Google GitGoogle Git
Sign in
apache/knox/HEAD
  1. 962e3ee KNOX-3518: Pin vitest to 4.1.11 to work around npm peer-resolution crash in UI builds (#1458) by Sandor Molnar · 2 days ago master
  2. f3d9bbd KNOX-3516: Log and describe JWT rejections caused by an untrusted issuer (#1457) by Sandor Molnar · 2 days ago
  3. a4d73aa KNOX-3514: Login and logout faviocn and title branding (#1455) by hanicz · 3 days ago
  4. 2c88621 KNOX-3509 - Add k8s service DNS audience form, non-delegation audience validation, etc (#1448) via Harrison <hsheinblatt@cloudera.com> by hsheinblatt · 3 days ago
  5. fff8f54 KNOX-3512: Per-issuer CA bundle (jwksCa) for trusted OIDC issuers (#1451) by Sandor Molnar · 3 days ago
  6. 3c4c6e1 KNOX-3513 - Add capped retry for resolving LDAP backend password aliases (#1453) by Sandor Molnar · 3 days ago
  7. 8a55ebe KNOX-3510 - Normalize decoded dispatch URLs and reject path traversal (#1449) by Phil Zampino · 5 days ago
  8. 30a18b4 KNOX-3511: Gateway ignores gateway-reloadable.xml if the file did not exist at startup (#1450) by hanicz · 5 days ago
  9. 6842542 KNOX-3505 - Extend auth page themes to logout session page (#1442) by arsrivastava-cloudera · 7 days ago
  10. 07afc00 KNOX-3506: Knox's default login page flashes before modern login page displayed (#1445) by hanicz · 10 days ago
  11. 234b966 KNOX-3508: Bundle UI icons locally so they render in air-gapped networks (#1444) by Sandor Molnar · 10 days ago
  12. bd52076 KNOX-3501 - JWT cookie tokens fail validation when knox.token.exp.server-managed=true (#1441) by Sandeep Moré · 11 days ago
  13. 836bfe4 Bump org.bouncycastle:bcprov-jdk18on from 1.84 to 1.85 (#1418) by dependabot[bot] · 12 days ago
  14. 315ae7c KNOX-3488: Harden original-url cookie validation (#1429) by hanicz · 2 weeks ago
  15. 0bd23de KNOX-3498: Reject IP-literal OIDC issuer registration via topology-configurable flag (#1438) by Sandor Molnar · 2 weeks ago
  16. efa4132 KNOX-3502: AliasService.isAlias recognizes the canonical ${ALIAS=} prefix in addition to the Shiro-escaped S{ALIAS=} form (#1439) by Sandor Molnar · 2 weeks ago
  17. 9bb2215 KNOX-3498 - In cases of failures with OIDC issuer discovery url containing IP addresses log a proper error and warn message. (#1437) by Sandeep Moré · 2 weeks ago
  18. 7dfa327 KNOX-3497: Resolve credential-store aliases in LDAP proxy backend password properties (#1436) by Sandor Molnar · 2 weeks ago
  19. a42ffc3 KNOX-3496: LDAP Proxy requests memberOf attribute from backend (#1435) by David Han · 2 weeks ago
  20. b4d3ef2 KNOX-3485: Roles lookup replaces group entries with role entries (#1428) by David Han · 3 weeks ago
  21. a9e2733 KNOX-3491 - Add pluggable request audience validation, with a Kubernetes destination validator (#1432) by hsheinblatt · 3 weeks ago
  22. 8fc8018 KNOX-3493: Add k8s SA policy-enforced actor-token and headless requested_subject delegation E2E tests (#1434) by Sandor Molnar · 3 weeks ago
  23. 51ceaf2 KNOX-3492: Update CHANGES with 2.1.1 release (#1433) by hanicz · 3 weeks ago
  24. 119d488 KNOX-3490: Key LDAP roles lookup on the uid attribute, augmenting the backend search with it when the client omits it (#1431) by Sandor Molnar · 3 weeks ago
  25. 7d4e4fa KNOX-3489: Log request/response when calling remote role lookup server (#1430) by Sandor Molnar · 3 weeks ago
  26. 7489115 KNOX-3478 - Add support to forward auth tokens in KNOX-AUTH-SERVICE (#1425) by Sandeep Moré · 3 weeks ago
  27. 189d1f7 KNOX-3480: Support user-supplied clientId in the Client Credentials endpoint (#1422) by Sandor Molnar · 3 weeks ago
  28. ef67c1d KNOX-3452: Add comprehensive unit tests for MimeTypes (#1393) by Raghav Maheshwari · 4 weeks ago
  29. 40097fc KNOX-3474: Add spark4historyui Knox service definition (#1413) by samuhasavak5 · 4 weeks ago
  30. fbf3332 KNOX-3473: Add livy_for_spark4 Knox service definition (#1412) by samuhasavak5 · 4 weeks ago
  31. 02428a7 KNOX-3477: Capture the RFC 8693 delegation actor-chain in gateway-audit.log (#1419) by hanicz · 4 weeks ago
  32. d4e995e KNOX-3472: Add livy_for_spark3 Knox service definition (#1411) by samuhasavak5 · 4 weeks ago
  33. b0fc823 KNOX-3476: add RFC 8693 delegation-path integration tests (policy lookup, act/aud minting, TTL cap, headless) (#1416) by Sandor Molnar · 4 weeks ago
  34. 20b6d6b KNOX-3470 - Add support for /.well-known/oauth-authorization-server (#1417) by Sandeep Moré · 4 weeks ago
  35. d2d808a KNOX-3475: enforce delegation policy status at authorization time so a revoked (not deleted) policy no longer authorizes token exchange (#1414) by Sandor Molnar · 4 weeks ago
  36. d1204b9 KNOX-3460: audit all RFC 8693 token-exchange paths pre-mint and add a mint-time TOKEN_EXCHANGE audit emitting jti/expiry/issued_subject (#1409) by Sandor Molnar · 4 weeks ago
  37. fe51d3d KNOX-3464: document KnoxIDF RFC 8693 token exchange & delegation; fix KnoxIDF config reference (#1410) by Sandor Molnar · 4 weeks ago
  38. 1bebbfa KNOX-3471: KnoxIDF expires_in should return relative second instead o… (#1408) by hanicz · 4 weeks ago
  39. 377d841 KNOX-3466: add CI integration tests for RFC 8693 same-subject requested-audience authorization (#1407) by Sandor Molnar · 4 weeks ago
  40. 6c34ad4 KNOX-3461: authorize same-subject requested audience against the subject token's aud via delegation.same.subject.requested.audience.enabled (#1405) by Sandor Molnar · 4 weeks ago
  41. da99fa6 KNOX-3465: add CI integration tests for RFC 8693 token exchange (same-subject and delegation gating) (#1406) by Sandor Molnar · 4 weeks ago
  42. 78b94fa KNOX-3238: Migrate from javax.servlet to jakarta.servlet servlet-api (#1388) by Sandor Molnar · 4 weeks ago
  43. 29a6520 Backport v3.0.0 docs changes to master and changing version to 3.1.0 (#1404) by hanicz · 4 weeks ago
  44. 1460b2b KNOX-3458: enforce a configurable maximum actor-chain depth in token exchange (#1400) by Sandor Molnar · 4 weeks ago
  45. cc6ec93 KNOX-3459: honor delegation policy tokenTtlSec as the minted token's expiry basis (#1401) by Sandor Molnar · 4 weeks ago
  46. 736c215 KNOX-3462: Fix github docs links (#1403) by hanicz · 4 weeks ago
  47. 095ade4 KNOX-3456: resolve canActFor.groups via KnoxLDAPService group lookup, failing with server_error when LDAP is unavailable (#1402) by Sandor Molnar · 5 weeks ago
  48. c9e04a0 KNOX-3457: Remove unused delegation.requested.scope.enabled provider parameter (#1399) by Sandor Molnar · 5 weeks ago
  49. 9c0a6cc KNOX-3441: add delegated token exchange (actor-token and headless) with policy enforcement and audit (#1398) by hsheinblatt · 5 weeks ago
  50. 6b4d83e KNOX-3453: Ignore runtime-generated gateway-server/data/security directory in git (#1397) by Sandor Molnar · 5 weeks ago
  51. 746c865 KNOX-3449: Prove Knox accepts Kubernetes ServiceAccount tokens on the RFC 8693 token-exchange path (#1396) by Sandor Molnar · 5 weeks ago
  52. 739011b KNOX-3445: KnoxIDF admin service stays disabled (Empty stub) when KNOXIDF_ADMIN topology is hot-deployed after gateway startup (#1394) by hanicz · 5 weeks ago
  53. ea1378a KNOX-3446: Change version to 3.1.0, Update NOTICE and CHANGES (#1386) by hanicz · 5 weeks ago
  54. 3f520b7 KNOX-3410: Add unit tests for XForwardedHeaderRequestWrapper (#1391) by shreyaaryaofficial · 5 weeks ago
  55. 8697bc7 KNOX-3444: Optimize CM discovery memory usage by only caching role configurations that ServiceModelGenerators actually use (#1392) by bonampak · 5 weeks ago
  56. 0a3a794 KNOX-3450: Add Transfer-Encoding to set of excluded headers in PassAllHeadersDispatch (#1389) by Phil Zampino · 5 weeks ago
  57. b2d2843 KNOX-3447: Harden ServiceDefinitonUnmarshaller (#1387) by hanicz · 5 weeks ago
  58. 38cc0f4 KNOX-3442: Reject INIT/RUNSCRIPT/ALIAS in H2 database name to prevent JDBC-URL code execution (#1383) by Sandor Molnar · 5 weeks ago
  59. 8872f98 KNOX-3438: Address review comments from delegation policy admin API (#1381) by Sandor Molnar · 6 weeks ago
  60. 6e02570 KNOX-3440: Remove HSQLDB completely from Knox (#1382) by Sandor Molnar · 6 weeks ago
  61. a919d15 KNOX-3401: Replace Derby with H2 (#1380) by Sandor Molnar · 6 weeks ago
  62. 6fce042 KNOX-3432: Advertise RFC 8693 token-exchange and client_credentials grant types in KnoxIDF discovery metadata (#1376) by Sandor Molnar · 6 weeks ago
  63. 7b90d0d KNOX-3439: Add tests for NoClassNameMultiLineToStringStyle (#1378) by Raghav Maheshwari · 6 weeks ago
  64. a8a43ae KNOX-3438: Add delegation policy admin API with upsert support for RFC 8693 token exchange (#1379) by hsheinblatt · 6 weeks ago
  65. e70fe0f KNOX-3434 - Allow missing typ when validating JWTs from TrustedOidcIssuers for token exchange. (#1377) by hsheinblatt · 6 weeks ago
  66. 3cb11c6 KNOX-3424: Complete RFC 8707/8693 dynamic resource/audience handling in KNOXTOKEN and token exchange (#1373) by Sandor Molnar · 6 weeks ago
  67. 6f94600 KNOX-3433: set issued_token_type in KnoxIDF token responses (RFC 8693 §2.2.1) (#1375) by Sandor Molnar · 6 weeks ago
  68. af3b298 KNOX-3426: Embedded-Derby delegation policy service (#1374) by Sandor Molnar · 6 weeks ago
  69. 683841b KNOX-3426 - Add DelegationPolicyService schema, interface, and JDBC implementation (#1361) by hsheinblatt · 6 weeks ago
  70. 8ac5a45 KNOX-3431: UserSearchInterceptor throws exceptions on failed search (#1372) by David Han · 6 weeks ago
  71. f77ffb2 KNOX-3424: Dynamic audience handling in the KNOXTOKEN service (#1356) by hanicz · 6 weeks ago
  72. a5fb4e7 KNOX-3419: Tests for the recent improvements (#1369) by hanicz · 6 weeks ago
  73. 7d719ca KNOX-3430: Deprecate AccessTokenFederationFilter, also added UnsupportedOperatorException (#1370) by hanicz · 7 weeks ago
  74. 31419b7 KNOX-3422: Update service_ldap_server.md (#1371) by David Han · 7 weeks ago
  75. 1f5d5c0 KNOX-3429: Harden source assembly to exclude build caches, runtime state, and staging dirs (#1368) by Sandor Molnar · 7 weeks ago
  76. c40480e KNOX-3428: Bump Spring to 6.2.19 and add HashiCorp Vault alias service integration tests (#1367) by Sandor Molnar · 7 weeks ago
  77. c213bba KNOX-3427: Bump Netty to 1.137.Final due to CVEs (#1366) by Sandor Molnar · 7 weeks ago
  78. 1832299 KNOX-3423: Switch to JSON error messages in Knox token validation paths (#1354) by hanicz · 7 weeks ago
  79. 2a909a7 KNOX-3395: Add KNOXTOKEN issuance and JWTProvider federation integration tests (#1325) by Raghav Maheshwari · 7 weeks ago
  80. 1e25461 Bump org.mariadb.jdbc:mariadb-java-client from 3.3.0 to 3.3.5 (#1363) by dependabot[bot] · 7 weeks ago
  81. 95e3b66 KNOX-3420 - Upgrade Jetty from 9.x 12.x (#1360) by Sandeep Moré · 7 weeks ago
  82. c776132 KNOX-3422: Ldap Proxy used in-memory bind user (#1357) by David Han · 7 weeks ago
  83. d910510 KNOX-3406: LDAP Proxy backend improve error handling (#1355) by David Han · 7 weeks ago
  84. 1cfef0d KNOX-3425: LDAP Proxy disallows anonymous binds to remote backends (#1358) by David Han · 7 weeks ago KNOX-2
  85. 9522a5b KNOX-3421 - Upgrade Shiro to 2.2.1 (#1353) by Sandeep Moré · 8 weeks ago
  86. 114af08 KNOX-3278: Update JLine to 3.30.6 (#1181) by bonampak · 8 weeks ago
  87. d036056 KNOX-3394: Correct outdated unittest documentation in Docker Compose integration test README (#1324) by Raghav Maheshwari · 9 weeks ago
  88. 3c3f3b5 Bump org.apache.httpcomponents.client5:httpclient5 from 5.4.3 to 5.6.3 (#1350) by dependabot[bot] · 9 weeks ago
  89. b4b657f Bump org.apache.httpcomponents.core5:httpcore5 from 5.3.6 to 5.4.3 (#1347) by dependabot[bot] · 9 weeks ago
  90. f0a5c94 Knox as an OAuth 2.0 / OpenID Connect Provider (KnoxIDF) (#1351) by Sandor Molnar · 9 weeks ago
  91. de71a60 KNOX-3418: Path traversal → arbitrary file write/overwrite in the Apache Knox Admin API (#1349) by hanicz · 9 weeks ago
  92. 3cb8ef7 KNOX-3417: KnoxLdapRealm builds the LDAP search filter from the client username without RFC-4515 escaping (#1348) by hanicz · 9 weeks ago
  93. c3dee56 KNOX-3416: KnoxSSO redirects to untrusted site (#1346) by hanicz · 9 weeks ago
  94. 5342483 KNOX-3413: KnoxToken passcode verification accepts a valid passcode for a different token (#1345) by hanicz · 9 weeks ago
  95. 049dc0c KNOX-3411: KnoxToken getUserTokens returns every user's token metadat… (#1344) by hanicz · 10 weeks ago
  96. f212600 KNOX-3410: KnoxToken enable/disable endpoints perform no caller autho… (#1343) by hanicz · 10 weeks ago
  97. e511635 KNOX-3409: Validate knoxauth theme name to Harden Branding Support (Reported by Quinn Nguyen) (#1341) by lmccay · 10 weeks ago
  98. eb14d8b KNOX-3407: Support for WebSocket mTLS (#1338) by Sandeep Moré · 2 months ago
  99. e713c58 KNOX-3386: LDAP Proxy pages backends (#1331) by David Han · 3 months ago
  100. da08af1 KNOX-3403: RFC 8693 token exchange: use the impersonated subject as the token sub on non-server-managed topologies (#1336) by Sandor Molnar · 3 months ago