Skip to content

KNOX-3368 - Switch KNOXIDF_ADMIN pattern for PathAclsAuthz #1337

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
hsheinblatt wants to merge 1 commit into
base: knox_idf
Choose a base branch
from
Open

KNOX-3368 - Switch KNOXIDF_ADMIN pattern for PathAclsAuthz #1337

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion ...idf/src/main/java/org/apache/knox/gateway/service/knoxidf/TrustedOidcIssuersResource.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -57,7 +57,7 @@
@Produces(MediaType.APPLICATION_JSON)
public class TrustedOidcIssuersResource {

static final String RESOURCE_PATH = "knoxidf/issuers-admin/v1/trusted-oidc-issuers";
static final String RESOURCE_PATH = "knoxidf/admin/v1/trusted-oidc-issuers";

private static final ObjectMapper MAPPER = new ObjectMapper();

Expand Down
20 changes: 12 additions & 8 deletions .../apache/knox/gateway/service/knoxidf/deploy/KnoxIDFAdminServiceDeploymentContributor.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,13 +19,17 @@
import org.apache.knox.gateway.jersey.JerseyServiceDeploymentContributorBase;

/**
* Deployment contributor for the KNOXIDF_ADMIN service role, which hosts the
* trusted OIDC issuer admin REST API. This contributor registers
* {@link org.apache.knox.gateway.service.knoxidf.TrustedOidcIssuersResource}
* under the {@code knoxidf/issuers-admin/**?**} pattern, which is disjoint from
* the KNOXIDF role's {@code knoxidf/api/**?**} pattern. This ensures the KNOXIDF
* role cannot serve admin endpoints, and that per-role AclsAuthz authorization
* ({@code KNOXIDF_ADMIN.acl}) applies only to trusted-issuer admin requests.
* Deployment contributor for the KNOXIDF_ADMIN service role, which hosts all
* KnoxIDF admin REST APIs under a single {@code knoxidf/admin/**?**} URL pattern.
* Current resources: {@link org.apache.knox.gateway.service.knoxidf.TrustedOidcIssuersResource}.
*
* <p>The {@code knoxidf/admin/**?**} pattern is disjoint from the KNOXIDF role's
* {@code knoxidf/api/**?**} pattern, preventing KNOXIDF from serving admin endpoints.</p>
*
* <p>Authorization: use {@code PathAclsAuthz} in the topology to assign independent
* ACLs to each admin endpoint (e.g., {@code KNOXIDF_ADMIN.rule_issuers.path.acl}
* for trusted-issuers). Alternatively, {@code AclsAuthz} with {@code KNOXIDF_ADMIN.acl}
* applies a single ACL to all endpoints under this role.</p>
*/
public class KnoxIDFAdminServiceDeploymentContributor extends JerseyServiceDeploymentContributorBase {

Expand All @@ -46,6 +50,6 @@ protected String[] getPackages() {

@Override
protected String[] getPatterns() {
return new String[] { "knoxidf/issuers-admin/**?**" };
return new String[] { "knoxidf/admin/**?**" };
}
}
13 changes: 7 additions & 6 deletions ...che/knox/gateway/service/knoxidf/deploy/KnoxIDFAdminServiceDeploymentContributorTest.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -72,11 +72,12 @@ public void testPatterns() {
new KnoxIDFAdminServiceDeploymentContributor();
final String[] patterns = c.getPatterns();
assertNotNull(patterns);
// Distinct from KnoxIDFServiceDeploymentContributor's "knoxidf/api/**?**" so that the
// KNOXIDF role cannot accidentally serve admin endpoints, and so that per-role AclsAuthz
// params (KNOXIDF_ADMIN.acl) apply only to trusted-issuer admin requests.
assertTrue("Expected knoxidf/issuers-admin/**?** in patterns",
Arrays.asList(patterns).contains("knoxidf/issuers-admin/**?**"));
// Single broad pattern covers all KnoxIDF admin resources (trusted-issuers, delegation-policies, etc.).
// Disjoint from KnoxIDFServiceDeploymentContributor's "knoxidf/api/**?**" so the KNOXIDF role
// cannot serve admin endpoints. Per-endpoint ACLs are configured via PathAclsAuthz rules in
// the topology descriptor (e.g., KNOXIDF_ADMIN.rule_issuers.path.acl).
assertTrue("Expected knoxidf/admin/**?** in patterns",
Arrays.asList(patterns).contains("knoxidf/admin/**?**"));
}

@Test
Expand Down Expand Up @@ -140,6 +141,6 @@ public void testContributeService() throws Exception {
contributor.contributeService(context, service);

assertEquals("KNOXIDF_ADMIN", capturedRole.getValue());
assertEquals("knoxidf/issuers-admin/**?**", capturedPattern.getValue());
assertEquals("knoxidf/admin/**?**", capturedPattern.getValue());
}
}