KNOX-3459: honor delegation policy tokenTtlSec as the minted token's expiry basis - #1401
Merged
Merged
Conversation
Contributor
Author
|
Cc. @hsheinblatt |
Test Results 4 files 4 suites 1m 48s ⏱️ Results for commit e7dfd64. |
hsheinblatt
reviewed
Sep 16, 2026
| // directly: it deliberately bypasses the topology knox.token.ttl upper bound and the client-supplied | ||
| // lifespan clamp below, since the policy value is server-side state (a peer of the topology config), | ||
| // not untrusted client input, and its purpose is longer-lived tokens for headless/batch delegations. | ||
| final Object requestedTtlSec = request.getAttribute(CommonTokenConstants.REQUESTED_TTL_REQUEST_ATTR); |
Contributor
There was a problem hiding this comment.
Maybe worth referring to the authoring bounds: knox.delegation.max.token.ttl.sec defaults to 86400 sec (24 hours) and knox.delegation.min.token.ttl.sec defaults to 60 sec.
hsheinblatt
reviewed
Sep 16, 2026
hsheinblatt
left a comment
hsheinblatt
left a comment
Contributor
There was a problem hiding this comment.
Thanks @smolnar82 , looks good to me. Just a comment that the operator allowed values are still bounded.
Contributor
Author
I made that bound clear in my comment in the code. Thanks for the review. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
KNOX-3459 - Honor delegation policy tokenTtlSec
What changes were proposed in this pull request?
PolicyDecision.getEffectiveTtlSec()is already computed byJdbcDelegationPolicyService.evaluate()(fromDelegationPolicy.getTokenTtlSec(), falling back to the configured default), but it was silently discarded —TokenExchangeHandlerread onlygetDenyReason(), so the per-policy TTL had no effect on the minted token's lifetime.This plumbs the effective TTL to KNOXTOKEN, mirroring the existing audience passthrough:
CommonTokenConstants— addsREQUESTED_TTL_REQUEST_ATTR(knox.token.requested.ttl), anIntegerseconds value an upstream component may set.TokenExchangeHandler— on the authorized delegation path (OBO / headless), sets the attribute frompolicyDecision.getEffectiveTtlSec().TokenResource.getExpiry()— when the attribute is present and positive, uses it as the expiry basis directly, deliberately bypassing the topologyknox.token.ttlupper bound and the clientlifespanclamp.The policy TTL is authoritative because
DelegationPolicy.tokenTtlSecis trusted, operator-configured server-side state (a peer of the topology config, not untrusted client input likelifespan). Its main use case — longer-lived tokens for headless/batch delegations — is impossible if capped by the topology default. Plain (same-subject) exchanges are unaffected: the attribute is set only on the policy-governed delegation path.How was this patch tested?
TokenExchangeHandlerTest(66 → 69): OBO delegation conveys the policy TTL, headless delegation conveys it, same-subject exchange does not.TokenServiceResourceTest(101 → 103): minted token honors the policy TTL while bypassing a lower topologyknox.token.ttlcap, and bypasses a shorterlifespanclamp.