-
Notifications
You must be signed in to change notification settings - Fork 65
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Merge remote-tracking branch 'origin/v2.x.x' into reboot/dependencies…
…_24_01_08
- Loading branch information
Showing
19 changed files
with
554 additions
and
22 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
46 changes: 46 additions & 0 deletions
46
gateway-service/src/main/java/org/zowe/apiml/gateway/security/mapping/NativeMapper.java
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,46 @@ | ||
| /* | ||
| * This program and the accompanying materials are made available under the terms of the | ||
| * Eclipse Public License v2.0 which accompanies this distribution, and is available at | ||
| * https://www.eclipse.org/legal/epl-v20.html | ||
| * | ||
| * SPDX-License-Identifier: EPL-2.0 | ||
| * | ||
| * Copyright Contributors to the Zowe Project. | ||
| */ | ||
|
|
||
| package org.zowe.apiml.gateway.security.mapping; | ||
|
|
||
| import lombok.NoArgsConstructor; | ||
| import lombok.extern.slf4j.Slf4j; | ||
| import org.springframework.boot.autoconfigure.condition.ConditionalOnProperty; | ||
| import org.springframework.stereotype.Component; | ||
| import org.zowe.commons.usermap.CertificateResponse; | ||
| import org.zowe.commons.usermap.MapperResponse; | ||
| import org.zowe.commons.usermap.UserMapper; | ||
|
|
||
| /** | ||
| * Native on platform mapper. Depends on <a href="https://github.com/zowe/common-java/tree/v2.x.x/zos-utils">zos-utils</a> library | ||
| * which provides native calls to z/OS. | ||
| */ | ||
| @Slf4j | ||
| @NoArgsConstructor | ||
| @Component | ||
| @ConditionalOnProperty(value = "apiml.security.useInternalMapper", havingValue = "true") | ||
| public class NativeMapper implements NativeMapperWrapper { | ||
|
|
||
| final UserMapper userMapper = new UserMapper(); | ||
|
|
||
| @Override | ||
| public CertificateResponse getUserIDForCertificate(byte[] cert) { | ||
| CertificateResponse response = userMapper.getUserIDForCertificate(cert); | ||
| log.debug("{}", response); | ||
| return response; | ||
| } | ||
|
|
||
| @Override | ||
| public MapperResponse getUserIDForDN(String dn, String registry) { | ||
| MapperResponse response = userMapper.getUserIDForDN(dn, registry); | ||
| log.debug("{}", response); | ||
| return response; | ||
| } | ||
| } |
25 changes: 25 additions & 0 deletions
25
...ay-service/src/main/java/org/zowe/apiml/gateway/security/mapping/NativeMapperWrapper.java
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,25 @@ | ||
| /* | ||
| * This program and the accompanying materials are made available under the terms of the | ||
| * Eclipse Public License v2.0 which accompanies this distribution, and is available at | ||
| * https://www.eclipse.org/legal/epl-v20.html | ||
| * | ||
| * SPDX-License-Identifier: EPL-2.0 | ||
| * | ||
| * Copyright Contributors to the Zowe Project. | ||
| */ | ||
|
|
||
| package org.zowe.apiml.gateway.security.mapping; | ||
|
|
||
| import org.zowe.commons.usermap.CertificateResponse; | ||
| import org.zowe.commons.usermap.MapperResponse; | ||
|
|
||
| /** | ||
| * Wrapper interface around the <a href="https://github.com/zowe/common-java/blob/v2.x.x/zos-utils/src/main/java/org/zowe/commons/usermap/UserMapper.java">UserMapper</a> class | ||
| * in the zos-utils library. It wraps public native methods for better testability. | ||
| */ | ||
| public interface NativeMapperWrapper { | ||
|
|
||
| CertificateResponse getUserIDForCertificate(byte[] cert); | ||
|
|
||
| MapperResponse getUserIDForDN(String dn, String registry); | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
79 changes: 79 additions & 0 deletions
79
gateway-service/src/main/java/org/zowe/apiml/gateway/security/mapping/OIDCNativeMapper.java
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,79 @@ | ||
| /* | ||
| * This program and the accompanying materials are made available under the terms of the | ||
| * Eclipse Public License v2.0 which accompanies this distribution, and is available at | ||
| * https://www.eclipse.org/legal/epl-v20.html | ||
| * | ||
| * SPDX-License-Identifier: EPL-2.0 | ||
| * | ||
| * Copyright Contributors to the Zowe Project. | ||
| */ | ||
|
|
||
| package org.zowe.apiml.gateway.security.mapping; | ||
|
|
||
| import lombok.RequiredArgsConstructor; | ||
| import org.apache.commons.lang3.StringUtils; | ||
| import org.springframework.beans.factory.annotation.Value; | ||
| import org.springframework.boot.autoconfigure.condition.ConditionalOnExpression; | ||
| import org.springframework.stereotype.Component; | ||
| import org.zowe.apiml.gateway.security.service.schema.source.AuthSource; | ||
| import org.zowe.apiml.gateway.security.service.schema.source.OIDCAuthSource; | ||
| import org.zowe.apiml.message.core.MessageType; | ||
| import org.zowe.apiml.message.log.ApimlLogger; | ||
| import org.zowe.apiml.product.logging.annotations.InjectApimlLogger; | ||
| import org.zowe.commons.usermap.MapperResponse; | ||
|
|
||
| import javax.annotation.PostConstruct; | ||
|
|
||
| import static org.zowe.apiml.gateway.security.mapping.model.MapperResponse.OIDC_FAILED_MESSAGE_KEY; | ||
|
|
||
| @RequiredArgsConstructor | ||
| @Component("oidcMapper") | ||
| @ConditionalOnExpression("'${apiml.security.oidc.enabled:false}' == 'true' && '${apiml.security.useInternalMapper:false}' == 'true'") | ||
| public class OIDCNativeMapper implements AuthenticationMapper { | ||
|
|
||
| private final NativeMapperWrapper nativeMapper; | ||
|
|
||
| @Value("${apiml.security.oidc.registry:}") | ||
| protected String registry; | ||
|
|
||
| @InjectApimlLogger | ||
| private final ApimlLogger apimlLog = ApimlLogger.empty(); | ||
|
|
||
| protected boolean isConfigError = false; | ||
|
|
||
| @PostConstruct | ||
| private void postConstruct() { | ||
| if (StringUtils.isEmpty(registry)) { | ||
| isConfigError = true; | ||
| apimlLog.log("org.zowe.apiml.security.common.OIDCConfigError"); | ||
| } | ||
| } | ||
|
|
||
| @Override | ||
| public String mapToMainframeUserId(AuthSource authSource) { | ||
| if (isConfigError) { | ||
| apimlLog.log("org.zowe.apiml.security.common.OIDCConfigError"); | ||
| return null; | ||
| } | ||
|
|
||
| if (!(authSource instanceof OIDCAuthSource)) { | ||
| apimlLog.log(MessageType.DEBUG, "The used authentication source type is {} and not OIDC", authSource.getType()); | ||
| return null; | ||
| } | ||
|
|
||
| final String distributedId = ((OIDCAuthSource) authSource).getDistributedId(); | ||
| if (StringUtils.isEmpty(distributedId)) { | ||
| apimlLog.log(OIDC_FAILED_MESSAGE_KEY, | ||
| "OIDC token is missing the distributed ID. Make sure your distributed identity provider is" + | ||
| " properly configured."); | ||
| return null; | ||
| } | ||
|
|
||
| MapperResponse response = nativeMapper.getUserIDForDN(distributedId, registry); | ||
| if (response.getRc() == 0 && StringUtils.isNotEmpty(response.getUserId())) { | ||
| return response.getUserId(); | ||
| } | ||
|
|
||
| return null; | ||
| } | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
55 changes: 55 additions & 0 deletions
55
gateway-service/src/main/java/org/zowe/apiml/gateway/security/mapping/X509NativeMapper.java
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,55 @@ | ||
| /* | ||
| * This program and the accompanying materials are made available under the terms of the | ||
| * Eclipse Public License v2.0 which accompanies this distribution, and is available at | ||
| * https://www.eclipse.org/legal/epl-v20.html | ||
| * | ||
| * SPDX-License-Identifier: EPL-2.0 | ||
| * | ||
| * Copyright Contributors to the Zowe Project. | ||
| */ | ||
|
|
||
| package org.zowe.apiml.gateway.security.mapping; | ||
|
|
||
| import lombok.RequiredArgsConstructor; | ||
| import lombok.extern.slf4j.Slf4j; | ||
| import org.apache.commons.lang3.StringUtils; | ||
| import org.springframework.boot.autoconfigure.condition.ConditionalOnProperty; | ||
| import org.springframework.stereotype.Component; | ||
| import org.zowe.apiml.gateway.security.service.schema.source.AuthSource; | ||
| import org.zowe.apiml.gateway.security.service.schema.source.X509AuthSource; | ||
| import org.zowe.commons.usermap.CertificateResponse; | ||
|
|
||
| import java.security.cert.CertificateEncodingException; | ||
| import java.security.cert.X509Certificate; | ||
|
|
||
| @Slf4j | ||
| @RequiredArgsConstructor | ||
| @Component("x509Mapper") | ||
| @ConditionalOnProperty(value = "apiml.security.useInternalMapper", havingValue = "true") | ||
| public class X509NativeMapper implements AuthenticationMapper { | ||
|
|
||
| private final NativeMapperWrapper nativeMapper; | ||
|
|
||
| @Override | ||
| public String mapToMainframeUserId(AuthSource authSource) { | ||
| if (authSource instanceof X509AuthSource) { | ||
| X509AuthSource x509AuthSource = (X509AuthSource)authSource; | ||
| X509Certificate certificate = x509AuthSource.getRawSource(); | ||
| if (certificate != null) { | ||
| try { | ||
| CertificateResponse response = nativeMapper.getUserIDForCertificate(certificate.getEncoded()); | ||
| if (response.getRc() == 0 && StringUtils.isNotEmpty(response.getUserId())) { | ||
| return response.getUserId(); | ||
| } | ||
| } catch (CertificateEncodingException e) { | ||
| log.error("Can`t get encoded data from certificate", e); | ||
| } | ||
| } else { | ||
| log.warn("No certificate found in the authentication source."); | ||
| } | ||
| } else { | ||
| log.debug("The used authentication source type is {} and not X509", authSource.getType()); | ||
| } | ||
| return null; | ||
| } | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.