KNOX-3424: Dynamic audience handling in the KNOXTOKEN service

[hanicz]

KNOX-3424 - Dynamic audience handling in the KNOXTOKEN service

What changes were proposed in this pull request?

Callers can now request a token's aud claim per request via an audience query parameter, validated against the existing knox.token.audiences whitelist to prevent audience/token spoofing.

Behavior

• No audience param → unchanged; the statically configured knox.token.audiences are used.
• audience param + no whitelist configured → 400 (secure by default — nothing to validate against).
• audience param + all values in the whitelist → only the requested audience(s) land in aud.
• audience param + any value not whitelisted → 400.
• Multiple audiences allowed (comma-separated and/or repeated params); exact match only, whitespace trimmed.

How was this patch tested?

Unit tests, local tests

curl -sku guest:guest-password -X GET \
  "https://localhost:8443/gateway/tokenissuer/knoxtoken/api/v2/token?lifespan=P0DT1H0M&audience=test1"
{
  "error": "No audiences are configured; cannot honor a requested audience.",
  "code": 100
}

curl -sku guest:guest-password -X GET \
  "https://localhost:8443/gateway/tokenissuer/knoxtoken/api/v2/token?lifespan=P0DT1H0M" \
| jq -r '.access_token' \
| cut -d. -f2 \
| { read p; pad=$(( (4 - ${#p} % 4) % 4 )); printf '%s%s' "$p" "$(printf '%*s' "$pad" '' | tr ' ' '=')" | tr '_-' '/+' | base64 -d; } \
| jq '{aud}'
{
  "aud": null
}

<param>
    <name>knox.token.audiences</name>
    <value>test1,test2</value>
</param>

curl -sku guest:guest-password -X GET \
  "https://localhost:8443/gateway/tokenissuer/knoxtoken/api/v2/token?lifespan=P0DT1H0M" \
| jq -r '.access_token' \
| cut -d. -f2 \
| { read p; pad=$(( (4 - ${#p} % 4) % 4 )); printf '%s%s' "$p" "$(printf '%*s' "$pad" '' | tr ' ' '=')" | tr '_-' '/+' | base64 -d; } \
| jq '{aud}'
{
  "aud": [
    "test1",
    "test2"
  ]
}

curl -sku guest:guest-password -X GET \
  "https://localhost:8443/gateway/tokenissuer/knoxtoken/api/v2/token?lifespan=P0DT1H0M&audience=test1,test2" \
| jq -r '.access_token' \
| cut -d. -f2 \
| { read p; pad=$(( (4 - ${#p} % 4) % 4 )); printf '%s%s' "$p" "$(printf '%*s' "$pad" '' | tr ' ' '=')" | tr '_-' '/+' | base64 -d; } \
| jq '{aud}'
{
  "aud": [
    "test1",
    "test2"
  ]
}

curl -sku guest:guest-password -X GET \
  "https://localhost:8443/gateway/tokenissuer/knoxtoken/api/v2/token?lifespan=P0DT1H0M&audience=test1" \
| jq -r '.access_token' \
| cut -d. -f2 \
| { read p; pad=$(( (4 - ${#p} % 4) % 4 )); printf '%s%s' "$p" "$(printf '%*s' "$pad" '' | tr ' ' '=')" | tr '_-' '/+' | base64 -d; } \
| jq '{aud}'
{
  "aud": "test1"
}

curl -sku guest:guest-password -X GET \
  "https://localhost:8443/gateway/tokenissuer/knoxtoken/api/v2/token?lifespan=P0DT1H0M&audience=test1,bad"
{
  "error": "The requested audience 'bad' is not allowed.",
  "code": 100
}

curl -sku guest:guest-password -X GET \
  "https://localhost:8443/gateway/tokenissuer/knoxtoken/api/v2/token?lifespan=P0DT1H0M&audience=bad"
{
  "error": "The requested audience 'bad' is not allowed.",
  "code": 100
}

Integration Tests

N/A

UI changes

N/A

[github-actions]

Test Results

 4 files   4 suites   9s ⏱️
55 tests 55 ✅ 0 💤 0 ❌
66 runs  66 ✅ 0 💤 0 ❌

Results for commit 8d4092f.