-
Notifications
You must be signed in to change notification settings - Fork 2.8k
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
AWS Lambda HTTP Security Integration
sam local docs
- Loading branch information
1 parent
6431d1e
commit 5085f15
Showing
42 changed files
with
1,230 additions
and
17 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
13 changes: 13 additions & 0 deletions
13
...ent/src/main/java/io/quarkus/amazon/lambda/http/deployment/LambdaHttpBuildTimeConfig.java
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,13 @@ | ||
| package io.quarkus.amazon.lambda.http.deployment; | ||
|
|
||
| import java.util.Optional; | ||
|
|
||
| import io.quarkus.runtime.annotations.ConfigRoot; | ||
|
|
||
| @ConfigRoot | ||
| public class LambdaHttpBuildTimeConfig { | ||
| /** | ||
| * Fully qualified class name of custom io.quarkus.lambda.http.LambdaSecurityIdentityProvider | ||
| */ | ||
| public Optional<String> identityProvider; | ||
| } |
30 changes: 30 additions & 0 deletions
30
...zon-lambda-http/runtime/src/main/java/io/quarkus/amazon/lambda/http/CognitoPrincipal.java
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,30 @@ | ||
| package io.quarkus.amazon.lambda.http; | ||
|
|
||
| import java.security.Principal; | ||
|
|
||
| import com.amazonaws.services.lambda.runtime.events.APIGatewayV2HTTPEvent; | ||
|
|
||
| /** | ||
| * Represents a Cognito JWT used to authenticate request | ||
| * | ||
| * Will only be allocated if requestContext.authorizer.jwt.claims.cognito:username is set | ||
| * in the http event sent by API Gateway | ||
| */ | ||
| public class CognitoPrincipal implements Principal { | ||
| private APIGatewayV2HTTPEvent.RequestContext.Authorizer.JWT jwt; | ||
| private String name; | ||
|
|
||
| public CognitoPrincipal(APIGatewayV2HTTPEvent.RequestContext.Authorizer.JWT jwt) { | ||
| this.jwt = jwt; | ||
| this.name = jwt.getClaims().get("cognito:username"); | ||
| } | ||
|
|
||
| @Override | ||
| public String getName() { | ||
| return name; | ||
| } | ||
|
|
||
| public APIGatewayV2HTTPEvent.RequestContext.Authorizer.JWT getClaims() { | ||
| return jwt; | ||
| } | ||
| } |
30 changes: 30 additions & 0 deletions
30
...azon-lambda-http/runtime/src/main/java/io/quarkus/amazon/lambda/http/CustomPrincipal.java
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,30 @@ | ||
| package io.quarkus.amazon.lambda.http; | ||
|
|
||
| import java.security.Principal; | ||
| import java.util.Map; | ||
|
|
||
| /** | ||
| * Represents a custom principal sent by API Gateway i.e. a Lambda authorizer | ||
| * | ||
| * Will only be allocated if requestContext.authorizer.lambda.principalId is set | ||
| * in the http event sent by API Gateway | ||
| * | ||
| */ | ||
| public class CustomPrincipal implements Principal { | ||
| private String name; | ||
| private Map<String, Object> claims; | ||
|
|
||
| public CustomPrincipal(String name, Map<String, Object> claims) { | ||
| this.claims = claims; | ||
| this.name = name; | ||
| } | ||
|
|
||
| @Override | ||
| public String getName() { | ||
| return name; | ||
| } | ||
|
|
||
| public Map<String, Object> getClaims() { | ||
| return claims; | ||
| } | ||
| } |
63 changes: 63 additions & 0 deletions
63
...me/src/main/java/io/quarkus/amazon/lambda/http/DefaultLambdaSecurityIdentityProvider.java
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,63 @@ | ||
| package io.quarkus.amazon.lambda.http; | ||
|
|
||
| import java.security.Principal; | ||
| import java.util.Map; | ||
|
|
||
| import com.amazonaws.services.lambda.runtime.events.APIGatewayV2HTTPEvent; | ||
|
|
||
| import io.quarkus.security.identity.SecurityIdentity; | ||
|
|
||
| public class DefaultLambdaSecurityIdentityProvider implements LambdaSecurityIdentityProvider { | ||
| @Override | ||
| public SecurityIdentity create(APIGatewayV2HTTPEvent event) { | ||
| Principal principal = getPrincipal(event); | ||
| if (principal != null) { | ||
| return new LambdaSecurityIdentity(principal); | ||
| } | ||
| return null; | ||
| } | ||
|
|
||
| protected Principal getPrincipal(APIGatewayV2HTTPEvent request) { | ||
| final Map<String, String> systemEnvironment = System.getenv(); | ||
| final boolean isSamLocal = Boolean.parseBoolean(systemEnvironment.get("AWS_SAM_LOCAL")); | ||
| final APIGatewayV2HTTPEvent.RequestContext requestContext = request.getRequestContext(); | ||
| if (isSamLocal && (requestContext == null || requestContext.getAuthorizer() == null)) { | ||
| final String forcedUserName = systemEnvironment.get("QUARKUS_AWS_LAMBDA_FORCE_USER_NAME"); | ||
| if (forcedUserName != null && !forcedUserName.isEmpty()) { | ||
| return new Principal() { | ||
|
|
||
| @Override | ||
| public String getName() { | ||
| return forcedUserName; | ||
| } | ||
|
|
||
| }; | ||
| } | ||
| } else { | ||
| if (requestContext != null) { | ||
| final APIGatewayV2HTTPEvent.RequestContext.Authorizer authorizer = requestContext.getAuthorizer(); | ||
| if (authorizer != null) { | ||
| if (authorizer.getJwt() != null) { | ||
| final APIGatewayV2HTTPEvent.RequestContext.Authorizer.JWT jwt = authorizer.getJwt(); | ||
| final Map<String, String> claims = jwt.getClaims(); | ||
| if (claims != null && claims.containsKey("cognito:username")) { | ||
| return new CognitoPrincipal(jwt); | ||
| } | ||
| } else if (authorizer.getIam() != null) { | ||
| if (authorizer.getIam().getUserId() != null) { | ||
| return new IAMPrincipal(authorizer.getIam()); | ||
| } | ||
| } else if (authorizer.getLambda() != null) { | ||
| Object tmp = authorizer.getLambda().get("principalId"); | ||
| if (tmp != null && tmp instanceof String) { | ||
| String username = (String) tmp; | ||
| return new CustomPrincipal(username, authorizer.getLambda()); | ||
| } | ||
| } | ||
| } | ||
| } | ||
| } | ||
| return null; | ||
| } | ||
|
|
||
| } |
30 changes: 30 additions & 0 deletions
30
.../amazon-lambda-http/runtime/src/main/java/io/quarkus/amazon/lambda/http/IAMPrincipal.java
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,30 @@ | ||
| package io.quarkus.amazon.lambda.http; | ||
|
|
||
| import java.security.Principal; | ||
|
|
||
| import com.amazonaws.services.lambda.runtime.events.APIGatewayV2HTTPEvent; | ||
|
|
||
| /** | ||
| * Used if IAM is used for authentication. | ||
| * | ||
| * Will only be allocated if requestContext.authorizer.iam.userId is set | ||
| * in the http event sent by API Gateway | ||
| */ | ||
| public class IAMPrincipal implements Principal { | ||
| private String name; | ||
| private APIGatewayV2HTTPEvent.RequestContext.IAM iam; | ||
|
|
||
| public IAMPrincipal(APIGatewayV2HTTPEvent.RequestContext.IAM iam) { | ||
| this.iam = iam; | ||
| this.name = iam.getUserId(); | ||
| } | ||
|
|
||
| @Override | ||
| public String getName() { | ||
| return name; | ||
| } | ||
|
|
||
| public APIGatewayV2HTTPEvent.RequestContext.IAM getIam() { | ||
| return iam; | ||
| } | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
13 changes: 13 additions & 0 deletions
13
...n-lambda-http/runtime/src/main/java/io/quarkus/amazon/lambda/http/LambdaHttpRecorder.java
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,13 @@ | ||
| package io.quarkus.amazon.lambda.http; | ||
|
|
||
| import io.quarkus.runtime.RuntimeValue; | ||
| import io.quarkus.runtime.annotations.Recorder; | ||
|
|
||
| @Recorder | ||
| public class LambdaHttpRecorder { | ||
| static LambdaSecurityIdentityProvider identityProvider = new DefaultLambdaSecurityIdentityProvider(); | ||
|
|
||
| public void setLambdaSecurityIdentityProvider(RuntimeValue<LambdaSecurityIdentityProvider> provider) { | ||
| identityProvider = provider.getValue(); | ||
| } | ||
| } |
Oops, something went wrong.