KNOX-3438: validate configured default token TTL against admin API bounds at startup

Author: smolnar82

gateway-server/src/main/java/org/apache/knox/gateway/services/knoxidf/delegation/EmptyDelegationPolicyService.java

@@ -85,4 +85,12 @@ public DelegationPolicyList list(String actorAuthorityFilter) {
   public PolicyDecision evaluate(PolicyCheckRequest request) {
     return new PolicyDecision("service_not_configured", 0);
   }
+
+  @Override
+  public int getConfiguredTokenTtlSec() {
+    // This stub is only in play when the service role is not deployed (so the admin API is not
+    // deployed either). Return the gateway-config default so any bounds check still sees an
+    // in-range value rather than 0.
+    return GatewayConfig.DELEGATION_SERVICE_TOKEN_TTL_SEC_DEFAULT;
+  }
 }

gateway-server/src/main/java/org/apache/knox/gateway/services/knoxidf/delegation/JdbcDelegationPolicyService.java

@@ -204,6 +204,11 @@ public DelegationPolicyList list(String actorAuthorityFilter) {
     }
   }
 
+  @Override
+  public int getConfiguredTokenTtlSec() {
+    return configuredKnoxTokenTtlSec;
+  }
+
   @Override
   public PolicyDecision evaluate(PolicyCheckRequest request) {
     // Step 1: look up registration

gateway-service-knoxidf/src/main/java/org/apache/knox/gateway/service/knoxidf/DelegationPolicyResource.java

@@ -96,13 +96,24 @@ public void init() {
     final GatewayServices services = (GatewayServices)
         servletContext.getAttribute(GatewayServices.GATEWAY_SERVICES_ATTRIBUTE);
     policyService = services.getService(ServiceType.DELEGATION_POLICY_SERVICE);
+    configureTtlBounds();
+  }
 
+  private void configureTtlBounds() {
     minTokenTtlSec = readPositiveIntParam(MIN_TOKEN_TTL_SEC_PARAM, DEFAULT_MIN_TOKEN_TTL_SEC);
     maxTokenTtlSec = readPositiveIntParam(MAX_TOKEN_TTL_SEC_PARAM, DEFAULT_MAX_TOKEN_TTL_SEC);
     if (minTokenTtlSec > maxTokenTtlSec) {
       throw new IllegalStateException("Invalid delegation policy TTL bounds: "
-          + MIN_TOKEN_TTL_SEC_PARAM + " (" + minTokenTtlSec + ") must not exceed "
-          + MAX_TOKEN_TTL_SEC_PARAM + " (" + maxTokenTtlSec + ")");
+              + MIN_TOKEN_TTL_SEC_PARAM + " (" + minTokenTtlSec + ") must not exceed "
+              + MAX_TOKEN_TTL_SEC_PARAM + " (" + maxTokenTtlSec + ")");
+    }
+
+    final int configuredDefaultTtlSec = policyService.getConfiguredTokenTtlSec();
+    if (configuredDefaultTtlSec < minTokenTtlSec || configuredDefaultTtlSec > maxTokenTtlSec) {
+      throw new IllegalStateException("Configured default delegation token TTL ("
+              + configuredDefaultTtlSec + "s) is outside the enforced bounds [" + minTokenTtlSec + ", "
+              + maxTokenTtlSec + "]; policies without an explicit tokenTtlSec would receive an "
+              + "out-of-range effective TTL");
     }
   }
 

gateway-service-knoxidf/src/test/java/org/apache/knox/gateway/service/knoxidf/DelegationPolicyResourceTest.java

@@ -1186,6 +1186,7 @@ public void testInstantFieldsSerializeAsIso8601() throws Exception {
   @Test
   public void testInitWiresServiceFromGatewayServices() throws Exception {
     final DelegationPolicyService svc = EasyMock.createNiceMock(DelegationPolicyService.class);
+    EasyMock.expect(svc.getConfiguredTokenTtlSec()).andReturn(3600).anyTimes();
     EasyMock.replay(svc);
 
     final GatewayServices gws = EasyMock.createNiceMock(GatewayServices.class);
@@ -1229,8 +1230,20 @@ public void testInitRejectsMinGreaterThanMax() throws Exception {
       initResourceWithBounds("7200", "120");
   }
 
+  @Test(expected = IllegalStateException.class)
+  public void testInitRejectsConfiguredDefaultOutsideBounds() throws Exception {
+    // Default bounds are [60, 86400]; a gateway-wide default above max would let policies without
+    // an explicit tokenTtlSec yield an out-of-range effective TTL, so init() must fail fast.
+    initResource(null, null, 100000);
+  }
+
   private DelegationPolicyResource initResourceWithBounds(String min, String max) throws Exception {
+    return initResource(min, max, 3600);
+  }
+
+  private DelegationPolicyResource initResource(String min, String max, int configuredDefault) throws Exception {
     final DelegationPolicyService svc = EasyMock.createNiceMock(DelegationPolicyService.class);
+    EasyMock.expect(svc.getConfiguredTokenTtlSec()).andReturn(configuredDefault).anyTimes();
     EasyMock.replay(svc);
 
     final GatewayServices gws = EasyMock.createNiceMock(GatewayServices.class);

gateway-spi/src/main/java/org/apache/knox/gateway/services/knoxidf/delegation/DelegationPolicyService.java

@@ -80,4 +80,13 @@ public interface DelegationPolicyService extends Service {
   DelegationPolicyList list(String actorAuthorityFilter);
 
   PolicyDecision evaluate(PolicyCheckRequest request);
+
+  /**
+   * @return the gateway-wide default token TTL (seconds) that {@link #evaluate} applies when a
+   *     policy does not pin its own tokenTtlSec. Exposed so the admin API can validate this
+   *     fallback against its configured [min, max] bounds at startup and fail fast on an
+   *     out-of-range value -- otherwise policies stored without an explicit tokenTtlSec would
+   *     yield an effective TTL outside the range the API enforces for explicit values.
+   */
+  int getConfiguredTokenTtlSec();
 }