KNOX-3395: Add KNOXTOKEN issuance and JWTProvider federation integration tests

.github/PULL_REQUEST_TEMPLATE.md

@@ -13,6 +13,16 @@
 ## Integration Tests
 (Please add or update integration tests [`.github/workflows/tests`](.github/workflows/tests) for the feature you are adding. If no unit test is added, please explain why. Check out [`.github/workflows/tests/README.md`](./workflows/tests/README.md) for instructions)
 
+### Opt-in test suites (PR labels)
+Some integration suites are expensive and are **not** run on every PR. Add the corresponding label to this PR to run them:
+
+| Label | Runs |
+|-------|------|
+| `test-federation` | KnoxIDF federation E2E (`test_knoxidf_federation.py`). Stands up a real Keycloak as an external OpenID Provider and drives the full broker flow. Adds a few minutes (image pull + realm import). |
+| `skip-tests` | Skips the entire Docker Compose test job. |
+
+**When to add the label:** these labels only take effect on runs triggered by opening the PR, pushing a commit, or reopening the PR — the workflow does not run on a label change. Add the label **before opening the PR** (or before your next push). Adding it after the checks have already finished will **not** start a new run; push a commit or close/reopen the PR to trigger one with the label applied.
+
 ## UI changes
 (If this patch involves UI changes, please attach a screen-shot; otherwise, remove this)
 

.github/workflows/build/Dockerfile

@@ -17,7 +17,8 @@ FROM eclipse-temurin:17-jre
 
 MAINTAINER moresandeep
 
-RUN useradd -ms /bin/bash gateway
+# Install dependencies
+RUN apt-get update && apt-get install -y git && useradd -ms /bin/bash gateway
 
 # Create temporary directories for extraction
 RUN mkdir -p /tmp/knox-artifacts /tmp/knoxshell-artifacts /knox-runtime /knoxshell /knox-runtime/knoxshell
@@ -41,8 +42,13 @@ ADD .github/workflows/build/gateway-site.xml /knox-runtime/conf/gateway-site.xml
 ADD .github/workflows/build/conf/topologies/knoxtoken.xml /knox-runtime/conf/topologies/knoxtoken.xml
 ADD .github/workflows/build/conf/topologies/health.xml /knox-runtime/conf/topologies/health.xml
 ADD .github/workflows/build/conf/topologies/knoxldap.xml /knox-runtime/conf/topologies/knoxldap.xml
+ADD .github/workflows/build/conf/topologies/knoxldapcache.xml /knox-runtime/conf/topologies/knoxldapcache.xml
 ADD .github/workflows/build/conf/topologies/remoteauth.xml /knox-runtime/conf/topologies/remoteauth.xml
 ADD .github/workflows/build/conf/topologies/k8sauth.xml /knox-runtime/conf/topologies/k8sauth.xml
+ADD .github/workflows/build/conf/topologies/knoxidf-ldap.xml /knox-runtime/conf/topologies/knoxidf-ldap.xml
+ADD .github/workflows/build/conf/topologies/knoxidf-token.xml /knox-runtime/conf/topologies/knoxidf-token.xml
+ADD .github/workflows/build/conf/topologies/knoxsso.xml /knox-runtime/conf/topologies/knoxsso.xml
+ADD .github/workflows/build/conf/topologies/knoxidf-sso.xml /knox-runtime/conf/topologies/knoxidf-sso.xml
 
 RUN chown -R gateway /knox-runtime/
 

.github/workflows/build/conf/topologies/knoxidf-ldap.xml

@@ -0,0 +1,82 @@
+<?xml version="1.0" encoding="utf-8"?>
+<topology>
+    <gateway>
+      <provider>
+         <role>authentication</role>
+         <name>ShiroProvider</name>
+         <enabled>true</enabled>
+         <param>
+            <name>main.ldapRealm</name>
+            <value>org.apache.knox.gateway.shirorealm.KnoxLdapRealm</value>
+         </param>
+         <param>
+            <name>main.ldapRealm.userDnTemplate</name>
+            <value>uid={0},ou=people,dc=hadoop,dc=apache,dc=org</value>
+         </param>
+         <param>
+            <name>main.ldapRealm.contextFactory.url</name>
+            <value>ldaps://localhost:33390</value>
+         </param>
+         <param>
+            <name>main.ldapRealm.contextFactory.authenticationMechanism</name>
+            <value>simple</value>
+         </param>
+         <param>
+            <name>urls./knoxidf/api/v1/.well-known/openid-configuration</name>
+            <value>anon</value>
+         </param>
+         <param>
+            <name>urls./knoxidf/api/v1/client/register</name>
+            <value>anon</value>
+         </param>
+         <param>
+            <name>urls./knoxidf/api/v1/authorize/callback</name>
+            <value>anon</value>
+         </param>
+         <param>
+            <name>urls./knoxidf/api/v1/jwks</name>
+            <value>anon</value>
+          </param>
+         <param>
+            <name>urls./**</name>
+            <value>authcBasic</value>
+         </param>
+      </provider>
+      <provider>
+            <role>identity-assertion</role>
+            <name>Default</name>
+            <enabled>true</enabled>
+      </provider>
+    </gateway>
+
+    <service>
+        <role>KNOXIDF</role>
+        <param>
+            <name>knoxidf.knox.token.ttl</name>
+            <value>60000</value>
+        </param>
+        <param>
+            <name>knoxidf.knox.token.limit.per.user</name>
+            <value>-1</value>
+        </param>
+        <param>
+            <!-- This sample topology intentionally allows open, unauthenticated client
+                 registration (the endpoint is wired as 'anon' above). Registration refuses
+                 anonymous callers unless this is explicitly set to true. -->
+            <name>knoxidf.client.registration.anonymous.allowed</name>
+            <value>true</value>
+        </param>
+        <param>
+            <!-- Skipping the user-consent screen is a server-side deployment decision, never a
+                 client-supplied request parameter (a client must not be able to bypass consent by
+                 sending auto_consent=true). This sample/CI topology opts in so the automated
+                 authorization-code flow tests can complete without driving the consent UI. -->
+            <name>knoxidf.auto.consent.enabled</name>
+            <value>true</value>
+        </param>
+        <param>
+            <name>token.exchange.topology.name</name>
+            <value>knoxidf-token</value>
+        </param>
+    </service>
+</topology>

.github/workflows/build/conf/topologies/knoxidf-sso.xml

@@ -0,0 +1,120 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!--
+  Licensed to the Apache Software Foundation (ASF) under one or more
+  contributor license agreements. See the NOTICE file distributed with this
+  work for additional information regarding copyright ownership. The ASF
+  licenses this file to you under the Apache License, Version 2.0 (the
+  "License"); you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+  WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+  License for the specific language governing permissions and limitations under
+  the License.
+-->
+<!--
+  CI-only KnoxIDF topology exercised by the opt-in federation E2E test
+  (test_knoxidf_federation.py). Unlike knoxidf-ldap.xml (which fronts /authorize with
+  LDAP Basic auth), this topology fronts /authorize with an SSOCookieProvider. An
+  unauthenticated /authorize is redirected to the knoxsso login front-end; because a
+  federated OP (Keycloak) is configured below, the SSOCookieFederationFilter records the
+  request and offers the OP as a login option, brokering the user out to Keycloak and back
+  through /authorize/callback.
+
+  The federated.op.* settings are KNOXIDF service params so they are exposed as
+  ServletContext init-params, which is where both AuthorizeResource and the
+  SSOCookieFederationFilter read them (same webapp, shared ServletContext).
+-->
+<topology>
+    <gateway>
+        <provider>
+            <role>federation</role>
+            <name>SSOCookieProvider</name>
+            <enabled>true</enabled>
+            <param>
+                <name>sso.authentication.provider.url</name>
+                <value>https://knox:8443/gateway/knoxsso/api/v1/websso</value>
+            </param>
+            <param>
+                <name>sso.unauthenticated.path.list</name>
+                <value>/knoxidf/api/v1/authorize/callback;/knoxidf/api/v1/jwks;/knoxidf/api/v1/.well-known/openid-configuration;/knoxidf/api/v1/client/register</value>
+            </param>
+        </provider>
+        <provider>
+            <role>identity-assertion</role>
+            <name>Default</name>
+            <enabled>true</enabled>
+        </provider>
+    </gateway>
+
+    <service>
+        <role>KNOXIDF</role>
+        <param>
+            <name>knoxidf.knox.token.ttl</name>
+            <value>60000</value>
+        </param>
+        <param>
+            <name>knoxidf.knox.token.limit.per.user</name>
+            <value>-1</value>
+        </param>
+        <param>
+            <name>knoxidf.client.registration.anonymous.allowed</name>
+            <value>true</value>
+        </param>
+        <param>
+            <name>knoxidf.auto.consent.enabled</name>
+            <value>true</value>
+        </param>
+        <param>
+            <name>token.exchange.topology.name</name>
+            <value>knoxidf-token</value>
+        </param>
+        <param>
+            <name>federated.op.names</name>
+            <value>keycloak</value>
+        </param>
+        <param>
+            <name>federated.op.keycloak.enabled</name>
+            <value>true</value>
+        </param>
+        <param>
+            <name>federated.op.keycloak.clientId</name>
+            <value>knox-client</value>
+        </param>
+        <param>
+            <name>federated.op.keycloak.clientSecret</name>
+            <value>knox-client-secret</value>
+        </param>
+        <param>
+            <name>federated.op.keycloak.authorize.endpoint</name>
+            <value>http://keycloak:8080/realms/knox/protocol/openid-connect/auth</value>
+        </param>
+        <param>
+            <name>federated.op.keycloak.authorize.callback</name>
+            <value>https://knox:8443/gateway/knoxidf-sso/knoxidf/api/v1/authorize/callback</value>
+        </param>
+        <param>
+            <name>federated.op.keycloak.token.endpoint</name>
+            <value>http://keycloak:8080/realms/knox/protocol/openid-connect/token</value>
+        </param>
+        <param>
+            <name>federated.op.keycloak.jwks.endpoint</name>
+            <value>http://keycloak:8080/realms/knox/protocol/openid-connect/certs</value>
+        </param>
+        <param>
+            <name>federated.op.keycloak.issuer</name>
+            <value>http://keycloak:8080/realms/knox</value>
+        </param>
+        <param>
+            <name>federated.op.keycloak.userinfo.endpoint</name>
+            <value>http://keycloak:8080/realms/knox/protocol/openid-connect/userinfo</value>
+        </param>
+        <param>
+            <name>federated.op.keycloak.signature.algorithm</name>
+            <value>RS256</value>
+        </param>
+    </service>
+</topology>

.github/workflows/build/conf/topologies/knoxidf-token.xml

@@ -0,0 +1,38 @@
+<?xml version="1.0" encoding="utf-8"?>
+<topology>
+    <gateway>
+      <provider>
+         <role>federation</role>
+         <name>JWTProvider</name>
+         <enabled>true</enabled>
+         <param>
+            <name>knox.token.exp.server-managed</name>
+            <value>true</value>
+         </param>
+      </provider>
+      <provider>
+            <role>identity-assertion</role>
+            <name>Default</name>
+            <enabled>true</enabled>
+      </provider>
+    </gateway>
+
+    <service>
+        <role>KNOXIDF</role>
+        <param>
+           <name>knoxidf.knox.token.ttl</name>
+           <value>86400000</value>
+        </param>
+        <param>
+            <name>knoxidf.knox.token.limit.per.user</name>
+            <value>-1</value>
+        </param>
+        <param>
+            <!-- Skipping the user-consent screen is a server-side deployment decision, never a
+                 client-supplied request parameter. Kept in sync with knoxidf-ldap.xml so the
+                 KNOXIDF service consents consistently across both topologies. -->
+            <name>knoxidf.auto.consent.enabled</name>
+            <value>true</value>
+        </param>
+    </service>
+</topology>

.github/workflows/build/conf/topologies/knoxldap.xml

@@ -63,9 +63,19 @@ limitations under the License.
 	<service>
 		<role>KNOXTOKEN</role>
 		<param>
-			<name>knoxsso.token.ttl</name>
+			<name>knox.token.ttl</name>
 			<value>86400000</value>
 		</param>
+		<!-- Server-managed state is required for renew / revoke / enable / disable. -->
+		<param>
+			<name>knox.token.exp.server-managed</name>
+			<value>true</value>
+		</param>
+		<!-- guest may renew/revoke others' tokens; own-token revoke is always allowed. -->
+		<param>
+			<name>knox.token.renewer.whitelist</name>
+			<value>guest</value>
+		</param>
 	</service>
 	<service>
 		<role>KNOX-AUTH-SERVICE</role>