Skip to content

Knox as OIDC Provider#1215

Open
smolnar82 wants to merge 26 commits into
apache:knox_idffrom
smolnar82:knox_idf_smolnar
Open

Knox as OIDC Provider#1215
smolnar82 wants to merge 26 commits into
apache:knox_idffrom
smolnar82:knox_idf_smolnar

Conversation

@smolnar82
Copy link
Copy Markdown
Contributor

@smolnar82 smolnar82 commented Apr 27, 2026 •
edited
Loading

What changes were proposed in this pull request?

Knox becomes an OIDC Provider itself. Until this change it was participating OIDC flows as a Service Provider only through the pac4j federation filter.
This PR is driven by KIP-18.

How was this patch tested?

Manually tested the

  • client credentials flow
  • authorization code flow
    • purely from Knox
    • through federation (using KeyCloak and Auth0)
    • with PKCE

Integration Tests

Added Docker-based integration tests that cover the flows described above.

UI changes

The login page has been updated in a way such that it lists all pre-configured federated OPs, if any.

@smolnar82 smolnar82 self-assigned this Apr 27, 2026
@smolnar82 smolnar82 marked this pull request as draft April 27, 2026 09:32
@github-actions
Copy link
Copy Markdown

github-actions Bot commented Apr 27, 2026 •
edited
Loading

Test Results

27 tests   27 ✅  3s ⏱️
 1 suites   0 💤
 1 files     0 ❌

Results for commit 2ba32fa.

♻️ This comment has been updated with latest results.

@hanicz
KNOX-3311: Fix X509CertificateUtil.fetchPublicCertsFromServer issue w… (
4f94d95 
apache#1217)

* KNOX-3311: Fix X509CertificateUtil.fetchPublicCertsFromServer issue where default truststore can't be loaded due to invalid/missing password

* KNOX-3311: Added unit tests
@smolnar82 smolnar82 force-pushed the knox_idf_smolnar branch from 8a46369 to b72fcfd Compare May 5, 2026 11:17
@smolnar82 smolnar82 force-pushed the knox_idf_smolnar branch 2 times, most recently from 7f07a3f to 2bb7979 Compare May 5, 2026 14:32
@hanicz
KNOX-3315: Adds BCFKS as an option cert export (apache#1221)
df17516 
* KNOX-3315: Adds BCFKS as an option cert export

* KNOX-3315: Address review comments
@smolnar82 smolnar82 force-pushed the knox_idf_smolnar branch from 2bb7979 to 8a12ee4 Compare May 6, 2026 12:42
@lmccay
KNOX-3312 - Client Credentials Flow with HTTP Basic needs Unwrapped S… (
fb70788 
apache#1219)

KNOX-3312 - Client Credentials Flow with HTTP Basic needs Unwrapped Servlet Request
@smolnar82 smolnar82 marked this pull request as ready for review May 6, 2026 14:38
smolnar82 and others added 11 commits May 8, 2026 12:04
@smolnar82
Copy link
Copy Markdown
Contributor Author

smolnar82 commented May 15, 2026 •
edited
Loading

As part of this PR I modified the Docker-based test orchestration as well, I'll update the README.md later on...

 I have unified the Docker build process and streamlined the CI workflow.

  Key Changes:
   1. Unified Dockerfile: I've updated .github/workflows/build/Dockerfile to be the single source of truth. It now handles the extraction of pre-built Knox and KnoxShell tarballs from the target directory.
   2. Simplified Docker Compose: .github/workflows/compose/docker-compose.yml now uses the project root as its context and points to the unified Dockerfile. I also removed the redundant knox-dev-local service.
   3. Cleaner CI Workflow: In .github/workflows/tests.yml, I removed the manual "Extract Artifacts" step and the unnecessary environment variables (KNOX_URL, BRANCH). The Docker build now directly consumes the artifacts produced by the Maven
      step.
   4. Removed Redundancy: I deleted Dockerfile.local as it is no longer needed.

  The local workflow is now perfectly aligned with the CI:
   1. Run mvn clean install -DskipTests -Ppackage (or similar) on your host.
   2. Run docker compose build knox-dev in .github/workflows/compose/.
   3. The Docker build will be extremely fast as it just copies and extracts your local artifacts.

Now the tests are completed in 5 mins as opposed to the previous 17-18 mins rounds.

Cc. @moresandeep @hanicz (wrt. KNOX-3256)

@smolnar82 smolnar82 changed the title Knox IDF - First steps Knox as OIDC Provider May 15, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@hanicz hanicz Awaiting requested review from hanicz

@moresandeep moresandeep Awaiting requested review from moresandeep

@pzampino pzampino Awaiting requested review from pzampino

@bonampak bonampak Awaiting requested review from bonampak

Assignees

@smolnar82 smolnar82

Labels

KnoxIDF

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

4 participants

@smolnar82 @hanicz @lmccay @moresandeep