error("invalid_request", "Wildcard not allowed in host: " + uriStr);
+ }
+
+ // Scheme check: require HTTPS per RFC 8252, allowing plain HTTP only for loopback
+ // (localhost / 127.0.0.1 / ::1) native-app dev. Any other http:// redirect is rejected.
+ final String scheme = uri.getScheme();
+ final boolean https = "https".equalsIgnoreCase(scheme);
+ final boolean loopbackHttp = "http".equalsIgnoreCase(scheme) && isLoopbackHost(uri.getHost(), loopbackHosts);
+ if (!https && !loopbackHttp) {
+ return error("invalid_request", "Redirect URI must use HTTPS (plain HTTP allowed only for localhost): " + uriStr);
+ }
+
+ // Path wildcard check
+ String path = uri.getPath();
+ if (path != null && path.contains("*") && !path.endsWith("*")) {
+ return error("invalid_request", "Wildcard '*' only allowed at end of path: " + uriStr);
+ }
+
+ // Query/fragment check
+ if ((uri.getQuery() != null && uri.getQuery().contains("*")) ||
+ (uri.getFragment() != null && uri.getFragment().contains("*"))) {
+ return error("invalid_request", "Wildcard '*' not allowed in query or fragment: " + uriStr);
+ }
+ }
+ return null;
+ }
+
+ private static boolean isLoopbackHost(String host, Set loopbackHosts) {
+ if (host == null) {
+ return false;
+ }
+ // Strip brackets from an IPv6 literal (e.g. [::1]).
+ final String h = host.startsWith("[") && host.endsWith("]") ? host.substring(1, host.length() - 1) : host;
+ // Exact, case-insensitive match against the single loopback-host set (defaults + configured extras).
+ // No sub/parent-domain widening: only hosts explicitly listed get the plain-HTTP exception.
+ return loopbackHosts.contains(h.toLowerCase(Locale.ROOT));
+ }
+
+ @Override
+ protected void addArbitraryTokenMetadata(TokenMetadata tokenMetadata) {
+ tokenMetadata.add("redirect_uris", getRedirectUris());
+ tokenMetadata.add("allowed_scopes", getAllowedScopes().replaceAll(",", " "));
+ super.addArbitraryTokenMetadata(tokenMetadata);
+ }
+
+ @Override
+ protected void decorateResponseMap(Map responseMap) {
+ responseMap.put("redirect_uris", getRedirectUris());
+ responseMap.put("allowed_scopes", getAllowedScopes());
+ }
+
+ private String getRedirectUris() {
+ return String.join(",", redirectUris);
+ }
+
+ private String getAllowedScopes() {
+ return String.join(",", allowedScopes);
+ }
+}
diff --git a/gateway-service-knoxidf/src/main/java/org/apache/knox/gateway/service/knoxidf/TokenResource.java b/gateway-service-knoxidf/src/main/java/org/apache/knox/gateway/service/knoxidf/TokenResource.java
new file mode 100644
index 0000000000..01e5517ef7
--- /dev/null
+++ b/gateway-service-knoxidf/src/main/java/org/apache/knox/gateway/service/knoxidf/TokenResource.java
@@ -0,0 +1,682 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with this
+ * work for additional information regarding copyright ownership. The ASF
+ * licenses this file to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+ * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+ * License for the specific language governing permissions and limitations under
+ * the License.
+ */
+package org.apache.knox.gateway.service.knoxidf;
+
+import com.nimbusds.jose.KeyLengthException;
+import org.apache.commons.lang3.StringUtils;
+import org.apache.knox.gateway.audit.api.Action;
+import org.apache.knox.gateway.audit.api.ActionOutcome;
+import org.apache.knox.gateway.audit.api.ResourceType;
+import org.apache.knox.gateway.config.GatewayConfig;
+import org.apache.knox.gateway.service.knoxidf.userparams.UserParamsProvider;
+import org.apache.knox.gateway.service.knoxidf.userparams.UserParamsProviderFactory;
+import org.apache.knox.gateway.service.knoxtoken.PasscodeTokenResourceBase;
+import org.apache.knox.gateway.services.GatewayServices;
+import org.apache.knox.gateway.services.ServiceLifecycleException;
+import org.apache.knox.gateway.services.ServiceType;
+import org.apache.knox.gateway.services.knoxidf.federation.FederatedIdentity;
+import org.apache.knox.gateway.services.knoxidf.federation.FederatedIdentityService;
+import org.apache.knox.gateway.services.security.AliasService;
+import org.apache.knox.gateway.services.security.AliasServiceException;
+import org.apache.knox.gateway.services.security.token.JWTokenAttributesBuilder;
+import org.apache.knox.gateway.services.security.token.JWTokenAuthority;
+import org.apache.knox.gateway.services.security.token.TokenMetadata;
+import org.apache.knox.gateway.services.security.token.TokenMetadataType;
+import org.apache.knox.gateway.services.security.token.TokenServiceException;
+import org.apache.knox.gateway.services.security.token.TokenUtils;
+import org.apache.knox.gateway.services.security.token.UnknownTokenException;
+import org.apache.knox.gateway.services.security.token.impl.JWT;
+import org.apache.knox.gateway.services.security.token.impl.TokenMAC;
+import org.apache.knox.gateway.util.ServletRequestUtils;
+
+import javax.annotation.PostConstruct;
+import javax.servlet.ServletContext;
+import javax.servlet.ServletException;
+import javax.servlet.http.HttpServletRequest;
+import javax.ws.rs.POST;
+import javax.ws.rs.Path;
+import javax.ws.rs.Produces;
+import javax.ws.rs.core.Context;
+import javax.ws.rs.core.MediaType;
+import javax.ws.rs.core.Response;
+import java.nio.charset.StandardCharsets;
+import java.security.MessageDigest;
+import java.security.NoSuchAlgorithmException;
+import java.text.ParseException;
+import java.util.Base64;
+import java.util.HashMap;
+import java.util.Map;
+
+import static org.apache.knox.gateway.security.CommonTokenConstants.CLIENT_SECRET;
+import static org.apache.knox.gateway.security.CommonTokenConstants.GRANT_TYPE;
+import static org.apache.knox.gateway.util.knoxidf.KnoxIDFConstants.AUTH_CODE;
+import static org.apache.knox.gateway.util.knoxidf.KnoxIDFConstants.BASE_RESOURCE_PATH;
+import static org.apache.knox.gateway.util.knoxidf.KnoxIDFConstants.CLIENT_ID;
+import static org.apache.knox.gateway.util.knoxidf.KnoxIDFConstants.CODE;
+import static org.apache.knox.gateway.util.knoxidf.KnoxIDFConstants.CODE_CHALLENGE;
+import static org.apache.knox.gateway.util.knoxidf.KnoxIDFConstants.CODE_CHALLENGE_METHOD;
+import static org.apache.knox.gateway.util.knoxidf.KnoxIDFConstants.CODE_VERIFIER;
+import static org.apache.knox.gateway.util.knoxidf.KnoxIDFConstants.FEDERATED_IDENTITY_ID;
+import static org.apache.knox.gateway.util.knoxidf.KnoxIDFConstants.OFFLINE_ACCESS_SCOPE;
+import static org.apache.knox.gateway.util.knoxidf.KnoxIDFConstants.PKCE_METHOD_S256;
+import static org.apache.knox.gateway.util.knoxidf.KnoxIDFConstants.REDIRECT_URI;
+import static org.apache.knox.gateway.util.knoxidf.KnoxIDFConstants.REFRESH_TOKEN;
+import static org.apache.knox.gateway.util.knoxidf.KnoxIDFConstants.REFRESH_TOKEN_TTL;
+import static org.apache.knox.gateway.util.knoxidf.KnoxIDFConstants.REFRESH_TOKEN_TTL_DEFAULT;
+import static org.apache.knox.gateway.util.knoxidf.KnoxIDFConstants.SCOPE;
+import static org.apache.knox.gateway.util.knoxidf.KnoxIDFUtils.error;
+
+@Path(TokenResource.RESOURCE_PATH)
+@Produces(MediaType.APPLICATION_JSON)
+public class TokenResource extends PasscodeTokenResourceBase {
+ static final String RESOURCE_PATH = BASE_RESOURCE_PATH + "/token";
+
+ // Per-request stash for the auth-code TokenMetadata read during validation. The code is
+ // atomically consumed (deleted) BEFORE token issuance to close the replay window, so the
+ // issuance steps (buildUserContext/addArbitraryTokenMetadata/buildResponseMap) can no longer
+ // re-read it from the store; they read this request attribute instead. This resource is a
+ // singleton, but the @Context request is a per-request proxy, so the attribute is request-scoped.
+ private static final String AUTH_CODE_METADATA_ATTR = "knoxidf.authCode.metadata";
+
+ // Per-request stash for the federated identity id of the current grant. On the authorization_code
+ // grant it is read from the auth-code metadata; on the refresh_token grant it is restored from the
+ // presented refresh token's metadata (see handleRefreshToken). This lets id_token generation keep
+ // emitting federated profile claims, and lets the rotated refresh token carry the id forward, so
+ // federated claims survive an arbitrary number of refresh rotations.
+ private static final String FEDERATED_IDENTITY_ID_ATTR = "knoxidf.federatedIdentityId";
+
+ private UserParamsProvider userParamsProvider;
+
+ @Context
+ HttpServletRequest request; // package-private for test injection; @Context injection is reflective
+
+ @Context
+ private ServletContext servletContext;
+
+ private FederatedIdentityService federatedIdentityService;
+ private long refreshTokenTTL;
+ TokenMAC tokenMAC;
+
+ @Override
+ public String getPrefix() {
+ return "knoxidf.";
+ }
+
+ @PostConstruct
+ @Override
+ public void init() throws ServletException, AliasServiceException, ServiceLifecycleException, KeyLengthException {
+ super.init();
+ this.servletContext = wrapContextForDefaultParams(this.servletContext);
+ this.userParamsProvider = UserParamsProviderFactory.getUserParamsProvider(servletContext);
+ final GatewayServices services = (GatewayServices) servletContext.getAttribute(GatewayServices.GATEWAY_SERVICES_ATTRIBUTE);
+ federatedIdentityService = services.getService(ServiceType.KNOXIDF_FEDERATED_IDENTITY_SERVICE);
+ // Build the same passcode MAC the JWTFederationFilter uses so the token endpoint can
+ // independently authenticate a client_secret (see validateAuthCode). The HMAC key alias is
+ // guaranteed to exist by this point (PasscodeTokenResourceBase#setupTokenStateService
+ // generates it if absent).
+ final GatewayConfig gatewayConfig = (GatewayConfig) servletContext.getAttribute(GatewayConfig.GATEWAY_CONFIG_ATTRIBUTE);
+ final AliasService aliasService = services.getService(ServiceType.ALIAS_SERVICE);
+ this.tokenMAC = new TokenMAC(gatewayConfig.getKnoxTokenHashAlgorithm(), aliasService.getPasswordFromAliasForGateway(TokenMAC.KNOX_TOKEN_HASH_KEY_ALIAS_NAME));
+ setRefreshTokenTTL();
+ }
+
+ private void setRefreshTokenTTL() {
+ final String configuredRefreshTokenTTL = servletContext.getInitParameter(REFRESH_TOKEN_TTL);
+ if (StringUtils.isNotBlank(configuredRefreshTokenTTL)) {
+ this.refreshTokenTTL = Long.parseLong(configuredRefreshTokenTTL);
+ } else {
+ refreshTokenTTL = REFRESH_TOKEN_TTL_DEFAULT;
+ }
+ }
+
+ @Override
+ @POST
+ public Response doPost() {
+ final String grantType = getRequestParam(GRANT_TYPE);
+ if (REFRESH_TOKEN.equals(grantType)) {
+ return handleRefreshToken();
+ } else if (AUTH_CODE.equals(grantType)) {
+ return handleAuthorizationCodeFlow();
+ }
+ return super.doPost(); // with this, we don't need an additional KNOXTOKEN service in any KnoxIDF topology
+ }
+
+ private boolean isAuthCodeFlow() {
+ return isAuthCodeFlow(getRequestParam(GRANT_TYPE));
+ }
+
+ private boolean isAuthCodeFlow(String grantType) {
+ return AUTH_CODE.equals(grantType);
+ }
+
+ private boolean isRefreshTokenFlow() {
+ return REFRESH_TOKEN.equals(getRequestParam(GRANT_TYPE));
+ }
+
+ @Override
+ protected UserContext buildUserContext(HttpServletRequest request) {
+ if (isAuthCodeFlow()) {
+ try {
+ final TokenMetadata tokenMetadata = getAuthCodeMetadata();
+ final String scope = tokenMetadata.getMetadata(SCOPE);
+ final Map userParams = userParamsProvider.getParamsFor(tokenMetadata.getUserName(), scope);
+ userParams.put(SCOPE, scope);
+ return new UserContext(tokenMetadata.getUserName(), null, userParams);
+ } catch (UnknownTokenException e) {
+ //this should not happen as we have just validated the auth code
+ throw new RuntimeException(e);
+ }
+ }
+ return super.buildUserContext(request);
+ }
+
+ @Override
+ protected void addArbitraryTokenMetadata(TokenMetadata tokenMetadata) {
+ super.addArbitraryTokenMetadata(tokenMetadata);
+ if (isAuthCodeFlow()) {
+ try {
+ final String code = getRequestParam(CODE);
+ if (StringUtils.isNotBlank(code)) {
+ final TokenMetadata authCodeTokenMetadata = getAuthCodeMetadata();
+
+ //if the auth code token was a result of a federated OIDC call, we need to save the associated
+ //federated identity ID in the JWT too (so that it can be looked up while fetching user info)
+ final String federatedIdentityId = authCodeTokenMetadata.getMetadata(FEDERATED_IDENTITY_ID);
+ if (StringUtils.isNotBlank(federatedIdentityId)) {
+ tokenMetadata.add(FEDERATED_IDENTITY_ID, federatedIdentityId);
+ }
+ }
+ } catch (UnknownTokenException e) {
+ //this should not happen as we have just validated the auth code
+ throw new RuntimeException(e);
+ }
+ }
+ }
+
+ @Override
+ protected ResponseMap buildResponseMap(JWT token, long expires) throws TokenServiceException {
+ final ResponseMap responseMap = super.buildResponseMap(token, expires);
+
+ // id_token + refresh-token rotation apply to the user-centric grants (authorization_code and
+ // refresh_token). client_credentials and other grants routed to super.doPost() must not get an
+ // id_token (no end user) and never carry offline_access, so they are excluded here.
+ if (isAuthCodeFlow() || isRefreshTokenFlow()) {
+ final String code = getRequestParam(CODE);
+ TokenMetadata authCodeTokenMetadata = null;
+ if (StringUtils.isNotBlank(code)) {
+ try {
+ authCodeTokenMetadata = getAuthCodeMetadata();
+ } catch (UnknownTokenException e) {
+ //NOP
+ }
+ }
+
+ responseMap.map.put("id_token", generateIdToken(token, authCodeTokenMetadata));
+
+ final String refreshToken = generateRefreshToken(token);
+ if (StringUtils.isNotBlank(refreshToken)) {
+ responseMap.map.put(REFRESH_TOKEN, refreshToken);
+ }
+ }
+
+ return responseMap;
+ }
+
+ // Package-private for testability (the single-use rotation guard is exercised by
+ // TokenResourceRefreshTokenRotationTest); not part of the public resource API.
+ Response handleRefreshToken() {
+ // Audit the outcome of every refresh_token grant exactly once. The resource is the masked
+ // client_id; the masked refresh-token id and a reason are recorded in the message. The raw
+ // refresh token and client_secret are never logged.
+ final String clientId = getRequestParam(CLIENT_ID);
+ String maskedRefreshTokenId = KnoxIDFAudit.UNKNOWN;
+ String outcome = ActionOutcome.FAILURE;
+ String detail = "reason=unknown";
+ try {
+ final String refreshTokenParam = getRequestParam(REFRESH_TOKEN);
+ final String refreshTokenId = TokenUtils.getTokenId(refreshTokenParam);
+ maskedRefreshTokenId = KnoxIDFAudit.mask(refreshTokenId);
+ final TokenMetadata refreshTokenMetadata = tokenStateService.getTokenMetadata(refreshTokenId);
+ validateRefreshTokenGrant(refreshTokenParam, refreshTokenId, refreshTokenMetadata);
+
+ // Rotation is single-use: atomically consume (revoke) the presented refresh token BEFORE
+ // issuing its replacement. consumeToken is an atomic claim -- exactly one of N concurrent
+ // redemptions wins -- so two concurrent refreshes cannot both mint a new token pair from
+ // the same refresh token. (DefaultTokenStateService otherwise has a check-then-act race in
+ // revokeToken; the JDBC path is already atomic via a PK DELETE.) A lost claim means another
+ // request already redeemed/rotated this token, so reject it as invalid_grant. This mirrors
+ // the consume-before-issue guard on the authorization_code grant (see handleAuthorizationCodeFlow).
+ if (!tokenStateService.consumeToken(refreshTokenId)) {
+ detail = "reason=refresh_token_replayed";
+ return error("invalid_grant", "Refresh token has already been redeemed");
+ }
+
+ // Valid, freshly-consumed refresh token -> issue new access token and new refresh token (rotation)
+ final String userName = refreshTokenMetadata.getUserName();
+ final String scope = refreshTokenMetadata.getMetadata(SCOPE);
+ final Map userParams = userParamsProvider.getParamsFor(userName, scope);
+ userParams.put(SCOPE, scope);
+
+ // Restore the federated identity id (if any) so id_token generation keeps the federated
+ // profile claims and the rotated refresh token carries the id forward for the next refresh.
+ final String federatedIdentityId = refreshTokenMetadata.getMetadata(FEDERATED_IDENTITY_ID);
+ if (StringUtils.isNotBlank(federatedIdentityId)) {
+ request.setAttribute(FEDERATED_IDENTITY_ID_ATTR, federatedIdentityId);
+ }
+
+ // Build new tokens
+ final UserContext userContext = new UserContext(userName, null, userParams);
+ final TokenResponseContext resp = getTokenResponse(userContext);
+ outcome = ActionOutcome.SUCCESS;
+ detail = "reason=rotated";
+ return resp.build();
+ } catch (ParseException e) {
+ detail = "reason=malformed_refresh_token";
+ return error("invalid_grant", "Malformed refresh_token");
+ } catch (UnknownTokenException e) {
+ detail = "reason=unknown_refresh_token";
+ return error("invalid_grant", "Unknown refresh_token");
+ } catch (RefreshTokenValidationError e) {
+ detail = "reason=validation_failed";
+ return error("invalid_grant", e.getMessage());
+ } finally {
+ KnoxIDFAudit.audit(Action.AUTHENTICATION, KnoxIDFAudit.mask(clientId), ResourceType.PRINCIPAL,
+ outcome, "event=token_grant grant_type=refresh_token refresh_token_id="
+ + maskedRefreshTokenId + " " + detail);
+ }
+ }
+
+ // Package-private for testability (client-authentication on the refresh grant is exercised by
+ // TokenResourceRefreshTokenClientAuthTest); not part of the public resource API.
+ void validateRefreshTokenGrant(String refreshTokenParam, String refreshTokenId, TokenMetadata refreshTokenMetadata) throws UnknownTokenException, RefreshTokenValidationError {
+ final String clientId = getRequestParam(CLIENT_ID);
+
+ if (StringUtils.isBlank(refreshTokenParam)) {
+ throw new RefreshTokenValidationError("Invalid request: Missing refresh_token");
+ }
+
+ if (StringUtils.isBlank(clientId)) {
+ throw new RefreshTokenValidationError("Invalid request: Missing client_id");
+ }
+
+ if (refreshTokenMetadata == null || !TokenMetadataType.REFRESH_TOKEN.name().equals(refreshTokenMetadata.getType())) {
+ throw new RefreshTokenValidationError("Invalid grant: invalid refresh_token");
+ }
+
+ // A refresh token that has been administratively disabled (revoked) must not mint new tokens,
+ // even if it has not yet expired.
+ if (!refreshTokenMetadata.isEnabled()) {
+ throw new RefreshTokenValidationError("Invalid grant: refresh_token disabled");
+ }
+
+ if (tokenStateService.getTokenExpiration(refreshTokenId) <= System.currentTimeMillis()) {
+ throw new RefreshTokenValidationError("Invalid grant: Refresh token expired");
+ }
+
+ final String associatedClientId = refreshTokenMetadata.getMetadata(CLIENT_ID);
+ if (!clientId.equals(associatedClientId)) {
+ throw new RefreshTokenValidationError("Invalid grant: client_id mismatch");
+ }
+
+ // Client authentication (RFC 6749 §6, §10.4). Like the authorization_code grant
+ // (see validateAuthCode), the refresh_token grant must independently prove client identity:
+ // the JWTFederationFilter Bearer path forwards a request to this endpoint without checking
+ // client_secret, so matching client_id alone would let anyone holding a stolen refresh token
+ // redeem and rotate it. KnoxIDF issues every registered client a client_secret, so a
+ // constant-time client_secret check against the stored passcode is required here.
+ if (!isValidClientSecret(clientId, getRequestParam(CLIENT_SECRET))) {
+ throw new RefreshTokenValidationError("Invalid grant: client authentication failed");
+ }
+ }
+
+ // Package-private for testability (single-use replay guard is exercised by
+ // TokenResourceAuthCodeReplayTest); not part of the public resource API.
+ Response handleAuthorizationCodeFlow() {
+ final String code = getRequestParam(CODE);
+ final String redirectUri = getRequestParam(REDIRECT_URI);
+ // Audit the outcome of every authorization_code grant exactly once. The resource is the masked
+ // client_id; the masked auth-code id and a reason are recorded in the message. The raw code,
+ // code_verifier and client_secret are never logged.
+ final String clientId = getRequestParam(CLIENT_ID);
+ String outcome = ActionOutcome.FAILURE;
+ String detail = "reason=unknown";
+ try {
+ final TokenMetadata authCodeMetadata;
+ try {
+ authCodeMetadata = validateAuthCode(code, redirectUri);
+ } catch (AuthTokenValidationError e) {
+ detail = "reason=validation_failed";
+ return error("invalid_grant", e.getMessage());
+ }
+
+ // Enforce single-use: atomically consume the code BEFORE issuing any token. Of N concurrent
+ // redemptions of the same code, exactly one wins the consume and proceeds; the losers get
+ // invalid_grant. This closes the replay window that existed when the code was only revoked
+ // in a finally block AFTER issuance. A code that fails validation above is deliberately NOT
+ // consumed here, so replaying with bad params cannot burn a victim's still-valid code.
+ if (!tokenStateService.consumeToken(code)) {
+ detail = "reason=code_replayed";
+ return error("invalid_grant", "Authorization code has already been redeemed");
+ }
+
+ // The code is now gone from the store; hand the already-validated metadata to the issuance
+ // path via a request attribute (see getAuthCodeMetadata) so it need not re-read the code.
+ request.setAttribute(AUTH_CODE_METADATA_ATTR, authCodeMetadata);
+ final Response response = getAuthenticationToken();
+ outcome = ActionOutcome.SUCCESS;
+ detail = "reason=tokens_issued";
+ return response;
+ } finally {
+ KnoxIDFAudit.audit(Action.AUTHENTICATION, KnoxIDFAudit.mask(clientId), ResourceType.PRINCIPAL,
+ outcome, "event=token_grant grant_type=authorization_code code=" + KnoxIDFAudit.mask(code)
+ + " " + detail);
+ }
+ }
+
+ /**
+ * Returns the auth-code {@link TokenMetadata} captured at validation time and stashed in a
+ * request attribute by {@link #handleAuthorizationCodeFlow()}. Because the code is consumed
+ * (deleted) before token issuance, the issuance steps can no longer re-read it from the store;
+ * this serves the cached copy, falling back to a store read only if the attribute is absent.
+ */
+ private TokenMetadata getAuthCodeMetadata() throws UnknownTokenException {
+ final Object cached = request.getAttribute(AUTH_CODE_METADATA_ATTR);
+ if (cached instanceof TokenMetadata) {
+ return (TokenMetadata) cached;
+ }
+ return tokenStateService.getTokenMetadata(getRequestParam(CODE));
+ }
+
+ // Resolves the federated identity id for the current grant, or null for a local (non-federated)
+ // user. On the authorization_code grant it comes from the auth-code metadata; on the refresh_token
+ // grant it is restored from the presented refresh token's metadata via a request attribute
+ // (see handleRefreshToken). This keeps federated profile claims flowing through every refresh.
+ private String resolveFederatedIdentityId() {
+ if (isAuthCodeFlow()) {
+ try {
+ return getAuthCodeMetadata().getMetadata(FEDERATED_IDENTITY_ID);
+ } catch (UnknownTokenException e) {
+ //this should not happen as we have just validated the auth code
+ throw new RuntimeException(e);
+ }
+ }
+ final Object cached = request.getAttribute(FEDERATED_IDENTITY_ID_ATTR);
+ return cached == null ? null : cached.toString();
+ }
+
+ private TokenMetadata validateAuthCode(String code, String redirectUri) throws AuthTokenValidationError {
+ try {
+ if (code == null || code.isEmpty()) {
+ throw new AuthTokenValidationError("Invalid request: missing code");
+ }
+
+ if (redirectUri == null || redirectUri.isEmpty()) {
+ throw new AuthTokenValidationError("Invalid request: missing redirect_uri");
+ }
+
+ final TokenMetadata authCodeTokenMetadata = tokenStateService.getTokenMetadata(code);
+ final String associateRedirectUri = authCodeTokenMetadata.getMetadata(REDIRECT_URI);
+ if (!authCodeTokenMetadata.isAuthCode()) {
+ throw new AuthTokenValidationError("Invalid auth_code: not an auth code token");
+ } else if (tokenStateService.getTokenExpiration(code) <= System.currentTimeMillis()) {
+ throw new AuthTokenValidationError("Invalid auth_code: expired");
+ } else if (!associateRedirectUri.equals(redirectUri)) {
+ throw new AuthTokenValidationError("Invalid redirect_uri: " + redirectUri);
+ }
+
+ final String associatedClientId = authCodeTokenMetadata.getMetadata(CLIENT_ID);
+ final String clientId = getRequestParam(CLIENT_ID);
+ if (!associatedClientId.equals(clientId)) {
+ throw new AuthTokenValidationError("Invalid client_id: " + clientId);
+ }
+
+ // Client authentication (defense in depth). A stolen auth code must not be redeemable by
+ // a party that merely holds some valid Knox JWT: the JWTProvider (JWTFederationFilter)
+ // Bearer path forwards such a request to this endpoint without ever checking
+ // client_secret. So the token endpoint independently binds the redemption to the
+ // legitimate client here. The caller must prove client identity via EITHER:
+ // - PKCE: a code_verifier matching the challenge stored at authorize time (S256), or
+ // - the client's client_secret (constant-time compared against the stored passcode).
+ // A code is rejected when neither is satisfiable.
+ final String codeChallenge = authCodeTokenMetadata.getMetadata(CODE_CHALLENGE);
+ if (StringUtils.isNotBlank(codeChallenge)) {
+ final String codeChallengeMethod = authCodeTokenMetadata.getMetadata(CODE_CHALLENGE_METHOD);
+ final String codeVerifier = getRequestParam(CODE_VERIFIER);
+ if (StringUtils.isBlank(codeVerifier)) {
+ throw new AuthTokenValidationError("Missing code_verifier");
+ }
+ if (!validatePKCE(codeVerifier, codeChallenge, codeChallengeMethod)) {
+ throw new AuthTokenValidationError("Invalid code_verifier");
+ }
+ } else if (!isValidClientSecret(clientId, getRequestParam(CLIENT_SECRET))) {
+ throw new AuthTokenValidationError("Invalid client authentication");
+ }
+ return authCodeTokenMetadata;
+ } catch (UnknownTokenException e) {
+ throw new AuthTokenValidationError("Unknown auth_code");
+ }
+ }
+
+ /**
+ * Authenticates a confidential client on the token endpoint by validating the presented
+ * {@code client_secret} against the stored passcode of the client identified by {@code clientId}.
+ *
+ * The wire format of {@code client_secret} matches what registration returns and what
+ * {@link org.apache.knox.gateway.provider.federation.jwt.filter.JWTFederationFilter} expects:
+ * {@code Base64(Base64(tokenId)::Base64(rawPasscode))}. The embedded {@code tokenId} must equal
+ * {@code clientId}, and {@code HMAC(tokenId, issueTime, userName, rawPasscode)} must equal the
+ * stored passcode hash. The comparison is constant-time.
+ *
+ * @return {@code true} only if the secret is well-formed, bound to {@code clientId}, and matches.
+ */
+ boolean isValidClientSecret(final String clientId, final String clientSecret) {
+ if (StringUtils.isBlank(clientId) || StringUtils.isBlank(clientSecret)) {
+ return false;
+ }
+ try {
+ final String[] tokenIdAndPasscode = decodeBase64(clientSecret).split("::");
+ if (tokenIdAndPasscode.length != 2) {
+ return false;
+ }
+ final String tokenId = decodeBase64(tokenIdAndPasscode[0]);
+ final String rawPasscode = decodeBase64(tokenIdAndPasscode[1]);
+ // The client_secret must belong to exactly the client redeeming the code.
+ if (!tokenId.equals(clientId)) {
+ return false;
+ }
+ final TokenMetadata clientMetadata = tokenStateService.getTokenMetadata(tokenId);
+ final String storedPasscode = clientMetadata == null ? null : clientMetadata.getPasscode();
+ if (StringUtils.isBlank(storedPasscode)) {
+ return false;
+ }
+ final long issueTime = tokenStateService.getTokenIssueTime(tokenId);
+ final String userName = clientMetadata.getUserName();
+ final byte[] computed = tokenMAC.hash(tokenId, issueTime, userName, rawPasscode).getBytes(StandardCharsets.UTF_8);
+ return MessageDigest.isEqual(computed, storedPasscode.getBytes(StandardCharsets.UTF_8));
+ } catch (UnknownTokenException | RuntimeException e) {
+ return false;
+ }
+ }
+
+ private String decodeBase64(final String value) {
+ return new String(Base64.getDecoder().decode(value.getBytes(StandardCharsets.UTF_8)), StandardCharsets.UTF_8);
+ }
+
+ private boolean validatePKCE(String codeVerifier, String codeChallenge, String method) {
+ // Only S256 is supported. 'plain' provides no protection and is rejected (the authorize
+ // endpoint already refuses to store a non-S256 challenge; this is defense in depth).
+ if (PKCE_METHOD_S256.equals(method)) {
+ try {
+ return generateS256Challenge(codeVerifier).equals(codeChallenge);
+ } catch (NoSuchAlgorithmException e) {
+ return false;
+ }
+ }
+ return false;
+ }
+
+ private String generateS256Challenge(String codeVerifier) throws NoSuchAlgorithmException {
+ MessageDigest md = MessageDigest.getInstance("SHA-256");
+ byte[] digest = md.digest(codeVerifier.getBytes(StandardCharsets.UTF_8));
+ return Base64.getUrlEncoder().withoutPadding().encodeToString(digest);
+ }
+
+ private String generateIdToken(JWT accessToken, TokenMetadata authCodeTokenMetadata) throws TokenServiceException {
+ // The federated identity id is resolved for the whole grant (auth-code metadata on the
+ // authorization_code grant, restored refresh-token metadata on the refresh_token grant), so a
+ // federated user keeps their profile claims in the id_token across refresh-token rotations.
+ final String federatedIdentityId = resolveFederatedIdentityId();
+
+ if (StringUtils.isNotBlank(federatedIdentityId)) {
+ // client_id and nonce live on the auth-code metadata for the authorization_code grant; on
+ // the refresh_token grant there is no auth-code metadata, so client_id comes from the
+ // request and there is no nonce to echo (nonce binds the original authorization request).
+ final String clientId = authCodeTokenMetadata != null
+ ? authCodeTokenMetadata.getMetadata(CLIENT_ID) : getRequestParam(CLIENT_ID);
+ final String nonce = authCodeTokenMetadata != null ? authCodeTokenMetadata.getMetadata("nonce") : null;
+ return generateFederatedIdToken(accessToken, federatedIdentityId, clientId, nonce);
+ } else {
+ return generateLocalIdToken(accessToken, authCodeTokenMetadata);
+ }
+ }
+
+ private String generateFederatedIdToken(JWT accessToken, String fedIdentityId, String clientId, String nonce) throws TokenServiceException {
+ final FederatedIdentity federatedIdentity = federatedIdentityService
+ .findById(fedIdentityId)
+ .orElseThrow(() -> new TokenServiceException("Federated identity not found"));
+
+ final JWTokenAttributesBuilder builder = new JWTokenAttributesBuilder();
+ builder.setAlgorithm(accessToken.getSignatureAlgorithm().getName())
+ .setUserName(federatedIdentity.getUserId())
+ .setIssueTime(System.currentTimeMillis())
+ .setExpires(Long.parseLong(accessToken.getExpires()))
+ .setIssuer(accessToken.getIssuer())
+ .setAudiences(clientId);
+
+ final Map claims = new HashMap<>(federatedIdentity.getAttributes());
+ claims.keySet().retainAll(AuthorizeResource.ALLOWED_CLAIMS);
+ if (StringUtils.isNotBlank(nonce)) {
+ claims.put("nonce", nonce);
+ }
+
+ // Optional: indicate source for auditing/logging
+ claims.put("federated_idp", federatedIdentity.getProvider());
+ claims.put("federated_sub", federatedIdentity.getExternalSubject());
+ claims.put("federated_iss", federatedIdentity.getExternalIssuer());
+
+ builder.setCustomAttributes(claims);
+
+ return issueToken(builder).toString();
+ }
+
+ private String generateLocalIdToken(JWT accessToken, TokenMetadata authCodeTokenMetadata) throws TokenServiceException {
+ final JWTokenAttributesBuilder idTokenAttributesBuilder = new JWTokenAttributesBuilder();
+ idTokenAttributesBuilder
+ .setAlgorithm(accessToken.getSignatureAlgorithm().getName())
+ .setUserName(accessToken.getSubject())
+ .setIssueTime(System.currentTimeMillis())
+ .setExpires(Long.parseLong(accessToken.getExpires()))
+ .setIssuer(accessToken.getIssuer());
+
+ if (authCodeTokenMetadata != null) {
+ final String associatedClientId = authCodeTokenMetadata.getMetadata("client_id");
+ idTokenAttributesBuilder.setAudiences(associatedClientId);
+ final String nonce = authCodeTokenMetadata.getMetadata("nonce");
+ if (StringUtils.isNotBlank(nonce)) {
+ idTokenAttributesBuilder.setCustomAttributes(Map.of("nonce", nonce));
+ }
+ } else {
+ // If there is no auth code (e.g. refresh token grant), we use the client_id from the request
+ idTokenAttributesBuilder.setAudiences(getRequestParam(CLIENT_ID));
+ }
+
+ return issueToken(idTokenAttributesBuilder).toString();
+ }
+
+ private String generateRefreshToken(JWT accessToken) throws TokenServiceException {
+ final String scope = (String) accessToken.getJWTClaimsSet().getClaim(SCOPE);
+ if (StringUtils.isNotBlank(scope) && scope.contains(OFFLINE_ACCESS_SCOPE)) {
+ return issueRefreshToken(accessToken, scope);
+ } else {
+ return null;
+ }
+ }
+
+ private String issueRefreshToken(JWT accessToken, String scope) throws TokenServiceException {
+ final JWTokenAttributesBuilder refreshTokenAttributesBuilder = new JWTokenAttributesBuilder();
+
+ final long issueTime = System.currentTimeMillis();
+ final long expires = issueTime + refreshTokenTTL;
+ final String clientId = getRequestParam(CLIENT_ID);
+
+ refreshTokenAttributesBuilder.setIssuer(accessToken.getIssuer())
+ .setUserName(accessToken.getSubject())
+ .setAlgorithm(accessToken.getSignatureAlgorithm().getName())
+ .setAudiences(clientId)
+ .setIssueTime(issueTime)
+ .setExpires(expires)
+ .setManaged(tokenStateService != null)
+ .setType(TokenMetadataType.REFRESH_TOKEN.name());
+
+ final JWT refreshToken = issueToken(refreshTokenAttributesBuilder);
+
+ if (tokenStateService != null) {
+ final String tokenId = TokenUtils.getTokenId(refreshToken);
+ tokenStateService.addToken(tokenId, issueTime, expires, tokenStateService.getDefaultMaxLifetimeDuration());
+ final TokenMetadata metadata = new TokenMetadata(refreshToken.getSubject());
+ metadata.setType(TokenMetadataType.REFRESH_TOKEN);
+ metadata.add("client_id", clientId);
+ metadata.add("scope", scope);
+ // Carry the federated identity id onto the refresh token so that, after rotation, the
+ // refresh_token grant can still emit federated profile claims in the id_token (the rotated
+ // token has no auth code to read the id back from). Blank/absent for local users.
+ final String federatedIdentityId = resolveFederatedIdentityId();
+ if (StringUtils.isNotBlank(federatedIdentityId)) {
+ metadata.add(FEDERATED_IDENTITY_ID, federatedIdentityId);
+ }
+ tokenStateService.addMetadata(tokenId, metadata);
+ }
+
+ return refreshToken.toString();
+ }
+
+ private JWT issueToken(final JWTokenAttributesBuilder builder) throws TokenServiceException {
+ final JWTokenAuthority ts = getGatewayServices().getService(ServiceType.TOKEN_SERVICE);
+ return ts.issueToken(builder.build());
+ }
+
+ private String getRequestParam(String paramName) {
+ String requestParamValue = request.getParameter(paramName);
+ if (requestParamValue == null) {
+ requestParamValue = ServletRequestUtils.unwrapHttpServletRequest(request).getParameter(paramName);
+ }
+ return requestParamValue;
+ }
+
+ private static class AuthTokenValidationError extends Exception {
+ AuthTokenValidationError(String message) {
+ super(message);
+ }
+ }
+
+ // Package-private so TokenResourceRefreshTokenClientAuthTest can assert the specific failure type.
+ static class RefreshTokenValidationError extends Exception {
+ RefreshTokenValidationError(String message) {
+ super(message);
+ }
+ }
+}
diff --git a/gateway-service-knoxidf/src/main/java/org/apache/knox/gateway/service/knoxidf/TrustedOidcIssuersResource.java b/gateway-service-knoxidf/src/main/java/org/apache/knox/gateway/service/knoxidf/TrustedOidcIssuersResource.java
new file mode 100644
index 0000000000..cbfaff4013
--- /dev/null
+++ b/gateway-service-knoxidf/src/main/java/org/apache/knox/gateway/service/knoxidf/TrustedOidcIssuersResource.java
@@ -0,0 +1,231 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with this
+ * work for additional information regarding copyright ownership. The ASF
+ * licenses this file to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+ * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+ * License for the specific language governing permissions and limitations under
+ * the License.
+ */
+package org.apache.knox.gateway.service.knoxidf;
+
+import com.fasterxml.jackson.databind.ObjectMapper;
+import org.apache.knox.gateway.audit.api.Action;
+import org.apache.knox.gateway.audit.api.ActionOutcome;
+import org.apache.knox.gateway.audit.api.AuditServiceFactory;
+import org.apache.knox.gateway.audit.api.Auditor;
+import org.apache.knox.gateway.audit.api.ResourceType;
+import org.apache.knox.gateway.audit.log4j.audit.AuditConstants;
+import org.apache.knox.gateway.services.GatewayServices;
+import org.apache.knox.gateway.services.ServiceType;
+import org.apache.commons.lang3.StringUtils;
+import org.apache.knox.gateway.services.knoxidf.trustedoidcissuer.TrustedOidcIssuer;
+import org.apache.knox.gateway.services.knoxidf.trustedoidcissuer.TrustedOidcIssuerService;
+import org.apache.knox.gateway.util.JsonUtils;
+
+import javax.annotation.PostConstruct;
+import javax.servlet.ServletContext;
+import javax.servlet.http.HttpServletRequest;
+import javax.ws.rs.Consumes;
+import javax.ws.rs.DELETE;
+import javax.ws.rs.GET;
+import javax.ws.rs.POST;
+import javax.ws.rs.Path;
+import javax.ws.rs.Produces;
+import javax.ws.rs.QueryParam;
+import javax.ws.rs.core.Context;
+import javax.ws.rs.core.MediaType;
+import javax.ws.rs.core.Response;
+import java.io.IOException;
+import java.net.URI;
+import java.net.URISyntaxException;
+import java.security.Principal;
+import java.time.Instant;
+import java.util.LinkedHashMap;
+import java.util.List;
+import java.util.Map;
+import java.util.stream.Collectors;
+
+@Path(TrustedOidcIssuersResource.RESOURCE_PATH)
+@Produces(MediaType.APPLICATION_JSON)
+public class TrustedOidcIssuersResource {
+
+ static final String RESOURCE_PATH = "knoxidf/admin/v1/trusted-oidc-issuers";
+
+ private static final ObjectMapper MAPPER = new ObjectMapper();
+
+ // Non-final and package-private to allow test injection of a mock Auditor.
+ static Auditor auditor = AuditServiceFactory.getAuditService()
+ .getAuditor(AuditConstants.DEFAULT_AUDITOR_NAME,
+ AuditConstants.KNOX_SERVICE_NAME, AuditConstants.KNOX_COMPONENT_NAME);
+
+ @Context
+ private ServletContext servletContext;
+
+ @Context
+ private HttpServletRequest request;
+
+ private TrustedOidcIssuerService trustedIssuers;
+
+ @PostConstruct
+ public void init() {
+ final GatewayServices services = (GatewayServices)
+ servletContext.getAttribute(GatewayServices.GATEWAY_SERVICES_ATTRIBUTE);
+ trustedIssuers = services.getService(ServiceType.TRUSTED_OIDC_ISSUER_SERVICE);
+ }
+
+ @POST
+ @Consumes(MediaType.APPLICATION_JSON)
+ public Response registerIssuer(String body) {
+ String issuerUrl = "INVALID_REQUEST";
+ final String operatorId = getOperatorId();
+ String outcome = ActionOutcome.FAILURE;
+
+ try {
+ final RegisterIssuerRequest parsed;
+ try {
+ parsed = MAPPER.readValue(body, RegisterIssuerRequest.class);
+ } catch (IOException e) {
+ return errorResponse(Response.Status.BAD_REQUEST, "invalid_request",
+ "Malformed or invalid JSON body");
+ }
+
+ final String rawUrl = parsed.getIssuerUrl();
+ issuerUrl = (rawUrl != null && !rawUrl.isEmpty()) ? rawUrl : "UNKNOWN_ISSUER";
+
+ if (rawUrl == null || rawUrl.isEmpty()) {
+ return errorResponse(Response.Status.BAD_REQUEST, "invalid_request", "issuerUrl is required");
+ }
+ if (!isHttpsUrl(rawUrl)) {
+ return errorResponse(Response.Status.BAD_REQUEST, "invalid_request",
+ "issuerUrl must use HTTPS scheme");
+ }
+ if (trustedIssuers.isTrusted(rawUrl)) {
+ return errorResponse(Response.Status.CONFLICT, "issuer_exists",
+ "Issuer already registered: " + rawUrl);
+ }
+
+ trustedIssuers.register(new TrustedOidcIssuer(rawUrl, parsed.isDynamicJwks(),
+ parsed.getClusterName(), Instant.now(), operatorId));
+ outcome = ActionOutcome.SUCCESS;
+ return Response.status(Response.Status.CREATED).build();
+ } catch (IllegalStateException e) {
+ // The service throws IllegalStateException when the configured maximum number of
+ // registered issuers (MAX_TRUSTED_ISSUERS) is reached. This is an operator-facing
+ // capacity condition, distinct from an internal storage failure, so report it as a
+ // 409 rather than lumping it into the generic 500 storage_error path below.
+ return errorResponse(Response.Status.CONFLICT, "issuer_limit_reached",
+ "Maximum number of registered trusted issuers reached");
+ } catch (RuntimeException e) {
+ return errorResponse(Response.Status.INTERNAL_SERVER_ERROR, "storage_error",
+ "Failed to register issuer");
+ } finally {
+ auditor.audit(Action.DELEGATION_LIFECYCLE, issuerUrl, ResourceType.TRUSTED_ISSUER,
+ outcome, "event_type=issuer_registered performed_by=" + auditLabel(operatorId));
+ }
+ }
+
+ @DELETE
+ public Response removeIssuer(@QueryParam("issuerUrl") String issuerUrl) {
+ final String operatorId = getOperatorId();
+ final String auditIssuerUrl = StringUtils.isBlank(issuerUrl) ? "UNKNOWN_ISSUER" : issuerUrl;
+ String outcome = ActionOutcome.FAILURE;
+
+ try {
+ if (StringUtils.isBlank(issuerUrl)) {
+ return errorResponse(Response.Status.BAD_REQUEST, "invalid_request",
+ "issuerUrl query parameter is required");
+ }
+
+ // deregister is idempotent at the service layer: it returns silently if the issuer is
+ // not registered. Admins deleting a non-existent issuer receive the same 204 and audit
+ // event as a successful delete — there is no separate 404 path at this layer.
+ trustedIssuers.deregister(issuerUrl);
+ outcome = ActionOutcome.SUCCESS;
+ return Response.noContent().build();
+ } catch (RuntimeException e) {
+ return errorResponse(Response.Status.INTERNAL_SERVER_ERROR, "storage_error",
+ "Failed to remove issuer");
+ } finally {
+ auditor.audit(Action.DELEGATION_LIFECYCLE, auditIssuerUrl, ResourceType.TRUSTED_ISSUER,
+ outcome, "event_type=issuer_removed performed_by=" + auditLabel(operatorId));
+ }
+ }
+
+ @GET
+ public Response listIssuers() {
+ final List> result = trustedIssuers.list().stream()
+ .map(this::issuerToMap)
+ .collect(Collectors.toList());
+ return Response.ok(JsonUtils.renderAsJsonString(result)).build();
+ }
+
+ @POST
+ @Path("/refresh-jwks")
+ public Response refreshJwksUri(@QueryParam("issuerUrl") String issuerUrl) {
+ final String operatorId = getOperatorId();
+ final String auditIssuerUrl = StringUtils.isBlank(issuerUrl) ? "UNKNOWN_ISSUER" : issuerUrl;
+ String outcome = ActionOutcome.FAILURE;
+
+ try {
+ if (StringUtils.isBlank(issuerUrl)) {
+ return errorResponse(Response.Status.BAD_REQUEST, "invalid_request",
+ "issuerUrl query parameter is required");
+ }
+
+ // No-op at the service layer if the issuer is not registered or not configured for
+ // dynamic JWKS; still returns 204 so the caller does not need to check existence first.
+ trustedIssuers.refreshJwksUri(issuerUrl);
+ outcome = ActionOutcome.SUCCESS;
+ return Response.noContent().build();
+ } catch (RuntimeException e) {
+ return errorResponse(Response.Status.INTERNAL_SERVER_ERROR, "storage_error",
+ "Failed to refresh JWKS URI");
+ } finally {
+ auditor.audit(Action.DELEGATION_LIFECYCLE, auditIssuerUrl, ResourceType.TRUSTED_ISSUER,
+ outcome, "event_type=issuer_jwks_refreshed performed_by=" + auditLabel(operatorId));
+ }
+ }
+
+ private String getOperatorId() {
+ final Principal principal = request.getUserPrincipal();
+ return principal != null ? principal.getName() : null;
+ }
+
+ private static String auditLabel(String operatorId) {
+ return operatorId != null ? operatorId : "ANONYMOUS";
+ }
+
+ private Map issuerToMap(TrustedOidcIssuer issuer) {
+ final Map map = new LinkedHashMap<>();
+ map.put("issuerUrl", issuer.getIssuerUrl());
+ map.put("dynamicJwks", issuer.isDynamicJwks());
+ map.put("clusterName", issuer.getClusterName());
+ map.put("registeredAt",
+ issuer.getRegisteredAt() != null ? issuer.getRegisteredAt().toString() : null);
+ map.put("registeredBy", issuer.getRegisteredBy());
+ return map;
+ }
+
+ private static boolean isHttpsUrl(String url) {
+ try {
+ return "https".equalsIgnoreCase(new URI(url).getScheme());
+ } catch (URISyntaxException e) {
+ return false;
+ }
+ }
+
+ private static Response errorResponse(Response.Status status, String error, String description) {
+ final Map body = new LinkedHashMap<>();
+ body.put("error", error);
+ body.put("error_description", description);
+ return Response.status(status).entity(JsonUtils.renderAsJsonString(body)).build();
+ }
+}
diff --git a/gateway-service-knoxidf/src/main/java/org/apache/knox/gateway/service/knoxidf/UserInfoResource.java b/gateway-service-knoxidf/src/main/java/org/apache/knox/gateway/service/knoxidf/UserInfoResource.java
new file mode 100644
index 0000000000..320f797859
--- /dev/null
+++ b/gateway-service-knoxidf/src/main/java/org/apache/knox/gateway/service/knoxidf/UserInfoResource.java
@@ -0,0 +1,173 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with this
+ * work for additional information regarding copyright ownership. The ASF
+ * licenses this file to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+ * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+ * License for the specific language governing permissions and limitations under
+ * the License.
+ */
+package org.apache.knox.gateway.service.knoxidf;
+
+
+import org.apache.commons.lang3.StringUtils;
+import org.apache.knox.gateway.audit.api.Action;
+import org.apache.knox.gateway.audit.api.ActionOutcome;
+import org.apache.knox.gateway.audit.api.ResourceType;
+import org.apache.knox.gateway.service.knoxidf.userparams.UserParamsProvider;
+import org.apache.knox.gateway.service.knoxidf.userparams.UserParamsProviderFactory;
+import org.apache.knox.gateway.services.GatewayServices;
+import org.apache.knox.gateway.services.ServiceType;
+import org.apache.knox.gateway.services.knoxidf.federation.FederatedIdentity;
+import org.apache.knox.gateway.services.knoxidf.federation.FederatedIdentityService;
+import org.apache.knox.gateway.services.security.token.TokenMetadata;
+import org.apache.knox.gateway.services.security.token.TokenStateService;
+import org.apache.knox.gateway.services.security.token.UnknownTokenException;
+import org.apache.knox.gateway.util.JsonUtils;
+
+import javax.annotation.PostConstruct;
+import javax.servlet.ServletContext;
+import javax.servlet.http.HttpServletRequest;
+import javax.ws.rs.GET;
+import javax.ws.rs.Path;
+import javax.ws.rs.Produces;
+import javax.ws.rs.core.Context;
+import javax.ws.rs.core.MediaType;
+import javax.ws.rs.core.Response;
+import java.util.HashMap;
+import java.util.Map;
+import java.util.stream.Collectors;
+
+import static org.apache.knox.gateway.util.knoxidf.KnoxIDFConstants.BASE_RESOURCE_PATH;
+import static org.apache.knox.gateway.util.knoxidf.KnoxIDFConstants.SCOPE_ATTRIBUTE;
+import static org.apache.knox.gateway.util.knoxidf.KnoxIDFConstants.TOKEN_ID_ATTRIBUTE;
+import static org.apache.knox.gateway.util.knoxidf.KnoxIDFUtils.error;
+
+
+@Path(UserInfoResource.RESOURCE_PATH)
+@Produces(MediaType.APPLICATION_JSON)
+public class UserInfoResource {
+
+ static final String RESOURCE_PATH = BASE_RESOURCE_PATH + "/userinfo";
+ private UserParamsProvider userParamsProvider;
+
+ @Context
+ private ServletContext servletContext;
+
+ @Context
+ HttpServletRequest request;
+
+ private FederatedIdentityService federatedIdentityService;
+
+ @PostConstruct
+ public void init() {
+ this.userParamsProvider = UserParamsProviderFactory.getUserParamsProvider(servletContext);
+ final GatewayServices services = (GatewayServices) servletContext.getAttribute(GatewayServices.GATEWAY_SERVICES_ATTRIBUTE);
+ federatedIdentityService = services.getService(ServiceType.KNOXIDF_FEDERATED_IDENTITY_SERVICE);
+ }
+
+ public Response doGet() {
+ return getUserInfo();
+ }
+
+ public Response doPost() {
+ throw new UnsupportedOperationException();
+ }
+
+ @GET
+ @Produces(MediaType.APPLICATION_JSON)
+ public Response getUserInfo() {
+ final String tokenId = request.getAttribute(TOKEN_ID_ATTRIBUTE) == null ? null : request.getAttribute(TOKEN_ID_ATTRIBUTE).toString();
+ // Audit the outcome of every /userinfo access exactly once. The resource is the masked
+ // bearer-token id (never the raw token); the reason distinguishes the failure modes.
+ String outcome = ActionOutcome.FAILURE;
+ String detail = "reason=unknown";
+ try {
+ if (tokenId == null) {
+ detail = "reason=missing_token_id";
+ return error("invalid_request", "Cannot find tokenId");
+ }
+
+ final String scope = request.getAttribute(SCOPE_ATTRIBUTE) == null ? "" : request.getAttribute(SCOPE_ATTRIBUTE).toString();
+ final TokenMetadata tokenMetadata;
+ try {
+ tokenMetadata = getReadonlyTokenStateService().getTokenMetadata(tokenId);
+ } catch (UnknownTokenException e) {
+ // Expired, revoked, or otherwise unknown bearer token. Per RFC 6750 the protected
+ // resource must answer 401 with a WWW-Authenticate: Bearer error="invalid_token"
+ // challenge rather than leaking a 500 for what is a client authentication failure.
+ detail = "reason=invalid_token";
+ return invalidToken("The access token is expired, revoked, or unknown");
+ }
+ final Map userInfo = new HashMap<>();
+
+ // Check if this token has a federated identity
+ final String federatedIdentityId = tokenMetadata.getMetadata("federated_identity_id");
+
+ if (StringUtils.isNotBlank(federatedIdentityId)) {
+ // Federated user
+ final FederatedIdentity federatedIdentity = federatedIdentityService
+ .findById(federatedIdentityId)
+ .orElse(null);
+ if (federatedIdentity == null) {
+ // The token references a federated identity that no longer exists; the bearer token
+ // can no longer be honored, so answer with the RFC 6750 invalid_token challenge.
+ detail = "reason=unknown_federated_identity";
+ return invalidToken("The access token references an unknown federated identity");
+ }
+
+ // Include only allowed claims
+ Map claims = federatedIdentity.getAttributes().entrySet().stream()
+ .filter(e -> AuthorizeResource.ALLOWED_CLAIMS.contains(e.getKey()))
+ .collect(Collectors.toMap(Map.Entry::getKey, Map.Entry::getValue));
+
+ // Mandatory claims for OIDC
+ claims.put("sub", federatedIdentity.getUserId()); // internal Knox subject
+ claims.put("idp", federatedIdentity.getProvider());
+
+ // Optional: federated info for auditing
+ claims.put("federated_sub", federatedIdentity.getExternalSubject());
+ claims.put("federated_iss", federatedIdentity.getExternalIssuer());
+
+ // Note: nonce is deliberately NOT returned here. Per OIDC it belongs in the id_token
+ // only; echoing it from the UserInfo endpoint is a spec violation and serves no purpose.
+
+ userInfo.putAll(claims);
+ } else {
+ // Local Knox user
+ userInfo.putAll(userParamsProvider.getParamsFor(tokenMetadata.getUserName(), scope));
+ }
+
+ outcome = ActionOutcome.SUCCESS;
+ detail = "reason=served";
+ return Response.ok(JsonUtils.renderAsJsonString(userInfo, true)).build();
+ } finally {
+ KnoxIDFAudit.audit(Action.ACCESS, KnoxIDFAudit.mask(tokenId), ResourceType.URI, outcome,
+ "event=userinfo " + detail);
+ }
+ }
+
+ TokenStateService getReadonlyTokenStateService() {
+ GatewayServices services = (GatewayServices) servletContext.getAttribute(GatewayServices.GATEWAY_SERVICES_ATTRIBUTE);
+ return services.getService(ServiceType.TOKEN_STATE_SERVICE);
+ }
+
+ /**
+ * Builds the RFC 6750 §3 response for a bad bearer token: HTTP 401 with a
+ * {@code WWW-Authenticate: Bearer error="invalid_token"} challenge and a matching JSON body.
+ */
+ static Response invalidToken(final String description) {
+ final Response base = error("invalid_token", description, Response.Status.UNAUTHORIZED);
+ final String challenge = "Bearer error=\"invalid_token\", error_description=\"" + description + "\"";
+ return Response.fromResponse(base).header("WWW-Authenticate", challenge).build();
+ }
+
+}
+
diff --git a/gateway-service-knoxidf/src/main/java/org/apache/knox/gateway/service/knoxidf/deploy/KnoxIDFAdminServiceDeploymentContributor.java b/gateway-service-knoxidf/src/main/java/org/apache/knox/gateway/service/knoxidf/deploy/KnoxIDFAdminServiceDeploymentContributor.java
new file mode 100644
index 0000000000..639027e8bb
--- /dev/null
+++ b/gateway-service-knoxidf/src/main/java/org/apache/knox/gateway/service/knoxidf/deploy/KnoxIDFAdminServiceDeploymentContributor.java
@@ -0,0 +1,55 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with this
+ * work for additional information regarding copyright ownership. The ASF
+ * licenses this file to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+ * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+ * License for the specific language governing permissions and limitations under
+ * the License.
+ */
+package org.apache.knox.gateway.service.knoxidf.deploy;
+
+import org.apache.knox.gateway.jersey.JerseyServiceDeploymentContributorBase;
+
+/**
+ * Deployment contributor for the KNOXIDF_ADMIN service role, which hosts all
+ * KnoxIDF admin REST APIs under a single {@code knoxidf/admin/**?**} URL pattern.
+ * Current resources: {@link org.apache.knox.gateway.service.knoxidf.TrustedOidcIssuersResource}.
+ *
+ *
The {@code knoxidf/admin/**?**} pattern is disjoint from the KNOXIDF role's
+ * {@code knoxidf/api/**?**} pattern, preventing KNOXIDF from serving admin endpoints.
+ *
+ * Authorization: use {@code PathAclsAuthz} in the topology to assign independent
+ * ACLs to each admin endpoint (e.g., {@code KNOXIDF_ADMIN.rule_issuers.path.acl}
+ * for trusted-issuers). Alternatively, {@code AclsAuthz} with {@code KNOXIDF_ADMIN.acl}
+ * applies a single ACL to all endpoints under this role.
+ */
+public class KnoxIDFAdminServiceDeploymentContributor extends JerseyServiceDeploymentContributorBase {
+
+ @Override
+ public String getRole() {
+ return "KNOXIDF_ADMIN";
+ }
+
+ @Override
+ public String getName() {
+ return "KNOXIDF_ADMIN";
+ }
+
+ @Override
+ protected String[] getPackages() {
+ return new String[] { "org.apache.knox.gateway.service.knoxidf" };
+ }
+
+ @Override
+ protected String[] getPatterns() {
+ return new String[] { "knoxidf/admin/**?**" };
+ }
+}
diff --git a/gateway-service-knoxidf/src/main/java/org/apache/knox/gateway/service/knoxidf/deploy/KnoxIDFServiceDeploymentContributor.java b/gateway-service-knoxidf/src/main/java/org/apache/knox/gateway/service/knoxidf/deploy/KnoxIDFServiceDeploymentContributor.java
new file mode 100644
index 0000000000..cfbb4647cb
--- /dev/null
+++ b/gateway-service-knoxidf/src/main/java/org/apache/knox/gateway/service/knoxidf/deploy/KnoxIDFServiceDeploymentContributor.java
@@ -0,0 +1,42 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with this
+ * work for additional information regarding copyright ownership. The ASF
+ * licenses this file to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+ * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+ * License for the specific language governing permissions and limitations under
+ * the License.
+ */
+package org.apache.knox.gateway.service.knoxidf.deploy;
+
+import org.apache.knox.gateway.jersey.JerseyServiceDeploymentContributorBase;
+
+public class KnoxIDFServiceDeploymentContributor extends JerseyServiceDeploymentContributorBase {
+
+ @Override
+ public String getRole() {
+ return "KNOXIDF";
+ }
+
+ @Override
+ public String getName() {
+ return "KnoxIdentityFederation";
+ }
+
+ @Override
+ protected String[] getPackages() {
+ return new String[] { "org.apache.knox.gateway.service.knoxidf" };
+ }
+
+ @Override
+ protected String[] getPatterns() {
+ return new String[] { "knoxidf/api/**?**" };
+ }
+}
diff --git a/gateway-service-knoxidf/src/main/java/org/apache/knox/gateway/service/knoxidf/userparams/EmptyUserParamsProvider.java b/gateway-service-knoxidf/src/main/java/org/apache/knox/gateway/service/knoxidf/userparams/EmptyUserParamsProvider.java
new file mode 100644
index 0000000000..f39d3eb772
--- /dev/null
+++ b/gateway-service-knoxidf/src/main/java/org/apache/knox/gateway/service/knoxidf/userparams/EmptyUserParamsProvider.java
@@ -0,0 +1,28 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with this
+ * work for additional information regarding copyright ownership. The ASF
+ * licenses this file to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+ * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+ * License for the specific language governing permissions and limitations under
+ * the License.
+ */
+package org.apache.knox.gateway.service.knoxidf.userparams;
+
+import java.util.HashMap;
+import java.util.Map;
+
+public class EmptyUserParamsProvider implements UserParamsProvider {
+
+ @Override
+ public Map getParamsFor(String subjectName, String scope) {
+ return new HashMap<>();
+ }
+}
diff --git a/gateway-service-knoxidf/src/main/java/org/apache/knox/gateway/service/knoxidf/userparams/LdapUserParamsProvider.java b/gateway-service-knoxidf/src/main/java/org/apache/knox/gateway/service/knoxidf/userparams/LdapUserParamsProvider.java
new file mode 100644
index 0000000000..1f78777c30
--- /dev/null
+++ b/gateway-service-knoxidf/src/main/java/org/apache/knox/gateway/service/knoxidf/userparams/LdapUserParamsProvider.java
@@ -0,0 +1,235 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with this
+ * work for additional information regarding copyright ownership. The ASF
+ * licenses this file to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+ * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+ * License for the specific language governing permissions and limitations under
+ * the License.
+ */
+package org.apache.knox.gateway.service.knoxidf.userparams;
+
+import org.apache.knox.gateway.service.knoxidf.OIDCScope;
+import org.apache.knox.gateway.services.GatewayServices;
+import org.apache.knox.gateway.services.ServiceType;
+import org.apache.knox.gateway.services.security.AliasService;
+import org.apache.knox.gateway.services.security.AliasServiceException;
+
+import javax.naming.Context;
+import javax.naming.NamingEnumeration;
+import javax.naming.directory.Attribute;
+import javax.naming.directory.Attributes;
+import javax.naming.directory.SearchControls;
+import javax.naming.directory.SearchResult;
+import javax.naming.ldap.InitialLdapContext;
+import javax.naming.ldap.LdapContext;
+import javax.naming.ldap.Rdn;
+import javax.servlet.ServletContext;
+import java.util.ArrayList;
+import java.util.HashMap;
+import java.util.Hashtable;
+import java.util.List;
+import java.util.Locale;
+import java.util.Map;
+import java.util.Set;
+
+public class LdapUserParamsProvider implements UserParamsProvider {
+ private static final String PREFIX = "user.params.provider.ldap.";
+ static final String LDAP_URL = PREFIX + "url";
+ private static final String LDAP_BASE_DN = PREFIX + "baseDn";
+ private static final String LDAP_USER_DN_TEMPLATE = PREFIX + "userDnTemplate";
+ private static final String LDAP_SYSTEM_USER = PREFIX + "systemUser";
+ private static final String LDAP_SYSTEM_PASSWORD_ALIAS = PREFIX + "systemPasswordAlias";
+
+ // === Defaults point to Knox's demo LDAP ===
+ private static final String DEFAULT_BASE_DN = "dc=hadoop,dc=apache,dc=org";
+ private static final String DEFAULT_USER_DN_TEMPLATE = "uid=%s,ou=people," + DEFAULT_BASE_DN;
+ private static final String DEFAULT_SYSTEM_USER = "uid=admin,ou=people," + DEFAULT_BASE_DN;
+
+ private static final String[] ATTRIBUTES = {"cn", "sn", "givenName", "mail"};
+
+ private final String ldapUrl;
+ private final String ldapBaseDn;
+ private final String ldapUserDnTemplate;
+ private final String ldapSystemUser;
+ private final String ldapSystemPassword;
+
+ LdapUserParamsProvider(ServletContext servletContext) {
+ this.ldapUrl = servletContext.getInitParameter(LDAP_URL);
+ this.ldapBaseDn = getInitParamOrDefault(servletContext, LDAP_BASE_DN, DEFAULT_BASE_DN);
+ this.ldapUserDnTemplate = getInitParamOrDefault(servletContext, LDAP_USER_DN_TEMPLATE, DEFAULT_USER_DN_TEMPLATE);
+ this.ldapSystemUser = getInitParamOrDefault(servletContext, LDAP_SYSTEM_USER, DEFAULT_SYSTEM_USER);
+ this.ldapSystemPassword = getSystemPassword(servletContext);
+ }
+
+ private String getInitParamOrDefault(ServletContext servletContext, String key, String defaultValue) {
+ final String value = servletContext.getInitParameter(key);
+ return value == null ? defaultValue : value;
+ }
+
+ private String getSystemPassword(ServletContext servletContext) {
+ final GatewayServices services = (GatewayServices) servletContext.getAttribute(GatewayServices.GATEWAY_SERVICES_ATTRIBUTE);
+ final AliasService aliasService = services.getService(ServiceType.ALIAS_SERVICE);
+ try {
+ final char[] systemPassword = aliasService.getPasswordFromAliasForGateway(LDAP_SYSTEM_PASSWORD_ALIAS);
+ // No hardcoded fallback: if the alias is absent/unresolvable, return null so the LDAP
+ // bind fails fast rather than silently binding with a well-known demo password.
+ return systemPassword == null ? null : new String(systemPassword);
+ } catch (AliasServiceException e) {
+ return null;
+ }
+ }
+
+ @Override
+ public Map getParamsFor(String subjectName, String scope) {
+ Map userParams = new HashMap<>();
+ if ("anonymous".equalsIgnoreCase(subjectName)) {
+ return userParams;
+ }
+
+ Set requestedClaims = OIDCScope.claimsForScopes(scope);
+
+ LdapContext ctx = null;
+ try {
+ ctx = createSystemContext();
+
+ // Escape the subject before interpolating it into the DN template. Without escaping a
+ // crafted subject (e.g. "x,ou=admins") could inject additional DN components (LDAP
+ // injection). Rdn.escapeValue escapes the RDN value per RFC 2253.
+ String userDn = String.format(Locale.US, ldapUserDnTemplate, Rdn.escapeValue(subjectName));
+
+ SearchControls controls = new SearchControls();
+ controls.setSearchScope(SearchControls.OBJECT_SCOPE);
+ controls.setReturningAttributes(ATTRIBUTES);
+
+ // Always close the enumeration: LdapContext.close() alone does not release the
+ // per-search cursor, so leaking these under load can exhaust server-side resources
+ // and start throwing NamingException. NamingEnumeration is not AutoCloseable, hence
+ // the explicit try/finally rather than try-with-resources.
+ NamingEnumeration results = ctx.search(userDn, "(objectClass=*)", controls);
+ try {
+ if (results.hasMore()) {
+ SearchResult sr = results.next();
+ Attributes attrs = sr.getAttributes();
+
+ // --- OIDC standard claims ---
+ if (requestedClaims.contains("sub")) {
+ userParams.put("sub", subjectName);
+ }
+ if (requestedClaims.contains("name")) {
+ userParams.put("name", getAttr(attrs, "cn"));
+ }
+ if (requestedClaims.contains("family_name")) {
+ userParams.put("family_name", getAttr(attrs, "sn"));
+ }
+ if (requestedClaims.contains("given_name")) {
+ userParams.put("given_name", getAttr(attrs, "givenName"));
+ }
+ if (requestedClaims.contains("email")) {
+ userParams.put("email", getAttr(attrs, "mail"));
+ }
+ if (requestedClaims.contains("email_verified")) {
+ userParams.put("email_verified", Boolean.TRUE);
+ }
+
+ // --- Custom: roles ---
+ if (requestedClaims.contains("roles")) {
+ List roles = fetchRoles(ctx, userDn);
+ userParams.put("roles", roles);
+ }
+ }
+ } finally {
+ closeEnumeration(results);
+ }
+
+ } catch (Exception e) {
+ throw new RuntimeException("Failed to fetch user parameters for " + subjectName, e);
+ } finally {
+ closeContext(ctx);
+ }
+
+ return userParams;
+ }
+
+ private List fetchRoles(LdapContext ctx, String userDn) throws Exception {
+ List roles = new ArrayList<>();
+
+ SearchControls groupControls = new SearchControls();
+ groupControls.setSearchScope(SearchControls.ONELEVEL_SCOPE);
+ groupControls.setReturningAttributes(new String[]{"cn", "member"});
+
+ String groupsBase = "ou=groups," + ldapBaseDn;
+ // Close both the group search cursor and each member enumeration; see getParamsFor.
+ NamingEnumeration groupResults =
+ ctx.search(groupsBase, "(objectClass=groupOfNames)", groupControls);
+ try {
+ while (groupResults.hasMore()) {
+ SearchResult group = groupResults.next();
+ Attributes groupAttrs = group.getAttributes();
+ Attribute members = groupAttrs.get("member");
+ if (members != null) {
+ NamingEnumeration e = members.getAll();
+ try {
+ while (e.hasMore()) {
+ String memberDn = (String) e.next();
+ if (memberDn.equalsIgnoreCase(userDn)) {
+ roles.add(getAttr(groupAttrs, "cn"));
+ break;
+ }
+ }
+ } finally {
+ closeEnumeration(e);
+ }
+ }
+ }
+ } finally {
+ closeEnumeration(groupResults);
+ }
+ return roles;
+ }
+
+ private LdapContext createSystemContext() throws Exception {
+ if (ldapSystemPassword == null) {
+ throw new IllegalStateException("No LDAP system password configured. Set the '"
+ + LDAP_SYSTEM_PASSWORD_ALIAS + "' alias; there is no default password.");
+ }
+ Hashtable env = new Hashtable<>();
+ env.put(Context.INITIAL_CONTEXT_FACTORY, "com.sun.jndi.ldap.LdapCtxFactory");
+ env.put(Context.PROVIDER_URL, ldapUrl);
+ env.put(Context.SECURITY_AUTHENTICATION, "simple");
+ env.put(Context.SECURITY_PRINCIPAL, ldapSystemUser);
+ env.put(Context.SECURITY_CREDENTIALS, ldapSystemPassword);
+ return new InitialLdapContext(env, null);
+ }
+
+ private String getAttr(Attributes attrs, String attrName) throws Exception {
+ Attribute attr = attrs.get(attrName);
+ return attr != null ? (String) attr.get() : null;
+ }
+
+ private void closeContext(LdapContext ctx) {
+ if (ctx != null) {
+ try {
+ ctx.close();
+ } catch (Exception ignored) {
+ }
+ }
+ }
+
+ private void closeEnumeration(NamingEnumeration enumeration) {
+ if (enumeration != null) {
+ try {
+ enumeration.close();
+ } catch (Exception ignored) {
+ }
+ }
+ }
+}
+
diff --git a/gateway-service-knoxidf/src/main/java/org/apache/knox/gateway/service/knoxidf/userparams/UserParamsProvider.java b/gateway-service-knoxidf/src/main/java/org/apache/knox/gateway/service/knoxidf/userparams/UserParamsProvider.java
new file mode 100644
index 0000000000..d052ef0403
--- /dev/null
+++ b/gateway-service-knoxidf/src/main/java/org/apache/knox/gateway/service/knoxidf/userparams/UserParamsProvider.java
@@ -0,0 +1,30 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with this
+ * work for additional information regarding copyright ownership. The ASF
+ * licenses this file to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+ * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+ * License for the specific language governing permissions and limitations under
+ * the License.
+ */
+package org.apache.knox.gateway.service.knoxidf.userparams;
+
+import java.util.Map;
+
+public interface UserParamsProvider {
+
+ /**
+ * Fetches OIDC parameters for the given subject name.
+ *
+ * @param subjectName The user login/ID (e.g., "sam").
+ * @return a map of OIDC parameters (e.g., email, name, roles)
+ */
+ Map getParamsFor(String subjectName, String scope);
+}
diff --git a/gateway-service-knoxidf/src/main/java/org/apache/knox/gateway/service/knoxidf/userparams/UserParamsProviderFactory.java b/gateway-service-knoxidf/src/main/java/org/apache/knox/gateway/service/knoxidf/userparams/UserParamsProviderFactory.java
new file mode 100644
index 0000000000..7cdf319844
--- /dev/null
+++ b/gateway-service-knoxidf/src/main/java/org/apache/knox/gateway/service/knoxidf/userparams/UserParamsProviderFactory.java
@@ -0,0 +1,26 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with this
+ * work for additional information regarding copyright ownership. The ASF
+ * licenses this file to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+ * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+ * License for the specific language governing permissions and limitations under
+ * the License.
+ */
+package org.apache.knox.gateway.service.knoxidf.userparams;
+
+import javax.servlet.ServletContext;
+
+public class UserParamsProviderFactory {
+ public static UserParamsProvider getUserParamsProvider(ServletContext servletContext) {
+ final String ldapUrl = servletContext.getInitParameter(LdapUserParamsProvider.LDAP_URL);
+ return ldapUrl == null ? new EmptyUserParamsProvider() : new LdapUserParamsProvider(servletContext);
+ }
+}
diff --git a/gateway-service-knoxidf/src/main/resources/META-INF/services/org.apache.knox.gateway.deploy.ServiceDeploymentContributor b/gateway-service-knoxidf/src/main/resources/META-INF/services/org.apache.knox.gateway.deploy.ServiceDeploymentContributor
new file mode 100644
index 0000000000..1fca75abb8
--- /dev/null
+++ b/gateway-service-knoxidf/src/main/resources/META-INF/services/org.apache.knox.gateway.deploy.ServiceDeploymentContributor
@@ -0,0 +1,19 @@
+##########################################################################
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements. See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership. The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License. You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+##########################################################################
+org.apache.knox.gateway.service.knoxidf.deploy.KnoxIDFServiceDeploymentContributor
+org.apache.knox.gateway.service.knoxidf.deploy.KnoxIDFAdminServiceDeploymentContributor
diff --git a/gateway-service-knoxidf/src/test/java/org/apache/knox/gateway/service/knoxidf/AuthorizeResourceClientSecretResolutionTest.java b/gateway-service-knoxidf/src/test/java/org/apache/knox/gateway/service/knoxidf/AuthorizeResourceClientSecretResolutionTest.java
new file mode 100644
index 0000000000..3915d7dd78
--- /dev/null
+++ b/gateway-service-knoxidf/src/test/java/org/apache/knox/gateway/service/knoxidf/AuthorizeResourceClientSecretResolutionTest.java
@@ -0,0 +1,54 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with this
+ * work for additional information regarding copyright ownership. The ASF
+ * licenses this file to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+ * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+ * License for the specific language governing permissions and limitations under
+ * the License.
+ */
+package org.apache.knox.gateway.service.knoxidf;
+
+import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertTrue;
+import static org.junit.Assert.fail;
+
+import org.apache.knox.gateway.service.knoxidf.AuthorizeResource.ClientSecretResolutionException;
+import org.junit.Test;
+
+/**
+ * Verifies the fail-closed handling of a configured federated-OP client-secret alias (review
+ * finding M4). When an alias is declared but resolves to nothing, the token exchange must abort
+ * with a clear error and never contact the OP -- previously an unresolvable alias yielded a null
+ * secret that the form encoder serialized to a literal {@code client_secret=null} sent to the OP.
+ */
+public class AuthorizeResourceClientSecretResolutionTest {
+
+ @Test
+ public void testResolvedSecretIsReturned() {
+ final String secret = AuthorizeResource.requireResolvedAliasSecret("op.secret.alias", "s3cr3t".toCharArray());
+ assertEquals("A resolved alias must yield its secret value.", "s3cr3t", secret);
+ }
+
+ @Test
+ public void testUnresolvableAliasFailsClosed() {
+ try {
+ AuthorizeResource.requireResolvedAliasSecret("op.secret.alias", null);
+ fail("A configured-but-unresolvable alias must fail closed, not return null.");
+ } catch (ClientSecretResolutionException e) {
+ assertTrue("The error should name the offending alias.", e.getMessage().contains("op.secret.alias"));
+ }
+ }
+
+ @Test(expected = ClientSecretResolutionException.class)
+ public void testEmptyResolvedSecretFailsClosed() {
+ AuthorizeResource.requireResolvedAliasSecret("op.secret.alias", new char[0]);
+ }
+}
diff --git a/gateway-service-knoxidf/src/test/java/org/apache/knox/gateway/service/knoxidf/AuthorizeResourceFederatedNonceTest.java b/gateway-service-knoxidf/src/test/java/org/apache/knox/gateway/service/knoxidf/AuthorizeResourceFederatedNonceTest.java
new file mode 100644
index 0000000000..0c2ae15771
--- /dev/null
+++ b/gateway-service-knoxidf/src/test/java/org/apache/knox/gateway/service/knoxidf/AuthorizeResourceFederatedNonceTest.java
@@ -0,0 +1,75 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with this
+ * work for additional information regarding copyright ownership. The ASF
+ * licenses this file to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+ * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+ * License for the specific language governing permissions and limitations under
+ * the License.
+ */
+package org.apache.knox.gateway.service.knoxidf;
+
+import static org.apache.knox.gateway.util.knoxidf.KnoxIDFConstants.NONCE;
+import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertNotNull;
+import static org.junit.Assert.assertNull;
+
+import javax.ws.rs.core.Response;
+
+import org.apache.knox.gateway.services.security.token.impl.JWT;
+import org.easymock.EasyMock;
+import org.junit.Test;
+
+/**
+ * Verifies the federated OIDC {@code nonce} binding (review finding H2). Knox mints a nonce for each
+ * federated login session, sends it to the OP, and — once the returned id_token's signature/issuer/
+ * audience have been verified — requires the id_token's {@code nonce} claim to equal that value. This
+ * defeats id_token replay/injection: a token minted for a different (or attacker-initiated) request
+ * carries a different nonce and is rejected.
+ */
+public class AuthorizeResourceFederatedNonceTest {
+
+ private static final String NONCE_VALUE = "6d1c7a90-4b2e-4c1a-9f3d-0a1b2c3d4e5f";
+
+ private static JWT idTokenWithNonce(final String nonce) {
+ final JWT idToken = EasyMock.createNiceMock(JWT.class);
+ EasyMock.expect(idToken.getClaim(NONCE)).andReturn(nonce).anyTimes();
+ EasyMock.replay(idToken);
+ return idToken;
+ }
+
+ @Test
+ public void testMatchingNoncePasses() {
+ final Response result = new AuthorizeResource().verifyFederatedNonce(NONCE_VALUE, idTokenWithNonce(NONCE_VALUE));
+ assertNull("A matching nonce must pass (null == no error).", result);
+ }
+
+ @Test
+ public void testMismatchedNonceIsRejected() {
+ final Response result = new AuthorizeResource().verifyFederatedNonce(NONCE_VALUE, idTokenWithNonce("some-other-nonce"));
+ assertNotNull("A mismatched nonce must be rejected.", result);
+ assertEquals(Response.Status.BAD_REQUEST.getStatusCode(), result.getStatus());
+ }
+
+ @Test
+ public void testMissingClaimInTokenIsRejected() {
+ final Response result = new AuthorizeResource().verifyFederatedNonce(NONCE_VALUE, idTokenWithNonce(null));
+ assertNotNull("An id_token without a nonce claim must be rejected.", result);
+ assertEquals(Response.Status.BAD_REQUEST.getStatusCode(), result.getStatus());
+ }
+
+ @Test
+ public void testMissingExpectedNonceIsRejected() {
+ // No stored nonce (expired/replayed state) must fail closed rather than accept any token.
+ final Response result = new AuthorizeResource().verifyFederatedNonce(null, idTokenWithNonce(NONCE_VALUE));
+ assertNotNull("A missing expected nonce must be rejected.", result);
+ assertEquals(Response.Status.BAD_REQUEST.getStatusCode(), result.getStatus());
+ }
+}
diff --git a/gateway-service-knoxidf/src/test/java/org/apache/knox/gateway/service/knoxidf/AuthorizeResourceFederatedSubjectTest.java b/gateway-service-knoxidf/src/test/java/org/apache/knox/gateway/service/knoxidf/AuthorizeResourceFederatedSubjectTest.java
new file mode 100644
index 0000000000..890abdc01c
--- /dev/null
+++ b/gateway-service-knoxidf/src/test/java/org/apache/knox/gateway/service/knoxidf/AuthorizeResourceFederatedSubjectTest.java
@@ -0,0 +1,68 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with this
+ * work for additional information regarding copyright ownership. The ASF
+ * licenses this file to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+ * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+ * License for the specific language governing permissions and limitations under
+ * the License.
+ */
+package org.apache.knox.gateway.service.knoxidf;
+
+import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertNotNull;
+import static org.junit.Assert.assertNull;
+import static org.junit.Assert.assertTrue;
+
+import javax.ws.rs.core.Response;
+
+import org.apache.knox.gateway.services.security.token.impl.JWT;
+import org.easymock.EasyMock;
+import org.junit.Test;
+
+/**
+ * Verifies that a federated id_token missing the required {@code sub} claim is rejected as a 4xx
+ * client/OP error rather than surfacing as an HTTP 500 (review finding M2). Knox derives the Knox
+ * subject and the federated-identity primary key from {@code sub}, and the identity tables declare
+ * {@code external_subject NOT NULL}; without this guard a broken or hostile OP omitting {@code sub}
+ * drives a NOT NULL insert failure and a 500 on every callback through that OP.
+ */
+public class AuthorizeResourceFederatedSubjectTest {
+
+ private static JWT idTokenWithSubject(final String subject) {
+ final JWT idToken = EasyMock.createNiceMock(JWT.class);
+ EasyMock.expect(idToken.getSubject()).andReturn(subject).anyTimes();
+ EasyMock.replay(idToken);
+ return idToken;
+ }
+
+ @Test
+ public void testPresentSubjectPasses() {
+ final Response result = new AuthorizeResource().requireFederatedSubject(idTokenWithSubject("user-123"));
+ assertNull("An id_token carrying a sub claim must pass (null == no error).", result);
+ }
+
+ @Test
+ public void testMissingSubjectIsRejectedWith4xx() {
+ final Response result = new AuthorizeResource().requireFederatedSubject(idTokenWithSubject(null));
+ assertNotNull("An id_token without a sub claim must be rejected.", result);
+ assertEquals("A missing sub must be a client/OP error, not a 500.",
+ Response.Status.BAD_REQUEST.getStatusCode(), result.getStatus());
+ assertTrue("The error body should identify the invalid_request condition.",
+ String.valueOf(result.getEntity()).contains("invalid_request"));
+ }
+
+ @Test
+ public void testBlankSubjectIsRejectedWith4xx() {
+ final Response result = new AuthorizeResource().requireFederatedSubject(idTokenWithSubject(" "));
+ assertNotNull("An id_token with a blank sub claim must be rejected.", result);
+ assertEquals(Response.Status.BAD_REQUEST.getStatusCode(), result.getStatus());
+ }
+}
diff --git a/gateway-service-knoxidf/src/test/java/org/apache/knox/gateway/service/knoxidf/AuthorizeResourceRedirectUriMatchTest.java b/gateway-service-knoxidf/src/test/java/org/apache/knox/gateway/service/knoxidf/AuthorizeResourceRedirectUriMatchTest.java
new file mode 100644
index 0000000000..01c88eaf9e
--- /dev/null
+++ b/gateway-service-knoxidf/src/test/java/org/apache/knox/gateway/service/knoxidf/AuthorizeResourceRedirectUriMatchTest.java
@@ -0,0 +1,74 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with this
+ * work for additional information regarding copyright ownership. The ASF
+ * licenses this file to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+ * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+ * License for the specific language governing permissions and limitations under
+ * the License.
+ */
+package org.apache.knox.gateway.service.knoxidf;
+
+import static org.junit.Assert.assertFalse;
+import static org.junit.Assert.assertTrue;
+
+import java.util.Collections;
+import java.util.Set;
+
+import org.junit.Test;
+
+/**
+ * Verifies wildcard redirect_uri matching rejects path traversal (review finding M3). A wildcard
+ * registration such as {@code https://app.example/callback/*} must not match
+ * {@code https://app.example/callback/../admin}: a raw startsWith on the un-normalized path would
+ * let the traversal escape the registered prefix and deliver the authorization code to /admin
+ * (a same-host open redirect). The path is normalized before the prefix compare.
+ */
+public class AuthorizeResourceRedirectUriMatchTest {
+
+ private final AuthorizeResource resource = new AuthorizeResource();
+
+ private boolean matches(final String requested, final String registered) {
+ final Set registeredUris = Collections.singleton(registered);
+ return resource.matchesRedirectUri(requested, registeredUris);
+ }
+
+ @Test
+ public void testTraversalEscapingWildcardPrefixIsRejected() {
+ assertFalse("A traversal that resolves outside the registered prefix must be rejected.",
+ matches("https://app.example/callback/../admin", "https://app.example/callback/*"));
+ }
+
+ @Test
+ public void testEncodedPrefixSuffixStillMatches() {
+ assertTrue("A genuine path under the wildcard prefix must still match.",
+ matches("https://app.example/callback/oauth", "https://app.example/callback/*"));
+ }
+
+ @Test
+ public void testExactPrefixMatchesWildcard() {
+ assertTrue("The wildcard base path itself must match.",
+ matches("https://app.example/callback/", "https://app.example/callback/*"));
+ }
+
+ @Test
+ public void testDifferentOriginIsRejected() {
+ assertFalse("A same-prefix path on a different host must be rejected.",
+ matches("https://app.example.evil.com/callback/x", "https://app.example/callback/*"));
+ }
+
+ @Test
+ public void testExact(){
+ assertTrue("An exact non-wildcard registration must match verbatim.",
+ matches("https://app.example/cb", "https://app.example/cb"));
+ assertFalse("An exact registration must not match a different path.",
+ matches("https://app.example/cb2", "https://app.example/cb"));
+ }
+}
diff --git a/gateway-service-knoxidf/src/test/java/org/apache/knox/gateway/service/knoxidf/AuthorizeResourceSuccessRedirectTest.java b/gateway-service-knoxidf/src/test/java/org/apache/knox/gateway/service/knoxidf/AuthorizeResourceSuccessRedirectTest.java
new file mode 100644
index 0000000000..30da0eb254
--- /dev/null
+++ b/gateway-service-knoxidf/src/test/java/org/apache/knox/gateway/service/knoxidf/AuthorizeResourceSuccessRedirectTest.java
@@ -0,0 +1,67 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with this
+ * work for additional information regarding copyright ownership. The ASF
+ * licenses this file to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+ * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+ * License for the specific language governing permissions and limitations under
+ * the License.
+ */
+package org.apache.knox.gateway.service.knoxidf;
+
+import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertTrue;
+
+import java.net.URI;
+import java.util.List;
+
+import org.apache.http.NameValuePair;
+import org.apache.http.client.utils.URLEncodedUtils;
+import org.junit.Test;
+
+/**
+ * Verifies the authorization-code success redirect stays well-formed when the registered
+ * redirect_uri already carries a query string (review finding M7). Appending {@code ?code=...}
+ * unconditionally produced a second {@code ?}, so the client parsed neither code nor state.
+ */
+public class AuthorizeResourceSuccessRedirectTest {
+
+ private static List queryParams(final String location) {
+ return URLEncodedUtils.parse(URI.create(location), java.nio.charset.StandardCharsets.UTF_8);
+ }
+
+ private static String param(final List params, final String name) {
+ return params.stream().filter(p -> p.getName().equals(name)).map(NameValuePair::getValue)
+ .findFirst().orElse(null);
+ }
+
+ @Test
+ public void testRedirectUriWithoutQueryUsesQuestionMark() throws Exception {
+ final String location = AuthorizeResource.buildSuccessRedirect(
+ "https://app.example/cb", "the code", "the state");
+ assertTrue("A redirect_uri without a query must start its params with '?'.",
+ location.startsWith("https://app.example/cb?"));
+ final List params = queryParams(location);
+ assertEquals("the code", param(params, "code"));
+ assertEquals("the state", param(params, "state"));
+ }
+
+ @Test
+ public void testRedirectUriWithExistingQueryUsesAmpersand() throws Exception {
+ final String location = AuthorizeResource.buildSuccessRedirect(
+ "https://app.example/cb?ui=dark", "the code", "the state");
+ // Exactly one '?' -- the code/state must be appended with '&', not a second '?'.
+ assertEquals("There must be exactly one query separator.", 1, location.chars().filter(c -> c == '?').count());
+ final List params = queryParams(location);
+ assertEquals("The pre-existing query param must survive.", "dark", param(params, "ui"));
+ assertEquals("the code", param(params, "code"));
+ assertEquals("the state", param(params, "state"));
+ }
+}
diff --git a/gateway-service-knoxidf/src/test/java/org/apache/knox/gateway/service/knoxidf/ConsentMetadataKeyTest.java b/gateway-service-knoxidf/src/test/java/org/apache/knox/gateway/service/knoxidf/ConsentMetadataKeyTest.java
new file mode 100644
index 0000000000..e4feee4d61
--- /dev/null
+++ b/gateway-service-knoxidf/src/test/java/org/apache/knox/gateway/service/knoxidf/ConsentMetadataKeyTest.java
@@ -0,0 +1,65 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with this
+ * work for additional information regarding copyright ownership. The ASF
+ * licenses this file to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+ * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+ * License for the specific language governing permissions and limitations under
+ * the License.
+ */
+package org.apache.knox.gateway.service.knoxidf;
+
+import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertNotEquals;
+import static org.junit.Assert.assertTrue;
+
+import org.junit.Test;
+
+/**
+ * Verifies the consent metadata key derivation (finding 2.11). Consent is stored in
+ * {@code KNOX_TOKEN_METADATA.md_name VARCHAR(32)}; the key must therefore stay within 32 chars for
+ * every subject, be deterministic (so a later read finds an earlier write), and separate distinct
+ * subjects.
+ */
+public class ConsentMetadataKeyTest {
+
+ /** The backing column is VARCHAR(32). */
+ private static final int MD_NAME_MAX = 32;
+
+ @Test
+ public void testKeyFitsColumnForRealisticSubjects() {
+ final String[] subjects = {
+ "alice",
+ "administrator@corp.example.com",
+ // a federated UUID subject - the case that overflowed the old "consentAccepted_" + subject
+ "b9f8e7d6-c5a4-4321-9876-0123456789abcdef-very-long-external-subject-identifier",
+ "",
+ };
+ for (final String subject : subjects) {
+ final String key = AuthorizeResource.consentMetadataKey(subject);
+ assertTrue("Key '" + key + "' (" + key.length() + " chars) must fit VARCHAR(" + MD_NAME_MAX + ")",
+ key.length() <= MD_NAME_MAX);
+ assertTrue("Key should carry the consent_ prefix", key.startsWith("consent_"));
+ }
+ }
+
+ @Test
+ public void testKeyIsDeterministic() {
+ final String subject = "b9f8e7d6-c5a4-4321-9876-0123456789ab";
+ assertEquals("Same subject must always derive the same key (read must match write).",
+ AuthorizeResource.consentMetadataKey(subject), AuthorizeResource.consentMetadataKey(subject));
+ }
+
+ @Test
+ public void testDistinctSubjectsDeriveDistinctKeys() {
+ assertNotEquals(AuthorizeResource.consentMetadataKey("alice"),
+ AuthorizeResource.consentMetadataKey("bob"));
+ }
+}
diff --git a/gateway-service-knoxidf/src/test/java/org/apache/knox/gateway/service/knoxidf/DiscoveryResourceMetadataTest.java b/gateway-service-knoxidf/src/test/java/org/apache/knox/gateway/service/knoxidf/DiscoveryResourceMetadataTest.java
new file mode 100644
index 0000000000..4f5c906899
--- /dev/null
+++ b/gateway-service-knoxidf/src/test/java/org/apache/knox/gateway/service/knoxidf/DiscoveryResourceMetadataTest.java
@@ -0,0 +1,69 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with this
+ * work for additional information regarding copyright ownership. The ASF
+ * licenses this file to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+ * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+ * License for the specific language governing permissions and limitations under
+ * the License.
+ */
+package org.apache.knox.gateway.service.knoxidf;
+
+import static org.junit.Assert.assertFalse;
+import static org.junit.Assert.assertTrue;
+
+import java.net.URI;
+
+import javax.ws.rs.core.Response;
+import javax.ws.rs.core.UriInfo;
+
+import org.easymock.EasyMock;
+import org.junit.Test;
+
+/**
+ * Verifies the discovery document carries required/expected OIDC provider metadata.
+ * subject_types_supported is REQUIRED by OpenID Connect Discovery 1.0; a strict client or
+ * conformance validator rejects a document that omits it. registration_endpoint must point at the
+ * dynamic client registration resource that KnoxIDF actually serves.
+ */
+public class DiscoveryResourceMetadataTest {
+
+ @Test
+ public void testAdvertisesSubjectTypesAndRegistrationEndpoint() {
+ final UriInfo uriInfo = EasyMock.createNiceMock(UriInfo.class);
+ EasyMock.expect(uriInfo.getBaseUri()).andReturn(URI.create("https://knox:8443/gateway/knoxidf/")).anyTimes();
+ EasyMock.replay(uriInfo);
+
+ final Response response = new DiscoveryResource().getConfig(uriInfo);
+ final String body = String.valueOf(response.getEntity());
+
+ // subject_types_supported is REQUIRED; Knox uses a shared (non-pairwise) subject -> "public".
+ assertTrue("subject_types_supported must be present (REQUIRED by OIDC Discovery).",
+ body.contains("subject_types_supported"));
+ assertTrue("subject_types_supported must advertise 'public'.",
+ body.contains("\"public\""));
+
+ // registration_endpoint must resolve to the dynamic client registration resource.
+ assertTrue("registration_endpoint must point at the /client registration resource.",
+ body.contains("registration_endpoint") && body.contains(RegistrationResource.RESOURCE_PATH));
+
+ // The token endpoint authenticates clients via body params only: client_secret_post + none (PKCE).
+ assertTrue("token_endpoint_auth_methods_supported must advertise client_secret_post and none.",
+ body.contains("token_endpoint_auth_methods_supported")
+ && body.contains("client_secret_post") && body.contains("\"none\""));
+ // It must NOT claim HTTP Basic client auth, which the token endpoint does not read.
+ assertFalse("Discovery must not advertise client_secret_basic, which is not honored.",
+ body.contains("client_secret_basic"));
+
+ // CIMD is not implemented, so it must be advertised explicitly as false (never true).
+ assertTrue("client_id_metadata_document_supported must be present and false.",
+ body.contains("\"client_id_metadata_document_supported\":false"));
+ }
+}
diff --git a/gateway-service-knoxidf/src/test/java/org/apache/knox/gateway/service/knoxidf/DiscoveryResourcePkceMethodsTest.java b/gateway-service-knoxidf/src/test/java/org/apache/knox/gateway/service/knoxidf/DiscoveryResourcePkceMethodsTest.java
new file mode 100644
index 0000000000..dfb1438cf1
--- /dev/null
+++ b/gateway-service-knoxidf/src/test/java/org/apache/knox/gateway/service/knoxidf/DiscoveryResourcePkceMethodsTest.java
@@ -0,0 +1,52 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with this
+ * work for additional information regarding copyright ownership. The ASF
+ * licenses this file to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+ * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+ * License for the specific language governing permissions and limitations under
+ * the License.
+ */
+package org.apache.knox.gateway.service.knoxidf;
+
+import static org.junit.Assert.assertFalse;
+import static org.junit.Assert.assertTrue;
+
+import java.net.URI;
+
+import javax.ws.rs.core.Response;
+import javax.ws.rs.core.UriInfo;
+
+import org.easymock.EasyMock;
+import org.junit.Test;
+
+/**
+ * Verifies discovery advertises only the PKCE methods it actually honors (review finding M8).
+ * AuthorizeResource rejects any code_challenge_method other than S256, so the discovery document
+ * must not list "plain" -- a client that trusts discovery and sends plain would be rejected at
+ * /authorize.
+ */
+public class DiscoveryResourcePkceMethodsTest {
+
+ @Test
+ public void testCodeChallengeMethodsAdvertisesOnlyS256() {
+ final UriInfo uriInfo = EasyMock.createNiceMock(UriInfo.class);
+ EasyMock.expect(uriInfo.getBaseUri()).andReturn(URI.create("https://knox:8443/gateway/knoxidf/")).anyTimes();
+ EasyMock.replay(uriInfo);
+
+ final Response response = new DiscoveryResource().getConfig(uriInfo);
+ final String body = String.valueOf(response.getEntity());
+
+ assertTrue("Discovery must advertise S256 PKCE support.",
+ body.contains("code_challenge_methods_supported") && body.contains("S256"));
+ assertFalse("Discovery must not advertise 'plain' PKCE, which /authorize rejects.",
+ body.contains("plain"));
+ }
+}
diff --git a/gateway-service-knoxidf/src/test/java/org/apache/knox/gateway/service/knoxidf/KnoxIDFAuditTest.java b/gateway-service-knoxidf/src/test/java/org/apache/knox/gateway/service/knoxidf/KnoxIDFAuditTest.java
new file mode 100644
index 0000000000..5e1a25d824
--- /dev/null
+++ b/gateway-service-knoxidf/src/test/java/org/apache/knox/gateway/service/knoxidf/KnoxIDFAuditTest.java
@@ -0,0 +1,280 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with this
+ * work for additional information regarding copyright ownership. The ASF
+ * licenses this file to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+ * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+ * License for the specific language governing permissions and limitations under
+ * the License.
+ */
+package org.apache.knox.gateway.service.knoxidf;
+
+import static org.apache.knox.gateway.security.CommonTokenConstants.CLIENT_SECRET;
+import static org.apache.knox.gateway.security.CommonTokenConstants.GRANT_TYPE;
+import static org.apache.knox.gateway.util.knoxidf.KnoxIDFConstants.CLIENT_ID;
+import static org.apache.knox.gateway.util.knoxidf.KnoxIDFConstants.REFRESH_TOKEN;
+import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertFalse;
+import static org.junit.Assert.assertNotNull;
+import static org.junit.Assert.assertTrue;
+
+import java.lang.reflect.Field;
+import java.nio.charset.StandardCharsets;
+import java.util.ArrayList;
+import java.util.Base64;
+import java.util.HashMap;
+import java.util.List;
+import java.util.concurrent.TimeUnit;
+
+import javax.servlet.http.HttpServletRequest;
+import javax.ws.rs.core.Response;
+
+import org.apache.knox.gateway.audit.api.Action;
+import org.apache.knox.gateway.audit.api.ActionOutcome;
+import org.apache.knox.gateway.audit.api.Auditor;
+import org.apache.knox.gateway.audit.api.CorrelationContext;
+import org.apache.knox.gateway.audit.api.AuditContext;
+import org.apache.knox.gateway.audit.api.ResourceType;
+import org.apache.knox.gateway.service.knoxidf.userparams.UserParamsProvider;
+import org.apache.knox.gateway.services.security.token.TokenMetadata;
+import org.apache.knox.gateway.services.security.token.TokenMetadataType;
+import org.apache.knox.gateway.services.security.token.TokenStateService;
+import org.apache.knox.gateway.services.security.token.impl.TokenMAC;
+import org.easymock.EasyMock;
+import org.junit.After;
+import org.junit.Before;
+import org.junit.Test;
+
+/**
+ * Representative coverage for the KnoxIDF audit instrumentation (structured audit-log completeness).
+ * A capturing {@link Auditor} is injected into {@link KnoxIDFAudit#auditor} so the emitted
+ * action/outcome/resource/message can be asserted for a representative SUCCESS path (a rotated
+ * refresh-token grant) and a representative FAILURE path (a rejected refresh-token grant). It also
+ * pins the security-critical invariant that {@link KnoxIDFAudit#mask(String)} never echoes a raw
+ * secret into the record.
+ */
+public class KnoxIDFAuditTest {
+
+ // A UUID so TokenUtils.getTokenId returns it verbatim (no JWT parsing needed).
+ private static final String REFRESH_TOKEN_ID = "11111111-2222-3333-4444-555555555555";
+ private static final String CLIENT = "client-abc";
+ private static final String USER_NAME = "alice";
+ private static final long ISSUE_TIME = 1_700_000_000_000L;
+ private static final String RAW_PASSCODE = "0f1e2d3c-4b5a-6978-8796-a5b4c3d2e1f0";
+
+ /** Records every thread-local 5-arg audit call so a test can assert what was emitted. */
+ static final class CapturingAuditor implements Auditor {
+ static final class Record {
+ final String action;
+ final String resource;
+ final String resourceType;
+ final String outcome;
+ final String message;
+
+ Record(String action, String resource, String resourceType, String outcome, String message) {
+ this.action = action;
+ this.resource = resource;
+ this.resourceType = resourceType;
+ this.outcome = outcome;
+ this.message = message;
+ }
+ }
+
+ final List records = new ArrayList<>();
+
+ @Override
+ public void audit(String action, String resourceName, String resourceType, String outcome, String message) {
+ records.add(new Record(action, resourceName, resourceType, outcome, message));
+ }
+
+ @Override
+ public void audit(String action, String resourceName, String resourceType, String outcome) {
+ audit(action, resourceName, resourceType, outcome, null);
+ }
+
+ @Override
+ public void audit(CorrelationContext correlationContext, AuditContext auditContext, String action,
+ String resourceName, String resourceType, String outcome, String message) {
+ audit(action, resourceName, resourceType, outcome, message);
+ }
+
+ @Override
+ public String getServiceName() {
+ return "knox";
+ }
+
+ @Override
+ public String getComponentName() {
+ return "knox";
+ }
+
+ @Override
+ public String getAuditorName() {
+ return "audit";
+ }
+ }
+
+ private static final Auditor ORIGINAL_AUDITOR = KnoxIDFAudit.auditor;
+ private CapturingAuditor capturingAuditor;
+
+ @Before
+ public void setUp() {
+ capturingAuditor = new CapturingAuditor();
+ KnoxIDFAudit.auditor = capturingAuditor;
+ }
+
+ @After
+ public void tearDown() {
+ KnoxIDFAudit.auditor = ORIGINAL_AUDITOR;
+ }
+
+ // ---------------------------------------------------------------------------
+ // mask(): never echoes a raw secret; blank/unmaskable -> UNKNOWN
+ // ---------------------------------------------------------------------------
+
+ @Test
+ public void testMaskNeverLeaksRawValue() {
+ final String secret = "supersecret-client-secret-value-1234567890";
+ final String masked = KnoxIDFAudit.mask(secret);
+ assertNotNull(masked);
+ assertFalse("mask() must never return the raw secret", secret.equals(masked));
+ assertFalse("mask() output must not contain the full raw secret", masked.contains(secret));
+ assertTrue("mask() output must be shorter than the raw secret", masked.length() < secret.length());
+ }
+
+ @Test
+ public void testMaskBlankOrTooShortIsUnknown() {
+ assertEquals(KnoxIDFAudit.UNKNOWN, KnoxIDFAudit.mask(null));
+ assertEquals(KnoxIDFAudit.UNKNOWN, KnoxIDFAudit.mask(""));
+ assertEquals(KnoxIDFAudit.UNKNOWN, KnoxIDFAudit.mask(" "));
+ // Too short for Tokens display text -> normalized to UNKNOWN, never the raw value.
+ assertEquals(KnoxIDFAudit.UNKNOWN, KnoxIDFAudit.mask("abc"));
+ }
+
+ // ---------------------------------------------------------------------------
+ // Representative FAILURE: a rejected refresh-token grant on the token endpoint.
+ // (Unknown grant types are no longer rejected here -- doPost() delegates them to
+ // the knoxtoken base, which only issues a token for an already-authenticated caller.)
+ // ---------------------------------------------------------------------------
+
+ @Test
+ public void testRejectedRefreshTokenGrantEmitsFailureAudit() throws Exception {
+ // Missing client_id makes validateRefreshTokenGrant reject the request with invalid_grant,
+ // which must emit exactly one FAILURE audit record for the refresh_token grant.
+ final HttpServletRequest req = EasyMock.createNiceMock(HttpServletRequest.class);
+ EasyMock.expect(req.getParameter(GRANT_TYPE)).andReturn(REFRESH_TOKEN).anyTimes();
+ EasyMock.expect(req.getParameter(REFRESH_TOKEN)).andReturn(REFRESH_TOKEN_ID).anyTimes();
+ EasyMock.expect(req.getParameter(CLIENT_ID)).andReturn(null).anyTimes();
+ EasyMock.replay(req);
+
+ final TokenStateService tokenStateService = EasyMock.createNiceMock(TokenStateService.class);
+ EasyMock.replay(tokenStateService);
+
+ final TestableTokenResource resource = new TestableTokenResource();
+ resource.inject(tokenStateService, null, req, null);
+
+ final Response response = resource.handleRefreshToken();
+
+ assertEquals(Response.Status.BAD_REQUEST.getStatusCode(), response.getStatus());
+ assertEquals("Exactly one audit record must be emitted.", 1, capturingAuditor.records.size());
+ final CapturingAuditor.Record record = capturingAuditor.records.get(0);
+ assertEquals(Action.AUTHENTICATION, record.action);
+ assertEquals(ResourceType.PRINCIPAL, record.resourceType);
+ assertEquals(ActionOutcome.FAILURE, record.outcome);
+ assertTrue(record.message.contains("grant_type=refresh_token"));
+ assertTrue(record.message.contains("reason=validation_failed"));
+ }
+
+ // ---------------------------------------------------------------------------
+ // Representative SUCCESS: a rotated refresh-token grant
+ // ---------------------------------------------------------------------------
+
+ /** Field injection plus a stub for the token-mint step so only the audit emission is under test. */
+ private static final class TestableTokenResource extends TokenResource {
+ void inject(final TokenStateService tss, final TokenMAC mac, final HttpServletRequest req,
+ final UserParamsProvider userParamsProvider) throws Exception {
+ this.tokenStateService = tss;
+ this.tokenMAC = mac;
+ this.request = req;
+ // userParamsProvider is private on TokenResource and normally wired in init(); inject it
+ // directly so the rotation success path can build its UserContext without a servlet context.
+ final Field field = TokenResource.class.getDeclaredField("userParamsProvider");
+ field.setAccessible(true);
+ field.set(this, userParamsProvider);
+ }
+
+ @Override
+ protected TokenResponseContext getTokenResponse(final UserContext context) {
+ return new TokenResponseContext(null, "issued", Response.ok());
+ }
+ }
+
+ private static String wireSecret(final String tokenId, final String rawPasscode) {
+ final String inner = Base64.getEncoder().encodeToString(tokenId.getBytes(StandardCharsets.UTF_8))
+ + "::" + Base64.getEncoder().encodeToString(rawPasscode.getBytes(StandardCharsets.UTF_8));
+ return Base64.getEncoder().encodeToString(inner.getBytes(StandardCharsets.UTF_8));
+ }
+
+ @Test
+ public void testRefreshTokenRotationEmitsSuccessAudit() throws Exception {
+ final TokenMAC tokenMAC = new TokenMAC("HmacSHA256", "0123456789abcdef0123456789abcdef".toCharArray());
+ final String storedPasscodeHash = tokenMAC.hash(CLIENT, ISSUE_TIME, USER_NAME, RAW_PASSCODE);
+
+ final TokenMetadata refreshTokenMetadata = EasyMock.createNiceMock(TokenMetadata.class);
+ EasyMock.expect(refreshTokenMetadata.getType()).andReturn(TokenMetadataType.REFRESH_TOKEN.name()).anyTimes();
+ EasyMock.expect(refreshTokenMetadata.isEnabled()).andReturn(true).anyTimes();
+ EasyMock.expect(refreshTokenMetadata.getMetadata(CLIENT_ID)).andReturn(CLIENT).anyTimes();
+ EasyMock.expect(refreshTokenMetadata.getUserName()).andReturn(USER_NAME).anyTimes();
+ EasyMock.replay(refreshTokenMetadata);
+
+ final TokenMetadata clientMetadata = EasyMock.createNiceMock(TokenMetadata.class);
+ EasyMock.expect(clientMetadata.getUserName()).andReturn(USER_NAME).anyTimes();
+ EasyMock.expect(clientMetadata.getPasscode()).andReturn(storedPasscodeHash).anyTimes();
+ EasyMock.replay(clientMetadata);
+
+ final TokenStateService tokenStateService = EasyMock.createNiceMock(TokenStateService.class);
+ EasyMock.expect(tokenStateService.getTokenMetadata(REFRESH_TOKEN_ID)).andReturn(refreshTokenMetadata).anyTimes();
+ EasyMock.expect(tokenStateService.getTokenExpiration(REFRESH_TOKEN_ID))
+ .andReturn(System.currentTimeMillis() + TimeUnit.MINUTES.toMillis(30)).anyTimes();
+ EasyMock.expect(tokenStateService.getTokenMetadata(CLIENT)).andReturn(clientMetadata).anyTimes();
+ EasyMock.expect(tokenStateService.getTokenIssueTime(CLIENT)).andReturn(ISSUE_TIME).anyTimes();
+ // This redemption wins the atomic consume and rotates.
+ EasyMock.expect(tokenStateService.consumeToken(REFRESH_TOKEN_ID)).andReturn(true).once();
+ EasyMock.replay(tokenStateService);
+
+ final HttpServletRequest req = EasyMock.createNiceMock(HttpServletRequest.class);
+ EasyMock.expect(req.getParameter(REFRESH_TOKEN)).andReturn(REFRESH_TOKEN_ID).anyTimes();
+ EasyMock.expect(req.getParameter(CLIENT_ID)).andReturn(CLIENT).anyTimes();
+ EasyMock.expect(req.getParameter(CLIENT_SECRET)).andReturn(wireSecret(CLIENT, RAW_PASSCODE)).anyTimes();
+ EasyMock.replay(req);
+
+ final UserParamsProvider userParamsProvider = EasyMock.createNiceMock(UserParamsProvider.class);
+ EasyMock.expect(userParamsProvider.getParamsFor(EasyMock.anyString(), EasyMock.anyObject()))
+ .andReturn(new HashMap<>()).anyTimes();
+ EasyMock.replay(userParamsProvider);
+
+ final TestableTokenResource resource = new TestableTokenResource();
+ resource.inject(tokenStateService, tokenMAC, req, userParamsProvider);
+
+ final Response response = resource.handleRefreshToken();
+
+ assertEquals(Response.Status.OK.getStatusCode(), response.getStatus());
+ assertEquals("Exactly one audit record must be emitted.", 1, capturingAuditor.records.size());
+ final CapturingAuditor.Record record = capturingAuditor.records.get(0);
+ assertEquals(Action.AUTHENTICATION, record.action);
+ assertEquals(ResourceType.PRINCIPAL, record.resourceType);
+ assertEquals(ActionOutcome.SUCCESS, record.outcome);
+ assertTrue(record.message.contains("grant_type=refresh_token"));
+ assertTrue(record.message.contains("reason=rotated"));
+ // Neither the raw refresh token id nor the client_id appear verbatim.
+ assertFalse(record.message.contains(REFRESH_TOKEN_ID));
+ assertFalse("client_id must be masked in the audit record", CLIENT.equals(record.resource));
+ }
+}
diff --git a/gateway-service-knoxidf/src/test/java/org/apache/knox/gateway/service/knoxidf/KnoxIDFUtilsErrorStatusTest.java b/gateway-service-knoxidf/src/test/java/org/apache/knox/gateway/service/knoxidf/KnoxIDFUtilsErrorStatusTest.java
new file mode 100644
index 0000000000..d7cd7fb55b
--- /dev/null
+++ b/gateway-service-knoxidf/src/test/java/org/apache/knox/gateway/service/knoxidf/KnoxIDFUtilsErrorStatusTest.java
@@ -0,0 +1,83 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with this
+ * work for additional information regarding copyright ownership. The ASF
+ * licenses this file to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+ * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+ * License for the specific language governing permissions and limitations under
+ * the License.
+ */
+package org.apache.knox.gateway.service.knoxidf;
+
+import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertTrue;
+
+import javax.ws.rs.core.Response;
+
+import org.apache.knox.gateway.util.knoxidf.KnoxIDFUtils;
+import org.junit.Test;
+
+/**
+ * Verifies {@link KnoxIDFUtils#error(String, String)} maps each OAuth 2.0 error code to the HTTP
+ * status RFC 6749 §5.2 prescribes, rather than the previous always-401 behavior.
+ */
+public class KnoxIDFUtilsErrorStatusTest {
+
+ private static int statusOf(String error) {
+ return KnoxIDFUtils.error(error, "desc").getStatus();
+ }
+
+ @Test
+ public void testInvalidClientIsUnauthorized() {
+ assertEquals(401, statusOf("invalid_client"));
+ }
+
+ @Test
+ public void testAccessDeniedIsForbidden() {
+ assertEquals(403, statusOf("access_denied"));
+ }
+
+ @Test
+ public void testServerErrorIs500() {
+ assertEquals(500, statusOf("server_error"));
+ }
+
+ @Test
+ public void testTemporarilyUnavailableIs503() {
+ assertEquals(503, statusOf("temporarily_unavailable"));
+ }
+
+ @Test
+ public void testProtocolErrorsDefaultToBadRequest() {
+ for (final String error : new String[]{"invalid_request", "invalid_grant", "invalid_scope",
+ "unsupported_grant_type", "unsupported_response_type", "unauthorized_client"}) {
+ assertEquals("Expected 400 for " + error, 400, statusOf(error));
+ }
+ }
+
+ @Test
+ public void testUnknownAndNullErrorDefaultToBadRequest() {
+ assertEquals(400, statusOf("something_unexpected"));
+ assertEquals(400, statusOf(null));
+ }
+
+ @Test
+ public void testExplicitStatusOverloadWins() {
+ final Response response = KnoxIDFUtils.error("invalid_request", "desc", Response.Status.CONFLICT);
+ assertEquals(409, response.getStatus());
+ }
+
+ @Test
+ public void testBodyCarriesErrorCodeAndDescription() {
+ final String body = String.valueOf(KnoxIDFUtils.error("invalid_grant", "bad code").getEntity());
+ assertTrue(body.contains("invalid_grant"));
+ assertTrue(body.contains("bad code"));
+ }
+}
diff --git a/gateway-service-knoxidf/src/test/java/org/apache/knox/gateway/service/knoxidf/RegistrationRedirectUriPolicyTest.java b/gateway-service-knoxidf/src/test/java/org/apache/knox/gateway/service/knoxidf/RegistrationRedirectUriPolicyTest.java
new file mode 100644
index 0000000000..35dd4b4f1c
--- /dev/null
+++ b/gateway-service-knoxidf/src/test/java/org/apache/knox/gateway/service/knoxidf/RegistrationRedirectUriPolicyTest.java
@@ -0,0 +1,119 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with this
+ * work for additional information regarding copyright ownership. The ASF
+ * licenses this file to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+ * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+ * License for the specific language governing permissions and limitations under
+ * the License.
+ */
+package org.apache.knox.gateway.service.knoxidf;
+
+import org.junit.Test;
+
+import javax.ws.rs.core.Response;
+import java.util.Arrays;
+import java.util.Collections;
+import java.util.List;
+import java.util.Set;
+
+import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertNull;
+import static org.junit.Assert.assertTrue;
+
+/**
+ * Verifies the dynamic-registration redirect-URI policy: HTTPS is required (RFC 8252), plain HTTP is
+ * tolerated only for loopback dev, and wildcard hosts are rejected.
+ */
+public class RegistrationRedirectUriPolicyTest {
+
+ private static Response verify(String... uris) {
+ return RegistrationResource.verifyRedirectUris(Arrays.asList(uris));
+ }
+
+ @Test
+ public void testHttpsAccepted() {
+ assertNull("A plain https redirect must be accepted.", verify("https://app.example.com/cb"));
+ }
+
+ @Test
+ public void testPlainHttpRejectedForNonLoopback() {
+ final Response response = verify("http://app.example.com/cb");
+ assertEquals(400, response.getStatus());
+ assertTrue(String.valueOf(response.getEntity()).contains("HTTPS"));
+ }
+
+ @Test
+ public void testPlainHttpAllowedForLoopback() {
+ assertNull(verify("http://localhost:8080/cb"));
+ assertNull(verify("http://127.0.0.1/cb"));
+ assertNull(verify("http://[::1]:9000/cb"));
+ }
+
+ @Test
+ public void testWildcardHostRejected() {
+ final Response response = verify("https://*.example.com/cb");
+ assertEquals(400, response.getStatus());
+ }
+
+ @Test
+ public void testEmptyListRejected() {
+ assertEquals(400, verify().getStatus());
+ assertEquals(400, RegistrationResource.verifyRedirectUris(Collections.emptyList()).getStatus());
+ assertEquals(400, RegistrationResource.verifyRedirectUris((List) null).getStatus());
+ }
+
+ @Test
+ public void testOneBadUriAmongGoodOnesRejectsWhole() {
+ assertEquals(400, verify("https://good.example.com/cb", "http://evil.example.com/cb").getStatus());
+ }
+
+ @Test
+ public void testConfiguredLoopbackHostAllowsPlainHttp() {
+ final Set hosts = RegistrationResource.parseLoopbackHosts("host.docker.internal");
+ assertNull("A configured loopback host must be allowed over plain HTTP.",
+ RegistrationResource.verifyRedirectUris(Collections.singletonList("http://host.docker.internal:8443/cb"), hosts));
+ }
+
+ @Test
+ public void testConfiguredLoopbackMatchIsCaseInsensitive() {
+ final Set hosts = RegistrationResource.parseLoopbackHosts("Host.Docker.Internal");
+ assertNull(RegistrationResource.verifyRedirectUris(Collections.singletonList("http://HOST.docker.internal/cb"), hosts));
+ }
+
+ @Test
+ public void testHostNotConfiguredStillRejected() {
+ final Set hosts = RegistrationResource.parseLoopbackHosts("host.docker.internal");
+ assertEquals("A host outside the allowlist must still require HTTPS.", 400,
+ RegistrationResource.verifyRedirectUris(Collections.singletonList("http://evil.docker.internal/cb"), hosts).getStatus());
+ }
+
+ @Test
+ public void testConfiguredLoopbackDoesNotWidenToSubdomains() {
+ final Set hosts = RegistrationResource.parseLoopbackHosts("host.docker.internal");
+ // Exact match only: a sub-domain of an allowlisted host is NOT itself allowlisted.
+ assertEquals(400, RegistrationResource.verifyRedirectUris(Collections.singletonList("http://evil.host.docker.internal/cb"), hosts).getStatus());
+ }
+
+ @Test
+ public void testDefaultsAlwaysPresentAlongsideConfiguredHosts() {
+ final Set hosts = RegistrationResource.parseLoopbackHosts("host.docker.internal");
+ // The three hard-coded loopback hosts survive even when extras are configured.
+ assertNull(RegistrationResource.verifyRedirectUris(Collections.singletonList("http://localhost:8080/cb"), hosts));
+ assertNull(RegistrationResource.verifyRedirectUris(Collections.singletonList("http://127.0.0.1/cb"), hosts));
+ }
+
+ @Test
+ public void testBlankConfigYieldsDefaultsOnly() {
+ assertEquals(RegistrationResource.DEFAULT_LOOPBACK_HOSTS, RegistrationResource.parseLoopbackHosts(null));
+ assertEquals(RegistrationResource.DEFAULT_LOOPBACK_HOSTS, RegistrationResource.parseLoopbackHosts(" "));
+ assertEquals(RegistrationResource.DEFAULT_LOOPBACK_HOSTS, RegistrationResource.parseLoopbackHosts(" , ,"));
+ }
+}
diff --git a/gateway-service-knoxidf/src/test/java/org/apache/knox/gateway/service/knoxidf/RegistrationResourceAnonymousGuardTest.java b/gateway-service-knoxidf/src/test/java/org/apache/knox/gateway/service/knoxidf/RegistrationResourceAnonymousGuardTest.java
new file mode 100644
index 0000000000..11a84b4c24
--- /dev/null
+++ b/gateway-service-knoxidf/src/test/java/org/apache/knox/gateway/service/knoxidf/RegistrationResourceAnonymousGuardTest.java
@@ -0,0 +1,78 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with this
+ * work for additional information regarding copyright ownership. The ASF
+ * licenses this file to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+ * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+ * License for the specific language governing permissions and limitations under
+ * the License.
+ */
+package org.apache.knox.gateway.service.knoxidf;
+
+import static org.junit.Assert.assertFalse;
+import static org.junit.Assert.assertTrue;
+
+import java.security.PrivilegedAction;
+
+import javax.security.auth.Subject;
+
+import org.apache.knox.gateway.security.PrimaryPrincipal;
+import org.junit.Test;
+
+/**
+ * Verifies finding 1.3: dynamic client registration refuses anonymous callers unless the
+ * deployment explicitly opts in via {@code knoxidf.client.registration.anonymous.allowed}. The
+ * endpoint is wired as {@code anon} in the sample topologies, so this resource-level check is what
+ * keeps registration closed by default.
+ */
+public class RegistrationResourceAnonymousGuardTest {
+
+ /** Exposes injection of the opt-in flag without running the full JAX-RS/servlet lifecycle. */
+ static final class TestableRegistrationResource extends RegistrationResource {
+ TestableRegistrationResource(final boolean anonymousRegistrationAllowed) {
+ this.anonymousRegistrationAllowed = anonymousRegistrationAllowed;
+ }
+ }
+
+ private static boolean deniedAs(final String principalName, final boolean anonymousAllowed) {
+ final TestableRegistrationResource resource = new TestableRegistrationResource(anonymousAllowed);
+ if (principalName == null) {
+ // No security context at all.
+ return resource.anonymousRegistrationDenied();
+ }
+ final Subject subject = new Subject();
+ subject.getPrincipals().add(new PrimaryPrincipal(principalName));
+ return Subject.doAs(subject, (PrivilegedAction) resource::anonymousRegistrationDenied);
+ }
+
+ @Test
+ public void testAnonymousCallerRejectedByDefault() {
+ // Default (flag false): the AnonymousAuthFilter principal ("anonymous") must be turned away.
+ assertTrue(deniedAs("anonymous", false));
+ }
+
+ @Test
+ public void testAnonymousCallerAllowedWhenExplicitlyEnabled() {
+ // The deliberate open-registration deployment mode: opt in and the anonymous caller is allowed.
+ assertFalse(deniedAs("anonymous", true));
+ }
+
+ @Test
+ public void testAuthenticatedCallerAlwaysAllowed() {
+ // A real authenticated principal is never subject to the anonymous gate, regardless of the flag.
+ assertFalse(deniedAs("alice", false));
+ assertFalse(deniedAs("alice", true));
+ }
+
+ @Test
+ public void testAnonymousMatchIsCaseInsensitive() {
+ assertTrue(deniedAs("ANONYMOUS", false));
+ }
+}
diff --git a/gateway-service-knoxidf/src/test/java/org/apache/knox/gateway/service/knoxidf/RegistrationScopePolicyTest.java b/gateway-service-knoxidf/src/test/java/org/apache/knox/gateway/service/knoxidf/RegistrationScopePolicyTest.java
new file mode 100644
index 0000000000..f54c7ebd7b
--- /dev/null
+++ b/gateway-service-knoxidf/src/test/java/org/apache/knox/gateway/service/knoxidf/RegistrationScopePolicyTest.java
@@ -0,0 +1,74 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with this
+ * work for additional information regarding copyright ownership. The ASF
+ * licenses this file to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+ * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+ * License for the specific language governing permissions and limitations under
+ * the License.
+ */
+package org.apache.knox.gateway.service.knoxidf;
+
+import org.apache.knox.gateway.util.knoxidf.KnoxIDFConstants;
+import org.junit.Test;
+
+import java.util.Set;
+
+import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertFalse;
+import static org.junit.Assert.assertTrue;
+
+/**
+ * Verifies the server-side registerable-scope whitelist: when the operator leaves
+ * {@code knoxidf.registration.allowed.scopes} unset the OIDC-standard scope set is the bound, and an
+ * explicit config is parsed into the authoritative set (with {@code openid} always registerable).
+ */
+public class RegistrationScopePolicyTest {
+
+ @Test
+ public void testUnsetDefaultsToOidcStandardScopes() {
+ // Only a genuinely blank (null / whitespace-only) config means "unset" -> OIDC-standard bound.
+ assertEquals(KnoxIDFConstants.OIDC_STANDARD_SCOPES, RegistrationResource.parseRegisterableScopes(null));
+ assertEquals(KnoxIDFConstants.OIDC_STANDARD_SCOPES, RegistrationResource.parseRegisterableScopes(" "));
+ }
+
+ @Test
+ public void testExplicitEmptyListYieldsOpenidOnly() {
+ // A non-blank config that resolves to no real scopes is an explicit (most restrictive) whitelist,
+ // not "unset": openid is always registerable, nothing else is.
+ assertEquals(Set.of("openid"), RegistrationResource.parseRegisterableScopes(" , ,"));
+ }
+
+ @Test
+ public void testOidcStandardSetDoesNotIncludeArbitraryScopes() {
+ // The default bound rejects a self-assigned privileged scope name like 'admin'.
+ assertFalse(KnoxIDFConstants.OIDC_STANDARD_SCOPES.contains("admin"));
+ assertTrue(KnoxIDFConstants.OIDC_STANDARD_SCOPES.contains("openid"));
+ assertTrue(KnoxIDFConstants.OIDC_STANDARD_SCOPES.contains("offline_access"));
+ }
+
+ @Test
+ public void testExplicitConfigIsAuthoritativeAndTrimmed() {
+ final Set scopes = RegistrationResource.parseRegisterableScopes("openid, profile , reports.read");
+ assertTrue(scopes.contains("openid"));
+ assertTrue(scopes.contains("profile"));
+ assertTrue(scopes.contains("reports.read"));
+ // A standard scope the operator omitted is NOT registerable under an explicit (narrower) config.
+ assertFalse(scopes.contains("email"));
+ assertFalse(scopes.contains("admin"));
+ }
+
+ @Test
+ public void testOpenidAlwaysRegisterableEvenIfOmittedFromConfig() {
+ final Set scopes = RegistrationResource.parseRegisterableScopes("profile,email");
+ assertTrue("'openid' must always be registerable regardless of the configured list.",
+ scopes.contains("openid"));
+ }
+}
diff --git a/gateway-service-knoxidf/src/test/java/org/apache/knox/gateway/service/knoxidf/TokenResourceAuthCodeReplayTest.java b/gateway-service-knoxidf/src/test/java/org/apache/knox/gateway/service/knoxidf/TokenResourceAuthCodeReplayTest.java
new file mode 100644
index 0000000000..92e6632ed3
--- /dev/null
+++ b/gateway-service-knoxidf/src/test/java/org/apache/knox/gateway/service/knoxidf/TokenResourceAuthCodeReplayTest.java
@@ -0,0 +1,153 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with this
+ * work for additional information regarding copyright ownership. The ASF
+ * licenses this file to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+ * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+ * License for the specific language governing permissions and limitations under
+ * the License.
+ */
+package org.apache.knox.gateway.service.knoxidf;
+
+import static org.apache.knox.gateway.security.CommonTokenConstants.CLIENT_SECRET;
+import static org.apache.knox.gateway.util.knoxidf.KnoxIDFConstants.CLIENT_ID;
+import static org.apache.knox.gateway.util.knoxidf.KnoxIDFConstants.CODE;
+import static org.apache.knox.gateway.util.knoxidf.KnoxIDFConstants.CODE_CHALLENGE;
+import static org.apache.knox.gateway.util.knoxidf.KnoxIDFConstants.REDIRECT_URI;
+import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertTrue;
+
+import java.nio.charset.StandardCharsets;
+import java.util.Base64;
+import java.util.concurrent.TimeUnit;
+import java.util.concurrent.atomic.AtomicInteger;
+
+import javax.servlet.http.HttpServletRequest;
+import javax.ws.rs.core.Response;
+
+import org.apache.knox.gateway.services.security.token.TokenMetadata;
+import org.apache.knox.gateway.services.security.token.TokenStateService;
+import org.apache.knox.gateway.services.security.token.impl.TokenMAC;
+import org.easymock.EasyMock;
+import org.junit.Before;
+import org.junit.Test;
+
+/**
+ * Verifies the single-use enforcement of the authorization_code grant (finding 2.4). The code must
+ * be atomically consumed BEFORE any token is issued: exactly one of N concurrent redemptions wins
+ * the consume and proceeds to issuance; the losers are rejected with {@code invalid_grant} and no
+ * token is minted. This closes the replay window that existed when the code was only revoked in a
+ * {@code finally} block after issuance.
+ */
+public class TokenResourceAuthCodeReplayTest {
+
+ private static final String AUTH_CODE = "auth-code-xyz";
+ private static final String CLIENT = "client-abc";
+ private static final String REDIRECT = "https://app.example/cb";
+ private static final String USER_NAME = "alice";
+ private static final long ISSUE_TIME = 1_700_000_000_000L;
+ private static final String RAW_PASSCODE = "0f1e2d3c-4b5a-6978-8796-a5b4c3d2e1f0";
+
+ private TokenStateService tokenStateService;
+ private TestableTokenResource resource;
+ private final AtomicInteger issuedCount = new AtomicInteger();
+
+ /**
+ * Exposes field injection and stubs out the heavy token-issuance path so the replay guard can be
+ * exercised in isolation. {@code getAuthenticationToken} is the step that mints tokens; here it
+ * only records that issuance was reached and returns a sentinel.
+ */
+ final class TestableTokenResource extends TokenResource {
+ void inject(final TokenStateService tss, final TokenMAC mac, final HttpServletRequest req) {
+ this.tokenStateService = tss;
+ this.tokenMAC = mac;
+ this.request = req;
+ }
+
+ @Override
+ public Response getAuthenticationToken() {
+ issuedCount.incrementAndGet();
+ return Response.ok("issued").build();
+ }
+ }
+
+ private static String wireSecret(final String tokenId, final String rawPasscode) {
+ final String inner = Base64.getEncoder().encodeToString(tokenId.getBytes(StandardCharsets.UTF_8))
+ + "::" + Base64.getEncoder().encodeToString(rawPasscode.getBytes(StandardCharsets.UTF_8));
+ return Base64.getEncoder().encodeToString(inner.getBytes(StandardCharsets.UTF_8));
+ }
+
+ @Before
+ public void setUp() throws Exception {
+ final TokenMAC tokenMAC = new TokenMAC("HmacSHA256", "0123456789abcdef0123456789abcdef".toCharArray());
+ final String storedPasscodeHash = tokenMAC.hash(CLIENT, ISSUE_TIME, USER_NAME, RAW_PASSCODE);
+
+ // Metadata for the authorization code being redeemed (confidential client, no PKCE challenge).
+ final TokenMetadata authCodeMetadata = EasyMock.createNiceMock(TokenMetadata.class);
+ EasyMock.expect(authCodeMetadata.isAuthCode()).andReturn(true).anyTimes();
+ EasyMock.expect(authCodeMetadata.getMetadata(REDIRECT_URI)).andReturn(REDIRECT).anyTimes();
+ EasyMock.expect(authCodeMetadata.getMetadata(CLIENT_ID)).andReturn(CLIENT).anyTimes();
+ EasyMock.expect(authCodeMetadata.getMetadata(CODE_CHALLENGE)).andReturn(null).anyTimes();
+ EasyMock.replay(authCodeMetadata);
+
+ // Metadata for the confidential client, used to authenticate the client_secret.
+ final TokenMetadata clientMetadata = EasyMock.createNiceMock(TokenMetadata.class);
+ EasyMock.expect(clientMetadata.getUserName()).andReturn(USER_NAME).anyTimes();
+ EasyMock.expect(clientMetadata.getPasscode()).andReturn(storedPasscodeHash).anyTimes();
+ EasyMock.replay(clientMetadata);
+
+ tokenStateService = EasyMock.createNiceMock(TokenStateService.class);
+ EasyMock.expect(tokenStateService.getTokenMetadata(AUTH_CODE)).andReturn(authCodeMetadata).anyTimes();
+ EasyMock.expect(tokenStateService.getTokenExpiration(AUTH_CODE))
+ .andReturn(System.currentTimeMillis() + TimeUnit.MINUTES.toMillis(5)).anyTimes();
+ EasyMock.expect(tokenStateService.getTokenMetadata(CLIENT)).andReturn(clientMetadata).anyTimes();
+ EasyMock.expect(tokenStateService.getTokenIssueTime(CLIENT)).andReturn(ISSUE_TIME).anyTimes();
+ // consumeToken behaviour is set per-test (win vs. lose) before replay().
+
+ final HttpServletRequest req = EasyMock.createNiceMock(HttpServletRequest.class);
+ EasyMock.expect(req.getParameter(CODE)).andReturn(AUTH_CODE).anyTimes();
+ EasyMock.expect(req.getParameter(REDIRECT_URI)).andReturn(REDIRECT).anyTimes();
+ EasyMock.expect(req.getParameter(CLIENT_ID)).andReturn(CLIENT).anyTimes();
+ EasyMock.expect(req.getParameter(CLIENT_SECRET)).andReturn(wireSecret(CLIENT, RAW_PASSCODE)).anyTimes();
+ EasyMock.replay(req);
+
+ resource = new TestableTokenResource();
+ resource.inject(tokenStateService, tokenMAC, req);
+ }
+
+ @Test
+ public void testFirstRedemptionConsumesThenIssues() {
+ EasyMock.expect(tokenStateService.consumeToken(AUTH_CODE)).andReturn(true).once();
+ EasyMock.replay(tokenStateService);
+
+ final Response response = resource.handleAuthorizationCodeFlow();
+
+ assertEquals("A validated, freshly-consumed code should issue a token.",
+ Response.Status.OK.getStatusCode(), response.getStatus());
+ assertEquals("Exactly one issuance for a single winning redemption.", 1, issuedCount.get());
+ EasyMock.verify(tokenStateService);
+ }
+
+ @Test
+ public void testReplayedCodeIsRejectedWithoutIssuing() {
+ // Simulate a concurrent redemption having already consumed the code: consumeToken loses.
+ EasyMock.expect(tokenStateService.consumeToken(AUTH_CODE)).andReturn(false).once();
+ EasyMock.replay(tokenStateService);
+
+ final Response response = resource.handleAuthorizationCodeFlow();
+
+ assertEquals("A code already consumed by a concurrent redemption must be rejected.",
+ Response.Status.BAD_REQUEST.getStatusCode(), response.getStatus());
+ assertTrue("The error body should identify the invalid_grant condition.",
+ String.valueOf(response.getEntity()).contains("invalid_grant"));
+ assertEquals("A losing redemption must not mint any token.", 0, issuedCount.get());
+ EasyMock.verify(tokenStateService);
+ }
+}
diff --git a/gateway-service-knoxidf/src/test/java/org/apache/knox/gateway/service/knoxidf/TokenResourceClientAuthTest.java b/gateway-service-knoxidf/src/test/java/org/apache/knox/gateway/service/knoxidf/TokenResourceClientAuthTest.java
new file mode 100644
index 0000000000..7cde797476
--- /dev/null
+++ b/gateway-service-knoxidf/src/test/java/org/apache/knox/gateway/service/knoxidf/TokenResourceClientAuthTest.java
@@ -0,0 +1,116 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with this
+ * work for additional information regarding copyright ownership. The ASF
+ * licenses this file to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+ * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+ * License for the specific language governing permissions and limitations under
+ * the License.
+ */
+package org.apache.knox.gateway.service.knoxidf;
+
+import static org.junit.Assert.assertFalse;
+import static org.junit.Assert.assertTrue;
+
+import java.nio.charset.StandardCharsets;
+import java.util.Base64;
+
+import org.apache.knox.gateway.services.security.token.TokenMetadata;
+import org.apache.knox.gateway.services.security.token.TokenStateService;
+import org.apache.knox.gateway.services.security.token.impl.TokenMAC;
+import org.easymock.EasyMock;
+import org.junit.Before;
+import org.junit.Test;
+
+/**
+ * Verifies that the token endpoint independently authenticates a confidential client on the
+ * authorization_code grant (finding 1.1). This closes the gap where the JWTFederationFilter Bearer
+ * path forwards a request without checking client_secret: a stolen auth code must not be redeemable
+ * without proving client identity.
+ */
+public class TokenResourceClientAuthTest {
+
+ private static final String CLIENT_ID = "client-abc";
+ private static final String USER_NAME = "alice";
+ private static final long ISSUE_TIME = 1_700_000_000_000L;
+ private static final String RAW_PASSCODE = "0f1e2d3c-4b5a-6978-8796-a5b4c3d2e1f0";
+
+ private TokenMAC tokenMAC;
+
+ private TestableTokenResource resource;
+
+ /**
+ * Exposes injection of the inherited (protected) token-state service and the package-private MAC
+ * so the client-authentication logic can be exercised without the full JAX-RS/servlet lifecycle.
+ */
+ static final class TestableTokenResource extends TokenResource {
+ void inject(final TokenStateService tokenStateService, final TokenMAC mac) {
+ this.tokenStateService = tokenStateService;
+ this.tokenMAC = mac;
+ }
+ }
+
+ @Before
+ public void setUp() throws Exception {
+ // A deterministic MAC shared by "the server" (stored hash) and the resource under test.
+ tokenMAC = new TokenMAC("HmacSHA256", "0123456789abcdef0123456789abcdef".toCharArray());
+ final String storedPasscodeHash = tokenMAC.hash(CLIENT_ID, ISSUE_TIME, USER_NAME, RAW_PASSCODE);
+
+ final TokenMetadata clientMetadata = EasyMock.createNiceMock(TokenMetadata.class);
+ EasyMock.expect(clientMetadata.getUserName()).andReturn(USER_NAME).anyTimes();
+ EasyMock.expect(clientMetadata.getPasscode()).andReturn(storedPasscodeHash).anyTimes();
+ EasyMock.replay(clientMetadata);
+
+ final TokenStateService tokenStateService = EasyMock.createNiceMock(TokenStateService.class);
+ EasyMock.expect(tokenStateService.getTokenMetadata(CLIENT_ID)).andReturn(clientMetadata).anyTimes();
+ EasyMock.expect(tokenStateService.getTokenIssueTime(CLIENT_ID)).andReturn(ISSUE_TIME).anyTimes();
+ EasyMock.replay(tokenStateService);
+
+ resource = new TestableTokenResource();
+ resource.inject(tokenStateService, tokenMAC);
+ }
+
+ private static String wireSecret(final String tokenId, final String rawPasscode) {
+ final String inner = Base64.getEncoder().encodeToString(tokenId.getBytes(StandardCharsets.UTF_8))
+ + "::" + Base64.getEncoder().encodeToString(rawPasscode.getBytes(StandardCharsets.UTF_8));
+ return Base64.getEncoder().encodeToString(inner.getBytes(StandardCharsets.UTF_8));
+ }
+
+ @Test
+ public void testValidClientSecretIsAccepted() {
+ assertTrue(resource.isValidClientSecret(CLIENT_ID, wireSecret(CLIENT_ID, RAW_PASSCODE)));
+ }
+
+ @Test
+ public void testWrongPasscodeIsRejected() {
+ assertFalse(resource.isValidClientSecret(CLIENT_ID, wireSecret(CLIENT_ID, "not-the-real-passcode")));
+ }
+
+ @Test
+ public void testSecretBoundToDifferentClientIsRejected() {
+ // A secret whose embedded tokenId does not match the client_id redeeming the code must fail,
+ // even if the secret itself is otherwise well-formed.
+ assertFalse(resource.isValidClientSecret("some-other-client", wireSecret(CLIENT_ID, RAW_PASSCODE)));
+ }
+
+ @Test
+ public void testBlankSecretIsRejected() {
+ assertFalse(resource.isValidClientSecret(CLIENT_ID, null));
+ assertFalse(resource.isValidClientSecret(CLIENT_ID, ""));
+ }
+
+ @Test
+ public void testMalformedSecretIsRejected() {
+ // Not base64 / no "tokenId::passcode" structure.
+ assertFalse(resource.isValidClientSecret(CLIENT_ID, "!!!not-base64!!!"));
+ assertFalse(resource.isValidClientSecret(CLIENT_ID,
+ Base64.getEncoder().encodeToString("no-separator".getBytes(StandardCharsets.UTF_8))));
+ }
+}
diff --git a/gateway-service-knoxidf/src/test/java/org/apache/knox/gateway/service/knoxidf/TokenResourceRefreshTokenClientAuthTest.java b/gateway-service-knoxidf/src/test/java/org/apache/knox/gateway/service/knoxidf/TokenResourceRefreshTokenClientAuthTest.java
new file mode 100644
index 0000000000..512b5a9d26
--- /dev/null
+++ b/gateway-service-knoxidf/src/test/java/org/apache/knox/gateway/service/knoxidf/TokenResourceRefreshTokenClientAuthTest.java
@@ -0,0 +1,146 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with this
+ * work for additional information regarding copyright ownership. The ASF
+ * licenses this file to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+ * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+ * License for the specific language governing permissions and limitations under
+ * the License.
+ */
+package org.apache.knox.gateway.service.knoxidf;
+
+import static org.apache.knox.gateway.security.CommonTokenConstants.CLIENT_SECRET;
+import static org.apache.knox.gateway.util.knoxidf.KnoxIDFConstants.CLIENT_ID;
+import static org.junit.Assert.fail;
+
+import java.nio.charset.StandardCharsets;
+import java.util.Base64;
+import java.util.concurrent.TimeUnit;
+
+import javax.servlet.http.HttpServletRequest;
+
+import org.apache.knox.gateway.service.knoxidf.TokenResource.RefreshTokenValidationError;
+import org.apache.knox.gateway.services.security.token.TokenMetadata;
+import org.apache.knox.gateway.services.security.token.TokenMetadataType;
+import org.apache.knox.gateway.services.security.token.TokenStateService;
+import org.apache.knox.gateway.services.security.token.impl.TokenMAC;
+import org.easymock.EasyMock;
+import org.junit.Before;
+import org.junit.Test;
+
+/**
+ * Verifies that the token endpoint independently authenticates the client on the
+ * {@code refresh_token} grant (review finding H1). Matching only {@code client_id} is not enough:
+ * the JWTFederationFilter Bearer path forwards a request here without checking {@code client_secret},
+ * so a stolen refresh token could otherwise be redeemed (and rotated) by anyone. This mirrors the
+ * client-authentication the authorization_code grant already performs.
+ */
+public class TokenResourceRefreshTokenClientAuthTest {
+
+ private static final String CLIENT = "client-abc";
+ private static final String USER_NAME = "alice";
+ private static final long ISSUE_TIME = 1_700_000_000_000L;
+ private static final String RAW_PASSCODE = "0f1e2d3c-4b5a-6978-8796-a5b4c3d2e1f0";
+ private static final String REFRESH_TOKEN_ID = "refresh-token-id-123";
+ private static final String REFRESH_TOKEN_PARAM = "the-opaque-refresh-token";
+
+ private TokenMAC tokenMAC;
+ private TokenStateService tokenStateService;
+ private TokenMetadata refreshTokenMetadata;
+
+ /** Exposes injection of the inherited (protected) token-state service, MAC and request. */
+ static final class TestableTokenResource extends TokenResource {
+ void inject(final TokenStateService tss, final TokenMAC mac, final HttpServletRequest req) {
+ this.tokenStateService = tss;
+ this.tokenMAC = mac;
+ this.request = req;
+ }
+ }
+
+ private static String wireSecret(final String tokenId, final String rawPasscode) {
+ final String inner = Base64.getEncoder().encodeToString(tokenId.getBytes(StandardCharsets.UTF_8))
+ + "::" + Base64.getEncoder().encodeToString(rawPasscode.getBytes(StandardCharsets.UTF_8));
+ return Base64.getEncoder().encodeToString(inner.getBytes(StandardCharsets.UTF_8));
+ }
+
+ @Before
+ public void setUp() throws Exception {
+ tokenMAC = new TokenMAC("HmacSHA256", "0123456789abcdef0123456789abcdef".toCharArray());
+ final String storedPasscodeHash = tokenMAC.hash(CLIENT, ISSUE_TIME, USER_NAME, RAW_PASSCODE);
+
+ // The refresh token's own metadata: a valid, enabled REFRESH_TOKEN bound to CLIENT.
+ refreshTokenMetadata = EasyMock.createNiceMock(TokenMetadata.class);
+ EasyMock.expect(refreshTokenMetadata.getType()).andReturn(TokenMetadataType.REFRESH_TOKEN.name()).anyTimes();
+ EasyMock.expect(refreshTokenMetadata.isEnabled()).andReturn(true).anyTimes();
+ EasyMock.expect(refreshTokenMetadata.getMetadata(CLIENT_ID)).andReturn(CLIENT).anyTimes();
+ EasyMock.replay(refreshTokenMetadata);
+
+ // The client's registration metadata, used to authenticate the presented client_secret.
+ final TokenMetadata clientMetadata = EasyMock.createNiceMock(TokenMetadata.class);
+ EasyMock.expect(clientMetadata.getUserName()).andReturn(USER_NAME).anyTimes();
+ EasyMock.expect(clientMetadata.getPasscode()).andReturn(storedPasscodeHash).anyTimes();
+ EasyMock.replay(clientMetadata);
+
+ tokenStateService = EasyMock.createNiceMock(TokenStateService.class);
+ EasyMock.expect(tokenStateService.getTokenExpiration(REFRESH_TOKEN_ID))
+ .andReturn(System.currentTimeMillis() + TimeUnit.MINUTES.toMillis(30)).anyTimes();
+ EasyMock.expect(tokenStateService.getTokenMetadata(CLIENT)).andReturn(clientMetadata).anyTimes();
+ EasyMock.expect(tokenStateService.getTokenIssueTime(CLIENT)).andReturn(ISSUE_TIME).anyTimes();
+ EasyMock.replay(tokenStateService);
+ }
+
+ private TestableTokenResource resourceWithClientSecret(final String clientSecret) {
+ final HttpServletRequest req = EasyMock.createNiceMock(HttpServletRequest.class);
+ EasyMock.expect(req.getParameter(CLIENT_ID)).andReturn(CLIENT).anyTimes();
+ EasyMock.expect(req.getParameter(CLIENT_SECRET)).andReturn(clientSecret).anyTimes();
+ EasyMock.replay(req);
+
+ final TestableTokenResource resource = new TestableTokenResource();
+ resource.inject(tokenStateService, tokenMAC, req);
+ return resource;
+ }
+
+ @Test
+ public void testValidClientSecretPassesRefreshGrant() throws Exception {
+ final TestableTokenResource resource = resourceWithClientSecret(wireSecret(CLIENT, RAW_PASSCODE));
+ // Should complete without throwing: a correctly authenticated client may refresh.
+ resource.validateRefreshTokenGrant(REFRESH_TOKEN_PARAM, REFRESH_TOKEN_ID, refreshTokenMetadata);
+ }
+
+ @Test
+ public void testMissingClientSecretIsRejected() {
+ final TestableTokenResource resource = resourceWithClientSecret(null);
+ assertRejected(resource);
+ }
+
+ @Test
+ public void testWrongClientSecretIsRejected() {
+ final TestableTokenResource resource = resourceWithClientSecret(wireSecret(CLIENT, "not-the-real-passcode"));
+ assertRejected(resource);
+ }
+
+ @Test
+ public void testSecretBoundToDifferentClientIsRejected() {
+ // A well-formed secret whose embedded tokenId is not the refreshing client must not pass.
+ final TestableTokenResource resource = resourceWithClientSecret(wireSecret("some-other-client", RAW_PASSCODE));
+ assertRejected(resource);
+ }
+
+ private void assertRejected(final TestableTokenResource resource) {
+ try {
+ resource.validateRefreshTokenGrant(REFRESH_TOKEN_PARAM, REFRESH_TOKEN_ID, refreshTokenMetadata);
+ fail("Refresh grant must reject a request that does not authenticate the client.");
+ } catch (RefreshTokenValidationError expected) {
+ // expected: client authentication failed
+ } catch (Exception e) {
+ fail("Expected RefreshTokenValidationError but got " + e.getClass().getName());
+ }
+ }
+}
diff --git a/gateway-service-knoxidf/src/test/java/org/apache/knox/gateway/service/knoxidf/TokenResourceRefreshTokenRotationTest.java b/gateway-service-knoxidf/src/test/java/org/apache/knox/gateway/service/knoxidf/TokenResourceRefreshTokenRotationTest.java
new file mode 100644
index 0000000000..90b7346f23
--- /dev/null
+++ b/gateway-service-knoxidf/src/test/java/org/apache/knox/gateway/service/knoxidf/TokenResourceRefreshTokenRotationTest.java
@@ -0,0 +1,134 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with this
+ * work for additional information regarding copyright ownership. The ASF
+ * licenses this file to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+ * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+ * License for the specific language governing permissions and limitations under
+ * the License.
+ */
+package org.apache.knox.gateway.service.knoxidf;
+
+import static org.apache.knox.gateway.security.CommonTokenConstants.CLIENT_SECRET;
+import static org.apache.knox.gateway.util.knoxidf.KnoxIDFConstants.CLIENT_ID;
+import static org.apache.knox.gateway.util.knoxidf.KnoxIDFConstants.REFRESH_TOKEN;
+import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertTrue;
+
+import java.nio.charset.StandardCharsets;
+import java.util.Base64;
+import java.util.concurrent.TimeUnit;
+import java.util.concurrent.atomic.AtomicInteger;
+
+import javax.servlet.http.HttpServletRequest;
+import javax.ws.rs.core.Response;
+
+import org.apache.knox.gateway.services.security.token.TokenMetadata;
+import org.apache.knox.gateway.services.security.token.TokenMetadataType;
+import org.apache.knox.gateway.services.security.token.TokenStateService;
+import org.apache.knox.gateway.services.security.token.impl.TokenMAC;
+import org.easymock.EasyMock;
+import org.junit.Before;
+import org.junit.Test;
+
+/**
+ * Verifies single-use enforcement of the {@code refresh_token} grant (review finding M1). The
+ * presented refresh token must be atomically consumed BEFORE its replacement is issued: exactly one
+ * of N concurrent redemptions wins the consume and rotates; the losers are rejected with
+ * {@code invalid_grant} and no new token pair is minted. This closes the check-then-act window that
+ * existed when rotation used {@code revokeToken} on the in-memory backend. Mirrors the
+ * authorization_code single-use guard (see {@link TokenResourceAuthCodeReplayTest}).
+ */
+public class TokenResourceRefreshTokenRotationTest {
+
+ // A UUID so TokenUtils.getTokenId returns it verbatim (no JWT parsing needed).
+ private static final String REFRESH_TOKEN_ID = "11111111-2222-3333-4444-555555555555";
+ private static final String CLIENT = "client-abc";
+ private static final String USER_NAME = "alice";
+ private static final long ISSUE_TIME = 1_700_000_000_000L;
+ private static final String RAW_PASSCODE = "0f1e2d3c-4b5a-6978-8796-a5b4c3d2e1f0";
+
+ private TokenStateService tokenStateService;
+ private TestableTokenResource resource;
+ private final AtomicInteger issuedCount = new AtomicInteger();
+
+ /** Field injection plus a stub for the token-mint step so the rotation guard is tested in isolation. */
+ final class TestableTokenResource extends TokenResource {
+ void inject(final TokenStateService tss, final TokenMAC mac, final HttpServletRequest req) {
+ this.tokenStateService = tss;
+ this.tokenMAC = mac;
+ this.request = req;
+ }
+
+ @Override
+ protected TokenResponseContext getTokenResponse(final UserContext context) {
+ issuedCount.incrementAndGet();
+ return new TokenResponseContext(null, "issued", Response.ok());
+ }
+ }
+
+ private static String wireSecret(final String tokenId, final String rawPasscode) {
+ final String inner = Base64.getEncoder().encodeToString(tokenId.getBytes(StandardCharsets.UTF_8))
+ + "::" + Base64.getEncoder().encodeToString(rawPasscode.getBytes(StandardCharsets.UTF_8));
+ return Base64.getEncoder().encodeToString(inner.getBytes(StandardCharsets.UTF_8));
+ }
+
+ @Before
+ public void setUp() throws Exception {
+ final TokenMAC tokenMAC = new TokenMAC("HmacSHA256", "0123456789abcdef0123456789abcdef".toCharArray());
+ final String storedPasscodeHash = tokenMAC.hash(CLIENT, ISSUE_TIME, USER_NAME, RAW_PASSCODE);
+
+ final TokenMetadata refreshTokenMetadata = EasyMock.createNiceMock(TokenMetadata.class);
+ EasyMock.expect(refreshTokenMetadata.getType()).andReturn(TokenMetadataType.REFRESH_TOKEN.name()).anyTimes();
+ EasyMock.expect(refreshTokenMetadata.isEnabled()).andReturn(true).anyTimes();
+ EasyMock.expect(refreshTokenMetadata.getMetadata(CLIENT_ID)).andReturn(CLIENT).anyTimes();
+ EasyMock.expect(refreshTokenMetadata.getUserName()).andReturn(USER_NAME).anyTimes();
+ EasyMock.replay(refreshTokenMetadata);
+
+ final TokenMetadata clientMetadata = EasyMock.createNiceMock(TokenMetadata.class);
+ EasyMock.expect(clientMetadata.getUserName()).andReturn(USER_NAME).anyTimes();
+ EasyMock.expect(clientMetadata.getPasscode()).andReturn(storedPasscodeHash).anyTimes();
+ EasyMock.replay(clientMetadata);
+
+ tokenStateService = EasyMock.createNiceMock(TokenStateService.class);
+ EasyMock.expect(tokenStateService.getTokenMetadata(REFRESH_TOKEN_ID)).andReturn(refreshTokenMetadata).anyTimes();
+ EasyMock.expect(tokenStateService.getTokenExpiration(REFRESH_TOKEN_ID))
+ .andReturn(System.currentTimeMillis() + TimeUnit.MINUTES.toMillis(30)).anyTimes();
+ EasyMock.expect(tokenStateService.getTokenMetadata(CLIENT)).andReturn(clientMetadata).anyTimes();
+ EasyMock.expect(tokenStateService.getTokenIssueTime(CLIENT)).andReturn(ISSUE_TIME).anyTimes();
+ // consumeToken behaviour is set per-test (win vs. lose) before replay().
+
+ final HttpServletRequest req = EasyMock.createNiceMock(HttpServletRequest.class);
+ EasyMock.expect(req.getParameter(REFRESH_TOKEN)).andReturn(REFRESH_TOKEN_ID).anyTimes();
+ EasyMock.expect(req.getParameter(CLIENT_ID)).andReturn(CLIENT).anyTimes();
+ EasyMock.expect(req.getParameter(CLIENT_SECRET)).andReturn(wireSecret(CLIENT, RAW_PASSCODE)).anyTimes();
+ EasyMock.replay(req);
+
+ resource = new TestableTokenResource();
+ resource.inject(tokenStateService, tokenMAC, req);
+ }
+
+ @Test
+ public void testAlreadyRedeemedRefreshTokenIsRejectedWithoutIssuing() {
+ // A concurrent redemption already consumed the token: this consume loses.
+ EasyMock.expect(tokenStateService.consumeToken(REFRESH_TOKEN_ID)).andReturn(false).once();
+ EasyMock.replay(tokenStateService);
+
+ final Response response = resource.handleRefreshToken();
+
+ assertEquals("A refresh token already consumed by a concurrent rotation must be rejected.",
+ Response.Status.BAD_REQUEST.getStatusCode(), response.getStatus());
+ assertTrue("The error body should identify the invalid_grant condition.",
+ String.valueOf(response.getEntity()).contains("invalid_grant"));
+ assertEquals("A losing redemption must not mint any token.", 0, issuedCount.get());
+ // Proves rotation now goes through the atomic consume path rather than revokeToken.
+ EasyMock.verify(tokenStateService);
+ }
+}
diff --git a/gateway-service-knoxidf/src/test/java/org/apache/knox/gateway/service/knoxidf/TrustedOidcIssuersResourceTest.java b/gateway-service-knoxidf/src/test/java/org/apache/knox/gateway/service/knoxidf/TrustedOidcIssuersResourceTest.java
new file mode 100644
index 0000000000..b5cea534ef
--- /dev/null
+++ b/gateway-service-knoxidf/src/test/java/org/apache/knox/gateway/service/knoxidf/TrustedOidcIssuersResourceTest.java
@@ -0,0 +1,587 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with this
+ * work for additional information regarding copyright ownership. The ASF
+ * licenses this file to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+ * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+ * License for the specific language governing permissions and limitations under
+ * the License.
+ */
+package org.apache.knox.gateway.service.knoxidf;
+
+import com.fasterxml.jackson.databind.ObjectMapper;
+import org.apache.knox.gateway.audit.api.Action;
+import org.apache.knox.gateway.audit.api.ActionOutcome;
+import org.apache.knox.gateway.audit.api.Auditor;
+import org.apache.knox.gateway.audit.api.ResourceType;
+import org.apache.knox.gateway.services.GatewayServices;
+import org.apache.knox.gateway.services.ServiceType;
+import org.apache.knox.gateway.services.knoxidf.trustedoidcissuer.TrustedOidcIssuer;
+import org.apache.knox.gateway.services.knoxidf.trustedoidcissuer.TrustedOidcIssuerService;
+import org.easymock.Capture;
+import org.easymock.EasyMock;
+import org.junit.After;
+import org.junit.Before;
+import org.junit.Test;
+
+import javax.servlet.ServletContext;
+import javax.servlet.http.HttpServletRequest;
+import javax.ws.rs.core.Response;
+import java.lang.reflect.Field;
+import java.security.Principal;
+import java.time.Instant;
+import java.util.Arrays;
+import java.util.Collections;
+import java.util.List;
+import java.util.Map;
+
+import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertFalse;
+import static org.junit.Assert.assertNotNull;
+import static org.junit.Assert.assertNull;
+import static org.junit.Assert.assertTrue;
+
+public class TrustedOidcIssuersResourceTest {
+
+ private static final String ISSUER_A = "https://issuer-a.example.com";
+ private static final String ISSUER_B = "https://issuer-b.example.com";
+ private static final String OPERATOR = "admin";
+
+ // Capture the real static Auditor so @After can restore it.
+ private static final Auditor ORIGINAL_AUDITOR = TrustedOidcIssuersResource.auditor;
+
+ private TrustedOidcIssuersResource resource;
+ private TrustedOidcIssuerService mockService;
+ private Auditor mockAuditor;
+
+ @Before
+ public void setUp() throws Exception {
+ mockService = EasyMock.createMock(TrustedOidcIssuerService.class);
+ mockAuditor = EasyMock.createMock(Auditor.class);
+ TrustedOidcIssuersResource.auditor = mockAuditor;
+ resource = buildResource(buildPrincipal(OPERATOR));
+ }
+
+ @After
+ public void tearDown() {
+ TrustedOidcIssuersResource.auditor = ORIGINAL_AUDITOR;
+ }
+
+ // ---------------------------------------------------------------------------
+ // POST /register
+ // ---------------------------------------------------------------------------
+
+ @Test
+ public void testRegisterIssuer() {
+ EasyMock.expect(mockService.isTrusted(ISSUER_A)).andReturn(false).once();
+ final Capture capturedIssuer = EasyMock.newCapture();
+ mockService.register(EasyMock.capture(capturedIssuer));
+ EasyMock.expectLastCall().once();
+ final Capture auditMsg = EasyMock.newCapture();
+ mockAuditor.audit(
+ EasyMock.eq(Action.DELEGATION_LIFECYCLE), EasyMock.eq(ISSUER_A),
+ EasyMock.eq(ResourceType.TRUSTED_ISSUER), EasyMock.eq(ActionOutcome.SUCCESS),
+ EasyMock.capture(auditMsg));
+ EasyMock.expectLastCall().once();
+ EasyMock.replay(mockService, mockAuditor);
+
+ final Response response = resource.registerIssuer(buildRegisterBody(ISSUER_A, false, null));
+
+ assertEquals(Response.Status.CREATED.getStatusCode(), response.getStatus());
+ assertEquals(ISSUER_A, capturedIssuer.getValue().getIssuerUrl());
+ assertFalse(capturedIssuer.getValue().isDynamicJwks());
+ assertNull(capturedIssuer.getValue().getClusterName());
+ assertEquals(OPERATOR, capturedIssuer.getValue().getRegisteredBy());
+ assertNotNull(capturedIssuer.getValue().getRegisteredAt());
+ assertTrue(auditMsg.getValue().contains("event_type=issuer_registered"));
+ assertTrue(auditMsg.getValue().contains("performed_by=" + OPERATOR));
+ EasyMock.verify(mockService, mockAuditor);
+ }
+
+ @Test
+ public void testRegisterWithClusterNameAndDynamicJwks() {
+ EasyMock.expect(mockService.isTrusted(ISSUER_A)).andReturn(false).once();
+ final Capture