Knox 3405 08 06 - #1340
Open
hsheinblatt wants to merge 2 commits into
Open
Conversation
added 2 commits
August 6, 2026 16:26
…bute on token-exchange Test issues to improve: Several tests use a helper rather than a mock, DynamicJwksPassTokenAuthority. This causes ambiguity in what method precisely was called and what failed. Additionally, fixing that becomes more complex because the token exchange requests use both a subject token and an actor token, so both tokens are validated, and it's either ambiguous or complex to ensure that each token validation path is correct. EasyMock should allow a range of times(0, 1) to be called, so we can make the appropriate signature verification optional for negative tests. That is, we can write the tests so that the order of enforcement for each condition is arbitrary: all the other conditions would evaluate to true if executed first. Once the actor token is made optional, we can simplify the negative test cases to use only a subject token, and then specify the mocks precisely so each negative test case validates the correct methods are called, if called, and no extra methods are called, the test can be insensitive to the order of validation checks, and we can remove the DynamicJwksPassTokenAuthority helper.
…alidation independent, and ensure that both the single subject token and the subject plus actor token request paths are covered.
lmccay
reviewed
Aug 9, 2026
Contributor
There was a problem hiding this comment.
@hsheinblatt - please provide more of a description and some details of the tests that you added and ran altogether. I'd also like to make sure that if some error messages/logs were changed for certain behavior that we know what they are. It looks like you probably fixed some previously inaccurate log messages. There may be implications for others tests and integrations. Also, change the PR Title to reflect the Jira name.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
KNOX-3405 - Extend JWTFederationFilter for dynamic JWKS and iss attribute on token-exchange
How was this patch tested?
Unit tests were added
Integration Tests
N/A Will be added once flow is complete