+++ /dev/null
-bff:
- access-control:
- ACTIONS_CREATE: [ portal_admin, portal_designer, portal_operator ]
- ACTIONS_GET: [ portal_admin, portal_designer, portal_operator ]
- ACTIONS_LIST: [ portal_admin, portal_designer, portal_operator ]
- ACTIVE_ALARM_LIST: [portal_admin, portal_designer, portal_operator]
- KEY_ENCRYPT_BY_USER: [portal_admin, portal_designer, portal_operator]
- KEY_ENCRYPT_BY_VALUE: [portal_admin, portal_designer, portal_operator]
- PREFERENCES_CREATE: [portal_admin, portal_designer, portal_operator]
- PREFERENCES_GET: [portal_admin, portal_designer, portal_operator]
- PREFERENCES_UPDATE: [portal_admin, portal_designer, portal_operator]
- ROLE_LIST: ["*"]
- USER_CREATE: [portal_admin, portal_designer, portal_operator]
- USER_DELETE: [portal_admin, portal_designer, portal_operator]
- USER_GET: [portal_admin, portal_designer, portal_operator]
- USER_LIST_AVAILABLE_ROLES: [portal_admin, portal_designer, portal_operator]
- USER_LIST_ROLES: [portal_admin, portal_designer, portal_operator]
- USER_LIST: [portal_admin, portal_designer, portal_operator]
- USER_UPDATE_PASSWORD: [portal_admin, portal_designer, portal_operator]
- USER_UPDATE_ROLES: [portal_admin, portal_designer, portal_operator]
- USER_UPDATE: [portal_admin, portal_designer, portal_operator]
preferences-url: ${PREFERENCES_URL}
history-url: ${HISTORY_URL}
keycloak-url: ${KEYCLOAK_URL}
+ keycloak-client-id: ${KEYCLOAK_CLIENT_ID}
endpoints:
unauthenticated: /api-docs.html, /api.yaml, /webjars/**, /actuator/**
+
rbac:
- endpoints-excluded: /actuator/**, **/actuator/**, */actuator/**, /**/actuator/**, /*/actuator/**
+ endpoints-excluded: ${RBAC_EXCLUDED_ENDPOINTS}:-/api-docs.html, /api.yaml, /webjars/**, /actuator/**, /users**, /roles**, /preferences**, /actions**}
.put("session_state", UUID.randomUUID().toString())
.put("scope", "email profile")
.toString())));
+
+ /*
+ * MockAuth for new RBAC permission via keycloak
+ */
+ WireMock.stubFor(
+ WireMock.post(
+ WireMock.urlMatching(
+ String.format("/realms/%s/protocol/openid-connect/token", realm)))
+ .withRequestBody(
+ WireMock.containing("grant_type=urn:ietf:params:oauth:grant-type:uma-ticket"))
+ .willReturn(
+ WireMock.aResponse()
+ .withHeader("Content-Type", MediaType.APPLICATION_JSON_VALUE)
+ .withBody(objectMapper.createObjectNode().put("result", "true").toString())));
}
/**
--- /dev/null
+/*
+ *
+ * Copyright (c) 2024. Deutsche Telekom AG
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ *
+ *
+ */
+
+package org.onap.portalng.bff.rbac;
+
+import com.github.tomakehurst.wiremock.client.WireMock;
+import io.restassured.http.Header;
+import org.junit.jupiter.api.Test;
+import org.onap.portalng.bff.BaseIntegrationTest;
+import org.springframework.http.HttpStatus;
+import org.springframework.http.MediaType;
+
+public class RoleBaseAccessIntegrationTest extends BaseIntegrationTest {
+
+ @Test
+ void thatRoleIsNotSufficient() {
+
+ WireMock.stubFor(
+ WireMock.post(
+ WireMock.urlMatching(
+ String.format("/realms/%s/protocol/openid-connect/token", realm)))
+ .withRequestBody(
+ WireMock.containing("grant_type=urn:ietf:params:oauth:grant-type:uma-ticket"))
+ .willReturn(
+ WireMock.aResponse()
+ .withHeader("Content-Type", MediaType.APPLICATION_JSON_VALUE)
+ .withStatus(HttpStatus.FORBIDDEN.value())));
+
+ requestSpecification()
+ .given()
+ .accept(MediaType.APPLICATION_JSON_VALUE)
+ .header(new Header("X-Request-Id", "addf6005-3075-4c80-b7bc-2c70b7d42b57"))
+ .when()
+ .get("/roles")
+ .then()
+ .statusCode(HttpStatus.FORBIDDEN.value());
+ }
+
+ @Test
+ void thatResourceIsNotAvailable() {
+
+ WireMock.stubFor(
+ WireMock.post(
+ WireMock.urlMatching(
+ String.format("/realms/%s/protocol/openid-connect/token", realm)))
+ .withRequestBody(
+ WireMock.containing("grant_type=urn:ietf:params:oauth:grant-type:uma-ticket"))
+ .willReturn(
+ WireMock.aResponse()
+ .withHeader("Content-Type", MediaType.APPLICATION_JSON_VALUE)
+ .withStatus(HttpStatus.BAD_REQUEST.value())));
+
+ requestSpecification()
+ .given()
+ .accept(MediaType.APPLICATION_JSON_VALUE)
+ .header(new Header("X-Request-Id", "addf6005-3075-4c80-b7bc-2c70b7d42b57"))
+ .when()
+ .get("/roles")
+ .then()
+ .statusCode(HttpStatus.FORBIDDEN.value());
+ }
+
+ @Test
+ void thatRoleBaseCheckIsMalformed() {
+
+ WireMock.stubFor(
+ WireMock.post(
+ WireMock.urlMatching(
+ String.format("/realms/%s/protocol/openid-connect/token", realm)))
+ .withRequestBody(
+ WireMock.containing("grant_type=urn:ietf:params:oauth:grant-type:uma-ticket"))
+ .willReturn(
+ WireMock.aResponse()
+ .withHeader("Content-Type", MediaType.APPLICATION_JSON_VALUE)
+ .withBody(objectMapper.createObjectNode().put("result", "false").toString())));
+
+ requestSpecification()
+ .given()
+ .accept(MediaType.APPLICATION_JSON_VALUE)
+ .header(new Header("X-Request-Id", "addf6005-3075-4c80-b7bc-2c70b7d42b57"))
+ .when()
+ .get("/roles")
+ .then()
+ .statusCode(HttpStatus.FORBIDDEN.value());
+ }
+}
preferences-url: http://localhost:${wiremock.server.port}
history-url: http://localhost:${wiremock.server.port}
keycloak-url: http://localhost:${wiremock.server.port}
+ keycloak-client-id: test
+ endpoints:
+ unauthenticated: /api-docs.html, /api.yaml, /webjars/**, /actuator/**
+ rbac:
+ endpoints-excluded: /api-docs.html, /api.yaml, /webjars/**, /actuator/**
preferences-url: http://localhost:${wiremock.server.port}
history-url: http://localhost:${wiremock.server.port}
keycloak-url: http://localhost:${wiremock.server.port}
+ keycloak-client-id: test
endpoints:
unauthenticated: /api-docs.html, /api.yaml, /webjars/**, /actuator/**
rbac:
- endpoints-excluded: /actuator/**, **/actuator/**, */actuator/**, /**/actuator/**, /*/actuator/**
-
+ endpoints-excluded: /api-docs.html, /api.yaml, /webjars/**, /actuator/**
@NotBlank private final String preferencesUrl;
@NotBlank private final String historyUrl;
@NotBlank private final String keycloakUrl;
+ @NotBlank private final String keycloakClientId;
@NotNull private final Map<String, Set<String>> accessControl;
--- /dev/null
+/*
+ *
+ * Copyright (c) 2024. Deutsche Telekom AG
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ *
+ *
+ */
+
+package org.onap.portalng.bff.config;
+
+import com.fasterxml.jackson.databind.JsonNode;
+import com.fasterxml.jackson.databind.ObjectMapper;
+import lombok.extern.slf4j.Slf4j;
+import org.springframework.beans.factory.annotation.Value;
+import org.springframework.http.HttpHeaders;
+import org.springframework.http.HttpStatus;
+import org.springframework.http.MediaType;
+import org.springframework.stereotype.Component;
+import org.springframework.web.reactive.function.client.WebClient;
+import org.springframework.web.server.ServerWebExchange;
+import org.springframework.web.server.WebFilter;
+import org.springframework.web.server.WebFilterChain;
+import reactor.core.publisher.Mono;
+
+@Component
+@Slf4j
+public class KeycloakPermissionFilter implements WebFilter {
+
+ private final WebClient webClient;
+
+ private final ObjectMapper objectMapper;
+ private final BffConfig bffConfig;
+
+ @Value("${bff.rbac.endpoints-excluded}")
+ private String[] EXCLUDED_PATHS;
+
+ public KeycloakPermissionFilter(
+ WebClient.Builder webClientBuilder, ObjectMapper objectMapper, BffConfig bffConfig) {
+ this.webClient = webClientBuilder.build();
+ this.objectMapper = objectMapper;
+ this.bffConfig = bffConfig;
+ }
+
+ @Override
+ public Mono<Void> filter(ServerWebExchange exchange, WebFilterChain chain) {
+ String accessToken = exchange.getRequest().getHeaders().getFirst(HttpHeaders.AUTHORIZATION);
+ String uri = exchange.getRequest().getURI().getPath();
+ String method = exchange.getRequest().getMethod().toString();
+
+ for (String excludedPath : EXCLUDED_PATHS) {
+ if (uri.matches(excludedPath.replace("**", ".*"))) {
+ return chain.filter(exchange);
+ }
+ }
+
+ String body =
+ new StringBuilder()
+ .append("grant_type=urn:ietf:params:oauth:grant-type:uma-ticket")
+ .append("&audience=")
+ .append(bffConfig.getKeycloakClientId())
+ .append("&permission_resource_format=uri")
+ .append("&permission_resource_matching_uri=true")
+ .append("&permission=")
+ .append(uri)
+ .append("#")
+ .append(method)
+ .append("&response_mode=decision")
+ .toString();
+
+ return webClient
+ .post()
+ .uri(
+ bffConfig.getKeycloakUrl()
+ + "/realms/"
+ + bffConfig.getRealm()
+ + "/protocol/openid-connect/token")
+ .header(HttpHeaders.AUTHORIZATION, accessToken)
+ .contentType(MediaType.APPLICATION_FORM_URLENCODED)
+ .bodyValue(body)
+ .retrieve()
+ .bodyToMono(String.class)
+ .flatMap(
+ response -> {
+ if (isPermissionGranted(response)) {
+ return chain.filter(exchange);
+ } else {
+ exchange.getResponse().setStatusCode(HttpStatus.FORBIDDEN);
+ return exchange.getResponse().setComplete();
+ }
+ })
+ .onErrorResume(
+ ex -> {
+ exchange.getResponse().setStatusCode(HttpStatus.FORBIDDEN);
+ return exchange.getResponse().setComplete();
+ });
+ }
+
+ private boolean isPermissionGranted(String response) {
+ try {
+ JsonNode jsonNode = objectMapper.readTree(response);
+ if (jsonNode.has("result") && jsonNode.get("result").asBoolean()) {
+ return true;
+ }
+ } catch (Exception e) {
+ log.error("Error parsing JSON response", e);
+ }
+ return false;
+ }
+}
import static org.springframework.security.config.Customizer.withDefaults;
+import lombok.RequiredArgsConstructor;
import org.springframework.beans.factory.annotation.Value;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.web.reactive.EnableWebFluxSecurity;
+import org.springframework.security.config.web.server.SecurityWebFiltersOrder;
import org.springframework.security.config.web.server.ServerHttpSecurity;
import org.springframework.security.oauth2.client.ReactiveOAuth2AuthorizedClientManager;
import org.springframework.security.oauth2.client.ReactiveOAuth2AuthorizedClientProvider;
@Configuration
@EnableWebFluxSecurity
+@RequiredArgsConstructor
public class SecurityConfig {
+ private final KeycloakPermissionFilter keycloakPermissionFilter;
+
@Value("${bff.endpoints.unauthenticated}")
private String[] unauthenticatedEndpoints;
.authenticated())
.oauth2ResourceServer(ServerHttpSecurity.OAuth2ResourceServerSpec::jwt)
.oauth2Client(withDefaults())
+ .addFilterAfter(keycloakPermissionFilter, SecurityWebFiltersOrder.AUTHORIZATION)
.build();
}
package org.onap.portalng.bff.controller;
import org.onap.portalng.bff.config.BffConfig;
-import org.onap.portalng.bff.config.IdTokenExchangeFilterFunction;
-import org.springframework.web.server.ServerWebExchange;
-import reactor.core.publisher.Mono;
public abstract class AbstractBffController {
protected AbstractBffController(BffConfig bffConfig) {
this.bffConfig = bffConfig;
}
-
- public Mono<Void> checkRoleAccess(String method, ServerWebExchange exchange) {
- return bffConfig
- .getRoles(method)
- .flatMap(
- roles ->
- roles.contains("*")
- ? Mono.empty()
- : IdTokenExchangeFilterFunction.validateAccess(exchange, roles));
- }
}
@RestController
public class ActionsController extends AbstractBffController implements ActionsApi {
- public static final String CREATE = "ACTIONS_CREATE";
- public static final String GET = "ACTIONS_GET";
- public static final String LIST = "ACTIONS_LIST";
private final ActionService actionService;
String xRequestId,
Mono<CreateActionRequestApiDto> createActionRequestApiDto,
ServerWebExchange exchange) {
- return checkRoleAccess(CREATE, exchange)
- .then(createActionRequestApiDto)
+ return createActionRequestApiDto
.flatMap(action -> actionService.createAction(userId, xRequestId, action))
.map(ResponseEntity::ok);
}
Integer showLastHours,
String xRequestId,
ServerWebExchange exchange) {
- return checkRoleAccess(GET, exchange)
- .then(actionService.getActions(userId, xRequestId, page, pageSize, showLastHours))
+ return actionService
+ .getActions(userId, xRequestId, page, pageSize, showLastHours)
.map(ResponseEntity::ok);
}
Integer showLastHours,
String xRequestId,
ServerWebExchange exchange) {
- return checkRoleAccess(LIST, exchange)
- .then(actionService.listActions(xRequestId, page, pageSize, showLastHours))
+ return actionService
+ .listActions(xRequestId, page, pageSize, showLastHours)
.map(ResponseEntity::ok);
}
}
@RestController
public class PreferencesController extends AbstractBffController implements PreferencesApi {
- public static final String CREATE = "PREFERENCES_CREATE";
- public static final String GET = "PREFERENCES_GET";
- public static final String UPDATE = "PREFERENCES_UPDATE";
private final PreferencesService preferencesService;
@Override
public Mono<ResponseEntity<PreferencesResponseApiDto>> getPreferences(
String xRequestId, ServerWebExchange exchange) {
- return checkRoleAccess(GET, exchange)
- .then(preferencesService.getPreferences(xRequestId))
- .map(ResponseEntity::ok);
+ return preferencesService.getPreferences(xRequestId).map(ResponseEntity::ok);
}
@Override
@Valid Mono<CreatePreferencesRequestApiDto> preferencesApiDto,
String xRequestId,
ServerWebExchange exchange) {
- return checkRoleAccess(CREATE, exchange)
- .then(preferencesApiDto)
+ return preferencesApiDto
.flatMap(request -> preferencesService.createPreferences(xRequestId, request))
.map(ResponseEntity::ok);
}
@Valid Mono<CreatePreferencesRequestApiDto> preferencesApiDto,
String xRequestId,
ServerWebExchange exchange) {
- return checkRoleAccess(UPDATE, exchange)
- .then(preferencesApiDto)
+ return preferencesApiDto
.flatMap(request -> preferencesService.updatePreferences(xRequestId, request))
.map(ResponseEntity::ok);
}
@RestController
public class RolesController extends AbstractBffController implements RolesApi {
- public static final String LIST = "ROLE_LIST";
-
private final KeycloakService keycloakService;
public RolesController(BffConfig bffConfig, KeycloakService keycloakService) {
@Override
public Mono<ResponseEntity<RoleListResponseApiDto>> listRoles(
String xRequestId, ServerWebExchange exchange) {
- return checkRoleAccess(LIST, exchange)
- .thenMany(keycloakService.listRoles(xRequestId))
+ return keycloakService
+ .listRoles(xRequestId)
.collectList()
.map(roles -> new RoleListResponseApiDto().items(roles).totalCount(roles.size()))
.map(ResponseEntity::ok);
@RestController
public class UsersController extends AbstractBffController implements UsersApi {
- public static final String CREATE = "USER_CREATE";
- public static final String GET = "USER_GET";
- public static final String UPDATE = "USER_UPDATE";
- public static final String DELETE = "USER_DELETE";
- public static final String LIST = "USER_LIST";
- public static final String UPDATE_PASSWORD = "USER_UPDATE_PASSWORD";
- public static final String UPDATE_ROLES = "USER_UPDATE_ROLES";
- public static final String LIST_ROLES = "USER_LIST_ROLES";
- public static final String LIST_AVAILABLE_ROLES = "USER_LIST_AVAILABLE_ROLES";
-
private final KeycloakService keycloakService;
public UsersController(BffConfig bffConfig, KeycloakService keycloakService) {
@Override
public Mono<ResponseEntity<UserResponseApiDto>> createUser(
Mono<CreateUserRequestApiDto> requestMono, String xRequestId, ServerWebExchange exchange) {
- return checkRoleAccess(CREATE, exchange)
- .then(requestMono.flatMap(request -> keycloakService.createUser(request, xRequestId)))
+ return requestMono
+ .flatMap(request -> keycloakService.createUser(request, xRequestId))
.map(ResponseEntity::ok);
}
@Override
public Mono<ResponseEntity<UserResponseApiDto>> getUser(
String userId, String xRequestId, ServerWebExchange exchange) {
- return checkRoleAccess(GET, exchange)
- .then(keycloakService.getUser(userId, xRequestId))
- .map(ResponseEntity::ok);
+ return keycloakService.getUser(userId, xRequestId).map(ResponseEntity::ok);
}
@Override
Mono<UpdateUserRequestApiDto> requestMono,
String xRequestId,
ServerWebExchange exchange) {
- return checkRoleAccess(UPDATE, exchange)
- .then(requestMono)
+ return requestMono
.flatMap(request -> keycloakService.updateUser(userId, request, xRequestId))
.map(ResponseEntity::ok);
}
@Override
public Mono<ResponseEntity<Void>> deleteUser(
String userId, String xRequestId, ServerWebExchange exchange) {
- return checkRoleAccess(DELETE, exchange)
- .then(keycloakService.deleteUser(userId, xRequestId))
+ return keycloakService
+ .deleteUser(userId, xRequestId)
.thenReturn(ResponseEntity.noContent().build());
}
public Mono<ResponseEntity<UserListResponseApiDto>> listUsers(
Integer page, Integer pageSize, String xRequestId, ServerWebExchange exchange) {
- return checkRoleAccess(LIST, exchange)
- .then(keycloakService.listUsers(page, pageSize, xRequestId))
- .map(ResponseEntity::ok);
+ return keycloakService.listUsers(page, pageSize, xRequestId).map(ResponseEntity::ok);
}
@Override
Mono<UpdateUserPasswordRequestApiDto> requestMono,
String xRequestId,
ServerWebExchange exchange) {
- return checkRoleAccess(UPDATE_PASSWORD, exchange)
- .then(requestMono)
+ return requestMono
.flatMap(request -> keycloakService.updateUserPassword(userId, request))
.thenReturn(ResponseEntity.noContent().build());
}
@Override
public Mono<ResponseEntity<RoleListResponseApiDto>> listAvailableRoles(
String userId, String xRequestId, ServerWebExchange exchange) {
- return checkRoleAccess(LIST_AVAILABLE_ROLES, exchange)
- .then(keycloakService.getAvailableRoles(userId, xRequestId))
- .map(ResponseEntity::ok);
+ return keycloakService.getAvailableRoles(userId, xRequestId).map(ResponseEntity::ok);
}
@Override
public Mono<ResponseEntity<RoleListResponseApiDto>> listAssignedRoles(
String userId, String xRequestId, ServerWebExchange exchange) {
- return checkRoleAccess(LIST_ROLES, exchange)
- .then(keycloakService.getAssignedRoles(userId, xRequestId))
- .map(ResponseEntity::ok);
+ return keycloakService.getAssignedRoles(userId, xRequestId).map(ResponseEntity::ok);
}
@Override
public Mono<ResponseEntity<RoleListResponseApiDto>> updateAssignedRoles(
String userId, String xRequestId, Flux<RoleApiDto> rolesFlux, ServerWebExchange exchange) {
- return checkRoleAccess(UPDATE_ROLES, exchange)
- .then(rolesFlux.collectList())
+ return rolesFlux
+ .collectList()
.flatMap(roles -> keycloakService.updateAssignedRoles(userId, roles, xRequestId))
.map(ResponseEntity::ok);
}
Code Review / portal-ng / bff.git / commitdiff