KNOX-3432: Advertise RFC 8693 token-exchange grant type in KnoxIDF discovery metadata

Author: smolnar82

.github/workflows/tests/test_knoxidf.py

@@ -66,7 +66,11 @@ def test_discovery(self):
         self.assertEqual(config.get("response_types_supported"), ["code"])
         self.assertEqual(
             config.get("grant_types_supported"),
-            ["authorization_code", "refresh_token"],
+            [
+                "authorization_code",
+                "refresh_token",
+                "urn:ietf:params:oauth:grant-type:token-exchange",
+            ],
         )
         self.assertEqual(config.get("id_token_signing_alg_values_supported"), ["RS256"])
         # DEFAULT_SCOPES is an ImmutableSet, so discovery emits it in insertion order.

gateway-service-knoxidf/src/main/java/org/apache/knox/gateway/service/knoxidf/DiscoveryResource.java

@@ -85,7 +85,7 @@ public Response getConfig(@Context UriInfo uriInfo) {
         // field is absent, but stating it tells MCP clients to use dynamic client registration
         // (registration_endpoint) rather than a URL client_id. Flip to true only if CIMD is implemented.
         config.put("client_id_metadata_document_supported", Boolean.FALSE);
-        config.put("grant_types_supported", new String[]{KnoxIDFConstants.AUTH_CODE, KnoxIDFConstants.REFRESH_TOKEN});
+        config.put("grant_types_supported", new String[]{KnoxIDFConstants.AUTH_CODE, KnoxIDFConstants.REFRESH_TOKEN, KnoxIDFConstants.TOKEN_EXCHANGE_GRANT_TYPE});
         config.put("scopes_supported", KnoxIDFConstants.DEFAULT_SCOPES);
         config.put("id_token_signing_alg_values_supported", new String[]{"RS256"});
         // Advertise only S256: AuthorizeResource rejects any other code_challenge_method (including

gateway-service-knoxidf/src/test/java/org/apache/knox/gateway/service/knoxidf/DiscoveryResourceMetadataTest.java

@@ -24,6 +24,7 @@
 import javax.ws.rs.core.Response;
 import javax.ws.rs.core.UriInfo;
 
+import org.apache.knox.gateway.util.knoxidf.KnoxIDFConstants;
 import org.easymock.EasyMock;
 import org.junit.Test;
 
@@ -65,5 +66,12 @@ public void testAdvertisesSubjectTypesAndRegistrationEndpoint() {
     // CIMD is not implemented, so it must be advertised explicitly as false (never true).
     assertTrue("client_id_metadata_document_supported must be present and false.",
         body.contains("\"client_id_metadata_document_supported\":false"));
+
+    assertTrue("grant_types_supported must advertise authorization_code.",
+        body.contains("grant_types_supported") && body.contains("\"" + KnoxIDFConstants.AUTH_CODE + "\""));
+    assertTrue("grant_types_supported must advertise refresh_token.",
+        body.contains("\"" + KnoxIDFConstants.REFRESH_TOKEN + "\""));
+    assertTrue("grant_types_supported must advertise the RFC 8693 token-exchange grant type.",
+        body.contains("\"" + KnoxIDFConstants.TOKEN_EXCHANGE_GRANT_TYPE + "\""));
   }
 }

gateway-util-common/src/main/java/org/apache/knox/gateway/util/knoxidf/KnoxIDFConstants.java

@@ -44,6 +44,10 @@ public interface KnoxIDFConstants {
     String STATE = "state";
     String CODE = "code";
     String REFRESH_TOKEN = "refresh_token";
+    // This is intentionally duplicated from JWTFederationFilter.TOKEN_EXCHANGE rather than shared:
+    // it is a fixed standard identifier that will not change, and duplicating it avoids a module
+    // dependency on the JWT federation provider.
+    String TOKEN_EXCHANGE_GRANT_TYPE = "urn:ietf:params:oauth:grant-type:token-exchange";
     String REFRESH_TOKEN_TTL= "refresh.token.ttl";
     long REFRESH_TOKEN_TTL_DEFAULT = 86400000L; // 1 day
     String CODE_RESPONSE_TYPE = RESPONSE_TYPE + "=" + CODE;