lingwei.kong/hawkbit
1
0
Fork 0
Code Issues Pull Requests Actions 2 Packages Projects Releases Wiki Activity

OICD Pluggable permission mapper (#1469)

Browse Source 
By default the resource_access/<client id>/roles claim is mapped to hawkBit permissions.
However, by registering a Spring bean _org.eclipse.hawkbit.autoconfigure.security.OidcUserManagementAutoConfiguration.JwtAuthoritiesExtractor_ a custom extractor permission mapper could be registered.

Signed-off-by: Marinov Avgustin <Avgustin.Marinov@bosch.com>
This commit is contained in:
Avgustin Marinov
2023-11-03 14:52:31 +02:00
committed by GitHub
parent 7b67de3082
commit ac946e76ef
3 changed files with 237 additions and 234 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
docs/content/concepts/authorization.md
View File

@@ -50,13 +50,11 @@ hawkbit supports authentication providers which use the OpenID Connect standard,
An example configuration is given below. An example configuration is given below.
spring.security.oauth2.client.registration.oidc.client-id=clientID spring.security.oauth2.client.registration.oidc.client-id=clientID
spring.security.oauth2.client.registration.oidc.client-secret=oidc-client-secret
spring.security.oauth2.client.provider.oidc.issuer-uri=https://oidc-provider/issuer-uri spring.security.oauth2.client.provider.oidc.issuer-uri=https://oidc-provider/issuer-uri
spring.security.oauth2.client.provider.oidc.authorization-uri=https://oidc-provider/authorization-uri
spring.security.oauth2.client.provider.oidc.token-uri=https://oidc-provider/token-uri
spring.security.oauth2.client.provider.oidc.user-info-uri=https://oidc-provider/user-info-uri
spring.security.oauth2.client.provider.oidc.jwk-set-uri=https://oidc-provider/jwk-set-uri spring.security.oauth2.client.provider.oidc.jwk-set-uri=https://oidc-provider/jwk-set-uri
Note: at the moment only DEFAULT tenant is supported. By default the resource_access/<client id>/roles claim is mapped to hawkBit permissions. However, by registering a Spring bean _org.eclipse.hawkbit.autoconfigure.security.OidcUserManagementAutoConfiguration.JwtAuthoritiesExtractor_ a custom extractor permission mapper could be registered.
### Delivered Permissions ### Delivered Permissions
- READ_/UPDATE_/CREATE_/DELETE_TARGET for: - READ_/UPDATE_/CREATE_/DELETE_TARGET for:

160
hawkbit-autoconfigure/src/main/java/org/eclipse/hawkbit/autoconfigure/security/OidcUserManagementAutoConfiguration.java
View File

@@ -29,7 +29,6 @@ import org.eclipse.hawkbit.im.authentication.TenantAwareAuthenticationDetails;
import org.eclipse.hawkbit.im.authentication.UserAuthenticationFilter; import org.eclipse.hawkbit.im.authentication.UserAuthenticationFilter;
import org.eclipse.hawkbit.repository.SystemManagement; import org.eclipse.hawkbit.repository.SystemManagement;
import org.eclipse.hawkbit.security.SystemSecurityContext; import org.eclipse.hawkbit.security.SystemSecurityContext;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.boot.autoconfigure.condition.ConditionalOnMissingBean; import org.springframework.boot.autoconfigure.condition.ConditionalOnMissingBean;
import org.springframework.boot.autoconfigure.security.oauth2.client.ClientsConfiguredCondition; import org.springframework.boot.autoconfigure.security.oauth2.client.ClientsConfiguredCondition;
import org.springframework.context.annotation.Bean; import org.springframework.context.annotation.Bean;
@@ -47,6 +46,7 @@ import org.springframework.security.oauth2.client.oidc.userinfo.OidcUserRequest;
import org.springframework.security.oauth2.client.oidc.userinfo.OidcUserService; import org.springframework.security.oauth2.client.oidc.userinfo.OidcUserService;
import org.springframework.security.oauth2.client.registration.ClientRegistration; import org.springframework.security.oauth2.client.registration.ClientRegistration;
import org.springframework.security.oauth2.client.userinfo.OAuth2UserService; import org.springframework.security.oauth2.client.userinfo.OAuth2UserService;
import org.springframework.security.oauth2.core.OAuth2AccessToken;
import org.springframework.security.oauth2.core.OAuth2AuthenticationException; import org.springframework.security.oauth2.core.OAuth2AuthenticationException;
import org.springframework.security.oauth2.core.OAuth2Error; import org.springframework.security.oauth2.core.OAuth2Error;
import org.springframework.security.oauth2.core.OAuth2ErrorCodes; import org.springframework.security.oauth2.core.OAuth2ErrorCodes;
@@ -80,14 +80,12 @@ import org.springframework.web.util.UriComponentsBuilder;
public class OidcUserManagementAutoConfiguration { public class OidcUserManagementAutoConfiguration {
/** /**
* @return the oauth2 user details service to load a user from oidc user * @return the OpenID Connect authentication success handler
* manager
*/ */
@Bean @Bean
@ConditionalOnMissingBean public AuthenticationSuccessHandler oidcAuthenticationSuccessHandler(
public OAuth2UserService<OidcUserRequest, OidcUser> oidcUserDetailsService( final SystemManagement systemManagement, final SystemSecurityContext systemSecurityContext) {
final JwtAuthoritiesExtractor extractor) { return new OidcAuthenticationSuccessHandler(systemManagement, systemSecurityContext);
return new JwtAuthoritiesOidcUserService(extractor);
} }
/** /**
@@ -98,14 +96,6 @@ public class OidcUserManagementAutoConfiguration {
return new OidcLogoutSuccessHandler(); return new OidcLogoutSuccessHandler();
} }
/**
* @return the OpenID Connect authentication success handler
*/
@Bean
public AuthenticationSuccessHandler oidcAuthenticationSuccessHandler() {
return new OidcAuthenticationSuccessHandler();
}
/** /**
* @return the OpenID Connect logout handler * @return the OpenID Connect logout handler
*/ */
@@ -125,7 +115,17 @@ public class OidcUserManagementAutoConfiguration {
authorityMapper.setPrefix(""); authorityMapper.setPrefix("");
authorityMapper.setConvertToUpperCase(true); authorityMapper.setConvertToUpperCase(true);
return new JwtAuthoritiesExtractor(authorityMapper); return new DefaultJwtAuthoritiesExtractor(authorityMapper);
}
/**
* @return the oauth2 user details service to load a user from oidc user manager
*/
@Bean
@ConditionalOnMissingBean
OAuth2UserService<OidcUserRequest, OidcUser> oidcUserDetailsService(
final JwtAuthoritiesExtractor extractor) {
return new JwtAuthoritiesOidcUserService(extractor);
} }
/** /**
@@ -133,21 +133,29 @@ public class OidcUserManagementAutoConfiguration {
*/ */
@Bean @Bean
@ConditionalOnMissingBean @ConditionalOnMissingBean
public OidcBearerTokenAuthenticationFilter oidcBearerTokenAuthenticationFilter() { OidcBearerTokenAuthenticationFilter oidcBearerTokenAuthenticationFilter(
return new OidcBearerTokenAuthenticationFilter(); final JwtAuthoritiesExtractor authoritiesExtractor,
final SystemManagement systemManagement, final SystemSecurityContext systemSecurityContext) {
return new OidcBearerTokenAuthenticationFilter(
authoritiesExtractor, systemManagement, systemSecurityContext);
} }
}
/** /**
* By registering bean of such type hawkBit could be customized to extract authorities from the token.
*/
public interface JwtAuthoritiesExtractor {
Set<GrantedAuthority> extract(final Jwt token, final ClientRegistration clientRegistration );
}
/**
* Extended {@link OidcUserService} supporting JWT containing authorities * Extended {@link OidcUserService} supporting JWT containing authorities
*/ */
class JwtAuthoritiesOidcUserService extends OidcUserService { private static class JwtAuthoritiesOidcUserService extends OidcUserService {
private final JwtAuthoritiesExtractor authoritiesExtractor; private final JwtAuthoritiesExtractor authoritiesExtractor;
JwtAuthoritiesOidcUserService(final JwtAuthoritiesExtractor authoritiesExtractor) { JwtAuthoritiesOidcUserService(final JwtAuthoritiesExtractor authoritiesExtractor) {
super();
this.authoritiesExtractor = authoritiesExtractor; this.authoritiesExtractor = authoritiesExtractor;
} }
@@ -156,15 +164,21 @@ class JwtAuthoritiesOidcUserService extends OidcUserService {
final OidcUser user = super.loadUser(userRequest); final OidcUser user = super.loadUser(userRequest);
final ClientRegistration clientRegistration = userRequest.getClientRegistration(); final ClientRegistration clientRegistration = userRequest.getClientRegistration();
final Set<GrantedAuthority> authorities = authoritiesExtractor.extract(clientRegistration, // Token is already verified by spring security
userRequest.getAccessToken().getTokenValue()); final NimbusJwtDecoder jwtDecoder =
NimbusJwtDecoder
.withJwkSetUri(clientRegistration.getProviderDetails().getJwkSetUri())
.jwsAlgorithm(SignatureAlgorithm.from(JwsAlgorithms.RS256))
.build();
final Jwt token = jwtDecoder.decode(userRequest.getAccessToken().getTokenValue());
final Set<GrantedAuthority> authorities = authoritiesExtractor.extract(token, clientRegistration);
if (authorities.isEmpty()) { if (authorities.isEmpty()) {
return user; return user;
} }
final String userNameAttributeName = clientRegistration.getProviderDetails().getUserInfoEndpoint() final String userNameAttributeName = clientRegistration.getProviderDetails().getUserInfoEndpoint()
.getUserNameAttributeName(); .getUserNameAttributeName();
OidcUser oidcUser; final OidcUser oidcUser;
if (StringUtils.hasText(userNameAttributeName)) { if (StringUtils.hasText(userNameAttributeName)) {
oidcUser = new DefaultOidcUser(authorities, userRequest.getIdToken(), user.getUserInfo(), oidcUser = new DefaultOidcUser(authorities, userRequest.getIdToken(), user.getUserInfo(),
userNameAttributeName); userNameAttributeName);
@@ -173,26 +187,29 @@ class JwtAuthoritiesOidcUserService extends OidcUserService {
} }
return oidcUser; return oidcUser;
} }
} }
/** /**
* OpenID Connect Authentication Success Handler which load tenant data * OpenID Connect Authentication Success Handler which load tenant data
*/ */
class OidcAuthenticationSuccessHandler extends SavedRequestAwareAuthenticationSuccessHandler { private static class OidcAuthenticationSuccessHandler extends SavedRequestAwareAuthenticationSuccessHandler {
@Autowired private final SystemManagement systemManagement;
private SystemManagement systemManagement; private final SystemSecurityContext systemSecurityContext;
@Autowired OidcAuthenticationSuccessHandler(
private SystemSecurityContext systemSecurityContext; final SystemManagement systemManagement, final SystemSecurityContext systemSecurityContext) {
this.systemManagement = systemManagement;
this.systemSecurityContext = systemSecurityContext;
}
@Override @Override
public void onAuthenticationSuccess(final HttpServletRequest request, final HttpServletResponse response, public void onAuthenticationSuccess(
final HttpServletRequest request, final HttpServletResponse response,
final Authentication authentication) throws ServletException, IOException { final Authentication authentication) throws ServletException, IOException {
if (authentication instanceof AbstractAuthenticationToken) { if (authentication instanceof AbstractAuthenticationToken token) {
final String defaultTenant = "DEFAULT"; final String defaultTenant = "DEFAULT";
final AbstractAuthenticationToken token = (AbstractAuthenticationToken) authentication;
token.setDetails(new TenantAwareAuthenticationDetails(defaultTenant, false)); token.setDetails(new TenantAwareAuthenticationDetails(defaultTenant, false));
systemSecurityContext.runAsSystemAsTenant(systemManagement::getTenantMetadata, defaultTenant); systemSecurityContext.runAsSystemAsTenant(systemManagement::getTenantMetadata, defaultTenant);
@@ -200,12 +217,12 @@ class OidcAuthenticationSuccessHandler extends SavedRequestAwareAuthenticationSu
super.onAuthenticationSuccess(request, response, authentication); super.onAuthenticationSuccess(request, response, authentication);
} }
} }
/** /**
* LogoutHandler to invalidate OpenID Connect tokens * LogoutHandler to invalidate OpenID Connect tokens
*/ */
class OidcLogoutHandler extends SecurityContextLogoutHandler { private static class OidcLogoutHandler extends SecurityContextLogoutHandler {
@Override @Override
public void logout(final HttpServletRequest request, final HttpServletResponse response, public void logout(final HttpServletRequest request, final HttpServletResponse response,
@@ -224,13 +241,13 @@ class OidcLogoutHandler extends SecurityContextLogoutHandler {
restTemplate.getForEntity(builder.toUriString(), String.class); restTemplate.getForEntity(builder.toUriString(), String.class);
} }
} }
} }
/** /**
* LogoutSuccessHandler that decides where to redirect to after logout, depending on * LogoutSuccessHandler that decides where to redirect to after logout, depending on
* the previously used auth mechanism * the previously used auth mechanism
*/ */
class OidcLogoutSuccessHandler extends SimpleUrlLogoutSuccessHandler { private static class OidcLogoutSuccessHandler extends SimpleUrlLogoutSuccessHandler {
@Override @Override
public void onLogoutSuccess(HttpServletRequest request, HttpServletResponse response, Authentication authentication) public void onLogoutSuccess(HttpServletRequest request, HttpServletResponse response, Authentication authentication)
@@ -242,34 +259,20 @@ class OidcLogoutSuccessHandler extends SimpleUrlLogoutSuccessHandler {
} }
super.onLogoutSuccess(request, response, authentication); super.onLogoutSuccess(request, response, authentication);
} }
} }
/** /**
* Utility class to extract authorities out of the jwt. It interprets the user's * Utility class to extract authorities out of the jwt. It interprets the user's
* role as their authorities. * role as their authorities.
*/ */
class JwtAuthoritiesExtractor { private record DefaultJwtAuthoritiesExtractor
(GrantedAuthoritiesMapper authoritiesMapper) implements JwtAuthoritiesExtractor {
private final GrantedAuthoritiesMapper authoritiesMapper;
private static final OAuth2Error INVALID_REQUEST = new OAuth2Error(OAuth2ErrorCodes.INVALID_REQUEST); private static final OAuth2Error INVALID_REQUEST = new OAuth2Error(OAuth2ErrorCodes.INVALID_REQUEST);
JwtAuthoritiesExtractor(final GrantedAuthoritiesMapper authoritiesMapper) { @Override
super(); public Set<GrantedAuthority> extract(final Jwt token, final ClientRegistration clientRegistration) {
this.authoritiesMapper = authoritiesMapper;
}
Set<GrantedAuthority> extract(final ClientRegistration clientRegistration, final String tokenValue) {
try { try {
// Token is already verified by spring security
final NimbusJwtDecoder jwtDecoder =
NimbusJwtDecoder
.withJwkSetUri(clientRegistration.getProviderDetails().getJwkSetUri())
.jwsAlgorithm(SignatureAlgorithm.from(JwsAlgorithms.RS256))
.build();
final Jwt token = jwtDecoder.decode(tokenValue);
return extract(clientRegistration.getClientId(), token.getClaims()); return extract(clientRegistration.getClientId(), token.getClaims());
} catch (final JwtException e) { } catch (final JwtException e) {
throw new OAuth2AuthenticationException(INVALID_REQUEST, e); throw new OAuth2AuthenticationException(INVALID_REQUEST, e);
@@ -277,7 +280,7 @@ class JwtAuthoritiesExtractor {
} }
@SuppressWarnings("unchecked") @SuppressWarnings("unchecked")
Set<GrantedAuthority> extract(final String clientId, final Map<String, Object> claims) { private Set<GrantedAuthority> extract(final String clientId, final Map<String, Object> claims) {
final Map<String, Object> resourceMap = (Map<String, Object>) claims.get("resource_access"); final Map<String, Object> resourceMap = (Map<String, Object>) claims.get("resource_access");
if (CollectionUtils.isEmpty(resourceMap)) { if (CollectionUtils.isEmpty(resourceMap)) {
return Collections.emptySet(); return Collections.emptySet();
@@ -301,21 +304,24 @@ class JwtAuthoritiesExtractor {
return new LinkedHashSet<>(authorities); return new LinkedHashSet<>(authorities);
} }
} }
class OidcBearerTokenAuthenticationFilter implements UserAuthenticationFilter, Filter { static class OidcBearerTokenAuthenticationFilter implements UserAuthenticationFilter, Filter {
@Autowired private final JwtAuthoritiesExtractor authoritiesExtractor;
private JwtAuthoritiesExtractor authoritiesExtractor; private final SystemManagement systemManagement;
private final SystemSecurityContext systemSecurityContext;
@Autowired
private SystemManagement systemManagement;
@Autowired
private SystemSecurityContext systemSecurityContext;
private ClientRegistration clientRegistration; private ClientRegistration clientRegistration;
OidcBearerTokenAuthenticationFilter(
final JwtAuthoritiesExtractor authoritiesExtractor,
final SystemManagement systemManagement, final SystemSecurityContext systemSecurityContext) {
this.authoritiesExtractor = authoritiesExtractor;
this.systemManagement = systemManagement;
this.systemSecurityContext = systemSecurityContext;
}
void setClientRegistration(final ClientRegistration clientRegistration) { void setClientRegistration(final ClientRegistration clientRegistration) {
this.clientRegistration = clientRegistration; this.clientRegistration = clientRegistration;
} }
@@ -323,19 +329,16 @@ class OidcBearerTokenAuthenticationFilter implements UserAuthenticationFilter, F
@Override @Override
public void doFilter(final ServletRequest request, final ServletResponse response, final FilterChain chain) public void doFilter(final ServletRequest request, final ServletResponse response, final FilterChain chain)
throws IOException, ServletException { throws IOException, ServletException {
final Authentication authentication = SecurityContextHolder.getContext().getAuthentication(); final Authentication authentication = SecurityContextHolder.getContext().getAuthentication();
if (authentication instanceof JwtAuthenticationToken) { if (authentication instanceof JwtAuthenticationToken jwtAuthenticationToken) {
final String defaultTenant = "DEFAULT"; final String defaultTenant = "DEFAULT";
final JwtAuthenticationToken jwtAuthenticationToken = (JwtAuthenticationToken) authentication;
final Jwt jwt = jwtAuthenticationToken.getToken(); final Jwt jwt = jwtAuthenticationToken.getToken();
final OidcIdToken idToken = new OidcIdToken(jwt.getTokenValue(), jwt.getIssuedAt(), jwt.getExpiresAt(), final OidcIdToken idToken = new OidcIdToken(jwt.getTokenValue(), jwt.getIssuedAt(), jwt.getExpiresAt(),
jwt.getClaims()); jwt.getClaims());
final OidcUserInfo userInfo = new OidcUserInfo(jwt.getClaims()); final OidcUserInfo userInfo = new OidcUserInfo(jwt.getClaims());
final Set<GrantedAuthority> authorities = authoritiesExtractor.extract(clientRegistration.getClientId(), final Set<GrantedAuthority> authorities = authoritiesExtractor.extract(jwt, clientRegistration);
jwt.getClaims());
if (authorities.isEmpty()) { if (authorities.isEmpty()) {
((HttpServletResponse) response).sendError(HttpServletResponse.SC_FORBIDDEN); ((HttpServletResponse) response).sendError(HttpServletResponse.SC_FORBIDDEN);
@@ -365,4 +368,5 @@ class OidcBearerTokenAuthenticationFilter implements UserAuthenticationFilter, F
public void destroy() { public void destroy() {
// Nothing to do // Nothing to do
} }
}
} }

5
hawkbit-autoconfigure/src/main/java/org/eclipse/hawkbit/autoconfigure/security/SecurityManagedConfiguration.java
View File

@@ -477,12 +477,13 @@ public class SecurityManagedConfiguration {
@Bean @Bean
@Order(350) @Order(350)
protected SecurityFilterChain filterChainREST( SecurityFilterChain filterChainREST(
final HttpSecurity http, final HttpSecurity http,
@Lazy @Lazy
final UserAuthenticationFilter userAuthenticationFilter, final UserAuthenticationFilter userAuthenticationFilter,
@Autowired(required = false) @Autowired(required = false)
final OidcBearerTokenAuthenticationFilter oidcBearerTokenAuthenticationFilter, final OidcUserManagementAutoConfiguration.OidcBearerTokenAuthenticationFilter
oidcBearerTokenAuthenticationFilter,
@Autowired(required = false) @Autowired(required = false)
final InMemoryClientRegistrationRepository clientRegistrationRepository, final InMemoryClientRegistrationRepository clientRegistrationRepository,
final SystemManagement systemManagement, final SystemManagement systemManagement,