[KNOX-2211] AliasBasedTokenStateService should store token state in topology-specific credential stores

• Type: Bug
• Status: Resolved
• Priority: Major
• Resolution: Not A Problem
• Affects Version/s: 1.4.0
• Component/s: Server
• Assignee: Philip Zampino
• Reporter: Philip Zampino
• Created: 30/Jan/20 14:56
• Updated: 11/Mar/20 14:40
• Resolved: 11/Mar/20 14:40

Description

Currently, the AliasBasedTokenStateService persists all token state in the gateway's central credential store rather than a topology-specific credential store. This was done because the providers that also employ the TokenStateService do not know from which topology a token was produced, and therefore have not enough information to correctly specify a topology credential store.

It may be possible to include this missing topology information in the tokens themselves, such that the providers (or the TokenStateService) would be able to correctly specify the topology credential store.

Issue Links

• relates to: KNOX-2067 KnoxToken service support for renewal and revocation
• relates to: KNOX-2266 Tokens Should Include a Unique Identifier