OICD Pluggable permission mapper (#1469)

By default the resource_access/<client id>/roles claim is mapped to hawkBit permissions. However, by registering a Spring bean _org.eclipse.hawkbit.autoconfigure.security.OidcUserManagementAutoConfiguration.JwtAuthoritiesExtractor_ a custom extractor permission mapper could be registered. Signed-off-by: Marinov Avgustin <Avgustin.Marinov@bosch.com>
2023-11-03 14:52:31 +02:00
parent 7b67de3082
commit ac946e76ef
3 changed files with 237 additions and 234 deletions
--- a/docs/content/concepts/authorization.md
+++ b/docs/content/concepts/authorization.md
@@ -50,13 +50,11 @@ hawkbit supports authentication providers which use the OpenID Connect standard,
 An example configuration is given below.

    spring.security.oauth2.client.registration.oidc.client-id=clientID
-    spring.security.oauth2.client.registration.oidc.client-secret=oidc-client-secret
    spring.security.oauth2.client.provider.oidc.issuer-uri=https://oidc-provider/issuer-uri
-    spring.security.oauth2.client.provider.oidc.authorization-uri=https://oidc-provider/authorization-uri
-    spring.security.oauth2.client.provider.oidc.token-uri=https://oidc-provider/token-uri
-    spring.security.oauth2.client.provider.oidc.user-info-uri=https://oidc-provider/user-info-uri
    spring.security.oauth2.client.provider.oidc.jwk-set-uri=https://oidc-provider/jwk-set-uri

+Note: at the moment only DEFAULT tenant is supported. By default the resource_access/<client id>/roles claim is mapped to hawkBit permissions. However, by registering a Spring bean _org.eclipse.hawkbit.autoconfigure.security.OidcUserManagementAutoConfiguration.JwtAuthoritiesExtractor_ a custom extractor permission mapper could be registered.
+
 ### Delivered Permissions

 - READ_/UPDATE_/CREATE_/DELETE_TARGET for:
--- a/hawkbit-autoconfigure/src/main/java/org/eclipse/hawkbit/autoconfigure/security/OidcUserManagementAutoConfiguration.java
+++ b/hawkbit-autoconfigure/src/main/java/org/eclipse/hawkbit/autoconfigure/security/OidcUserManagementAutoConfiguration.java
@@ -29,7 +29,6 @@ import org.eclipse.hawkbit.im.authentication.TenantAwareAuthenticationDetails;
 import org.eclipse.hawkbit.im.authentication.UserAuthenticationFilter;
 import org.eclipse.hawkbit.repository.SystemManagement;
 import org.eclipse.hawkbit.security.SystemSecurityContext;
-import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.boot.autoconfigure.condition.ConditionalOnMissingBean;
 import org.springframework.boot.autoconfigure.security.oauth2.client.ClientsConfiguredCondition;
 import org.springframework.context.annotation.Bean;
@@ -47,6 +46,7 @@ import org.springframework.security.oauth2.client.oidc.userinfo.OidcUserRequest;
 import org.springframework.security.oauth2.client.oidc.userinfo.OidcUserService;
 import org.springframework.security.oauth2.client.registration.ClientRegistration;
 import org.springframework.security.oauth2.client.userinfo.OAuth2UserService;
+import org.springframework.security.oauth2.core.OAuth2AccessToken;
 import org.springframework.security.oauth2.core.OAuth2AuthenticationException;
 import org.springframework.security.oauth2.core.OAuth2Error;
 import org.springframework.security.oauth2.core.OAuth2ErrorCodes;
@@ -80,14 +80,12 @@ import org.springframework.web.util.UriComponentsBuilder;
 public class OidcUserManagementAutoConfiguration {

    /**
-     * @return the oauth2 user details service to load a user from oidc user
-     *         manager
+     * @return the OpenID Connect authentication success handler
     */
    @Bean
-    @ConditionalOnMissingBean
-    public OAuth2UserService<OidcUserRequest, OidcUser> oidcUserDetailsService(
-            final JwtAuthoritiesExtractor extractor) {
-        return new JwtAuthoritiesOidcUserService(extractor);
+    public AuthenticationSuccessHandler oidcAuthenticationSuccessHandler(
+            final SystemManagement systemManagement, final SystemSecurityContext systemSecurityContext) {
+        return new OidcAuthenticationSuccessHandler(systemManagement, systemSecurityContext);
    }

    /**
@@ -98,14 +96,6 @@ public class OidcUserManagementAutoConfiguration {
        return new OidcLogoutSuccessHandler();
    }

-    /**
-     * @return the OpenID Connect authentication success handler
-     */
-    @Bean
-    public AuthenticationSuccessHandler oidcAuthenticationSuccessHandler() {
-        return new OidcAuthenticationSuccessHandler();
-    }
-
    /**
     * @return the OpenID Connect logout handler
     */
@@ -125,7 +115,17 @@ public class OidcUserManagementAutoConfiguration {
        authorityMapper.setPrefix("");
        authorityMapper.setConvertToUpperCase(true);

-        return new JwtAuthoritiesExtractor(authorityMapper);
+        return new DefaultJwtAuthoritiesExtractor(authorityMapper);
+    }
+
+    /**
+     * @return the oauth2 user details service to load a user from oidc user manager
+     */
+    @Bean
+    @ConditionalOnMissingBean
+    OAuth2UserService<OidcUserRequest, OidcUser> oidcUserDetailsService(
+            final JwtAuthoritiesExtractor extractor) {
+        return new JwtAuthoritiesOidcUserService(extractor);
    }

    /**
@@ -133,21 +133,29 @@ public class OidcUserManagementAutoConfiguration {
     */
    @Bean
    @ConditionalOnMissingBean
-    public OidcBearerTokenAuthenticationFilter oidcBearerTokenAuthenticationFilter() {
-        return new OidcBearerTokenAuthenticationFilter();
+    OidcBearerTokenAuthenticationFilter oidcBearerTokenAuthenticationFilter(
+            final JwtAuthoritiesExtractor authoritiesExtractor,
+            final SystemManagement systemManagement, final SystemSecurityContext systemSecurityContext) {
+        return new OidcBearerTokenAuthenticationFilter(
+                authoritiesExtractor, systemManagement, systemSecurityContext);
    }
-}

-/**
+    /**
+     * By registering bean of such type hawkBit could be customized to extract authorities from the token.
+     */
+    public interface JwtAuthoritiesExtractor {
+
+        Set<GrantedAuthority> extract(final Jwt token, final ClientRegistration clientRegistration );
+    }
+
+    /**
     * Extended {@link OidcUserService} supporting JWT containing authorities
     */
-class JwtAuthoritiesOidcUserService extends OidcUserService {
+    private static class JwtAuthoritiesOidcUserService extends OidcUserService {

        private final JwtAuthoritiesExtractor authoritiesExtractor;

        JwtAuthoritiesOidcUserService(final JwtAuthoritiesExtractor authoritiesExtractor) {
-        super();
-
            this.authoritiesExtractor = authoritiesExtractor;
        }

@@ -156,15 +164,21 @@ class JwtAuthoritiesOidcUserService extends OidcUserService {
            final OidcUser user = super.loadUser(userRequest);
            final ClientRegistration clientRegistration = userRequest.getClientRegistration();

-        final Set<GrantedAuthority> authorities = authoritiesExtractor.extract(clientRegistration,
-                userRequest.getAccessToken().getTokenValue());
+            // Token is already verified by spring security
+            final NimbusJwtDecoder jwtDecoder =
+                    NimbusJwtDecoder
+                            .withJwkSetUri(clientRegistration.getProviderDetails().getJwkSetUri())
+                            .jwsAlgorithm(SignatureAlgorithm.from(JwsAlgorithms.RS256))
+                            .build();
+            final Jwt token = jwtDecoder.decode(userRequest.getAccessToken().getTokenValue());
+            final Set<GrantedAuthority> authorities = authoritiesExtractor.extract(token, clientRegistration);
            if (authorities.isEmpty()) {
                return user;
            }

            final String userNameAttributeName = clientRegistration.getProviderDetails().getUserInfoEndpoint()
                    .getUserNameAttributeName();
-        OidcUser oidcUser;
+            final OidcUser oidcUser;
            if (StringUtils.hasText(userNameAttributeName)) {
                oidcUser = new DefaultOidcUser(authorities, userRequest.getIdToken(), user.getUserInfo(),
                        userNameAttributeName);
@@ -173,26 +187,29 @@ class JwtAuthoritiesOidcUserService extends OidcUserService {
            }
            return oidcUser;
        }
-}
+    }

-/**
+    /**
     * OpenID Connect Authentication Success Handler which load tenant data
     */
-class OidcAuthenticationSuccessHandler extends SavedRequestAwareAuthenticationSuccessHandler {
+    private static class OidcAuthenticationSuccessHandler extends SavedRequestAwareAuthenticationSuccessHandler {

-    @Autowired
-    private SystemManagement systemManagement;
+        private final SystemManagement systemManagement;
+        private final SystemSecurityContext systemSecurityContext;

-    @Autowired
-    private SystemSecurityContext systemSecurityContext;
+        OidcAuthenticationSuccessHandler(
+                final SystemManagement systemManagement, final SystemSecurityContext systemSecurityContext) {
+            this.systemManagement = systemManagement;
+            this.systemSecurityContext = systemSecurityContext;
+        }

        @Override
-    public void onAuthenticationSuccess(final HttpServletRequest request, final HttpServletResponse response,
+        public void onAuthenticationSuccess(
+                final HttpServletRequest request, final HttpServletResponse response,
                final Authentication authentication) throws ServletException, IOException {
-        if (authentication instanceof AbstractAuthenticationToken) {
+            if (authentication instanceof AbstractAuthenticationToken token) {
                final String defaultTenant = "DEFAULT";

-            final AbstractAuthenticationToken token = (AbstractAuthenticationToken) authentication;
                token.setDetails(new TenantAwareAuthenticationDetails(defaultTenant, false));

                systemSecurityContext.runAsSystemAsTenant(systemManagement::getTenantMetadata, defaultTenant);
@@ -200,12 +217,12 @@ class OidcAuthenticationSuccessHandler extends SavedRequestAwareAuthenticationSu

            super.onAuthenticationSuccess(request, response, authentication);
        }
-}
+    }

-/**
+    /**
     * LogoutHandler to invalidate OpenID Connect tokens
     */
-class OidcLogoutHandler extends SecurityContextLogoutHandler {
+    private static class OidcLogoutHandler extends SecurityContextLogoutHandler {

        @Override
        public void logout(final HttpServletRequest request, final HttpServletResponse response,
@@ -224,13 +241,13 @@ class OidcLogoutHandler extends SecurityContextLogoutHandler {
                restTemplate.getForEntity(builder.toUriString(), String.class);
            }
        }
-}
+    }

-/**
+    /**
     * LogoutSuccessHandler that decides where to redirect to after logout, depending on
     * the previously used auth mechanism
     */
-class OidcLogoutSuccessHandler extends SimpleUrlLogoutSuccessHandler {
+   private static  class OidcLogoutSuccessHandler extends SimpleUrlLogoutSuccessHandler {

        @Override
        public void onLogoutSuccess(HttpServletRequest request, HttpServletResponse response, Authentication authentication)
@@ -242,34 +259,20 @@ class OidcLogoutSuccessHandler extends SimpleUrlLogoutSuccessHandler {
            }
            super.onLogoutSuccess(request, response, authentication);
        }
-}
+    }

-/**
+    /**
     * Utility class to extract authorities out of the jwt. It interprets the user's
     * role as their authorities.
     */
-class JwtAuthoritiesExtractor {
-
-    private final GrantedAuthoritiesMapper authoritiesMapper;
+    private record DefaultJwtAuthoritiesExtractor
+            (GrantedAuthoritiesMapper authoritiesMapper) implements JwtAuthoritiesExtractor {

        private static final OAuth2Error INVALID_REQUEST = new OAuth2Error(OAuth2ErrorCodes.INVALID_REQUEST);

-    JwtAuthoritiesExtractor(final GrantedAuthoritiesMapper authoritiesMapper) {
-        super();
-
-        this.authoritiesMapper = authoritiesMapper;
-    }
-
-    Set<GrantedAuthority> extract(final ClientRegistration clientRegistration, final String tokenValue) {
+        @Override
+        public Set<GrantedAuthority> extract(final Jwt token, final ClientRegistration clientRegistration) {
            try {
-            // Token is already verified by spring security
-            final NimbusJwtDecoder jwtDecoder =
-                NimbusJwtDecoder
-                    .withJwkSetUri(clientRegistration.getProviderDetails().getJwkSetUri())
-                    .jwsAlgorithm(SignatureAlgorithm.from(JwsAlgorithms.RS256))
-                    .build();
-            final Jwt token = jwtDecoder.decode(tokenValue);
-
                return extract(clientRegistration.getClientId(), token.getClaims());
            } catch (final JwtException e) {
                throw new OAuth2AuthenticationException(INVALID_REQUEST, e);
@@ -277,7 +280,7 @@ class JwtAuthoritiesExtractor {
        }

        @SuppressWarnings("unchecked")
-    Set<GrantedAuthority> extract(final String clientId, final Map<String, Object> claims) {
+        private Set<GrantedAuthority> extract(final String clientId, final Map<String, Object> claims) {
            final Map<String, Object> resourceMap = (Map<String, Object>) claims.get("resource_access");
            if (CollectionUtils.isEmpty(resourceMap)) {
                return Collections.emptySet();
@@ -301,21 +304,24 @@ class JwtAuthoritiesExtractor {

            return new LinkedHashSet<>(authorities);
        }
-}
+    }

-class OidcBearerTokenAuthenticationFilter implements UserAuthenticationFilter, Filter {
+    static class OidcBearerTokenAuthenticationFilter implements UserAuthenticationFilter, Filter {

-    @Autowired
-    private JwtAuthoritiesExtractor authoritiesExtractor;
-
-    @Autowired
-    private SystemManagement systemManagement;
-
-    @Autowired
-    private SystemSecurityContext systemSecurityContext;
+        private final JwtAuthoritiesExtractor authoritiesExtractor;
+        private final SystemManagement systemManagement;
+        private final SystemSecurityContext systemSecurityContext;

        private ClientRegistration clientRegistration;

+        OidcBearerTokenAuthenticationFilter(
+                final JwtAuthoritiesExtractor authoritiesExtractor,
+                final SystemManagement systemManagement, final SystemSecurityContext systemSecurityContext) {
+            this.authoritiesExtractor = authoritiesExtractor;
+            this.systemManagement = systemManagement;
+            this.systemSecurityContext = systemSecurityContext;
+        }
+
        void setClientRegistration(final ClientRegistration clientRegistration) {
            this.clientRegistration = clientRegistration;
        }
@@ -323,19 +329,16 @@ class OidcBearerTokenAuthenticationFilter implements UserAuthenticationFilter, F
        @Override
        public void doFilter(final ServletRequest request, final ServletResponse response, final FilterChain chain)
                throws IOException, ServletException {
-
            final Authentication authentication = SecurityContextHolder.getContext().getAuthentication();
-        if (authentication instanceof JwtAuthenticationToken) {
+            if (authentication instanceof JwtAuthenticationToken jwtAuthenticationToken) {
                final String defaultTenant = "DEFAULT";

-            final JwtAuthenticationToken jwtAuthenticationToken = (JwtAuthenticationToken) authentication;
                final Jwt jwt = jwtAuthenticationToken.getToken();
                final OidcIdToken idToken = new OidcIdToken(jwt.getTokenValue(), jwt.getIssuedAt(), jwt.getExpiresAt(),
                        jwt.getClaims());
                final OidcUserInfo userInfo = new OidcUserInfo(jwt.getClaims());

-            final Set<GrantedAuthority> authorities = authoritiesExtractor.extract(clientRegistration.getClientId(),
-                    jwt.getClaims());
+                final Set<GrantedAuthority> authorities = authoritiesExtractor.extract(jwt, clientRegistration);

                if (authorities.isEmpty()) {
                    ((HttpServletResponse) response).sendError(HttpServletResponse.SC_FORBIDDEN);
@@ -365,4 +368,5 @@ class OidcBearerTokenAuthenticationFilter implements UserAuthenticationFilter, F
        public void destroy() {
            // Nothing to do
        }
+    }
 }
--- a/hawkbit-autoconfigure/src/main/java/org/eclipse/hawkbit/autoconfigure/security/SecurityManagedConfiguration.java
+++ b/hawkbit-autoconfigure/src/main/java/org/eclipse/hawkbit/autoconfigure/security/SecurityManagedConfiguration.java
@@ -477,12 +477,13 @@ public class SecurityManagedConfiguration {

        @Bean
        @Order(350)
-        protected SecurityFilterChain filterChainREST(
+        SecurityFilterChain filterChainREST(
                final HttpSecurity http,
                @Lazy
                final UserAuthenticationFilter userAuthenticationFilter,
                @Autowired(required = false)
-                final OidcBearerTokenAuthenticationFilter oidcBearerTokenAuthenticationFilter,
+                final OidcUserManagementAutoConfiguration.OidcBearerTokenAuthenticationFilter
+                        oidcBearerTokenAuthenticationFilter,
                @Autowired(required = false)
                final InMemoryClientRegistrationRepository clientRegistrationRepository,
                final SystemManagement systemManagement,