[KNOX-2210] Gateway-level configuration for server-managed Knox token state

• Type: Bug
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 1.4.0
• Component/s: Server
• Assignee: Philip Zampino
• Reporter: Philip Zampino
• Created: 30/Jan/20 14:48
• Updated: 11/Feb/20 02:09
• Resolved: 11/Feb/20 02:09

Description

Currently, use of the token state service by Knox Token service deployments and JWT providers is configured independently. This is due to the fact that there can be multiple deployments of the Knox Token service (i.e., multiple topologies), and each can choose whether server-management of token state is desired.

However, in the simplest deployment scenarios, there is a single topology providing the Knox Token service, and one or more topologies with providers that verify those tokens for authentication. In these cases, would be simpler to have a single gateway-level configuration property that enables/disables the use of the TokenStateService for all KnoxToken service deployments and JWT provider deployments.

The KnoxToken service and the providers should check for a topology-level override (e.g., service param, provider param), which should be applied if present. In the absence of an topology-level override, the gateway-level configuration property should be referenced and applied.

 

Issue Links

• relates to: KNOX-2067 KnoxToken service support for renewal and revocation
• links to: GitHub Pull Request #259