-
Notifications
You must be signed in to change notification settings - Fork 98
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
* API key authenticate * refactor scope * add feature flag and scope can be null * remove extra dependency * add accessKey in oAuthSession * fix unit tests * rename variable
- Loading branch information
1 parent
0caa7fc
commit 9d14ab8
Showing
20 changed files
with
266 additions
and
31 deletions.
There are no files selected for viewing
11 changes: 11 additions & 0 deletions
11
whois-api/src/main/java/net/ripe/db/whois/api/rest/BearerTokenExtractor.java
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,11 @@ | ||
| package net.ripe.db.whois.api.rest; | ||
|
|
||
| import jakarta.servlet.http.HttpServletRequest; | ||
| import net.ripe.db.whois.common.apiKey.OAuthSession; | ||
|
|
||
| public class BearerTokenExtractor { | ||
|
|
||
| public static OAuthSession extract(final HttpServletRequest request) { | ||
| return null; | ||
| } | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
66 changes: 66 additions & 0 deletions
66
whois-client/src/main/java/net/ripe/db/whois/common/apiKey/OAuthSession.java
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,66 @@ | ||
| package net.ripe.db.whois.common.apiKey; | ||
|
|
||
| import com.google.common.base.MoreObjects; | ||
|
|
||
| import java.time.LocalDateTime; | ||
| import java.util.List; | ||
|
|
||
| public class OAuthSession { | ||
|
|
||
| private final String application; | ||
|
|
||
| private final String email; | ||
|
|
||
| private final String accessKey; | ||
|
|
||
| private final String uuid; | ||
|
|
||
| private final LocalDateTime expirationDate; | ||
|
|
||
| private final List<String> scopes; | ||
|
|
||
| public OAuthSession(final String application, final String accessKey, final String email, final String uuid, final LocalDateTime expirationDate, final List<String> scopes) { | ||
| this.application = application; | ||
| this.email = email; | ||
| this.uuid = uuid; | ||
| this.expirationDate = expirationDate; | ||
| this.scopes = scopes; | ||
| this.accessKey = accessKey; | ||
| } | ||
|
|
||
| public String getApplication() { | ||
| return application; | ||
| } | ||
|
|
||
| public String getEmail() { | ||
| return email; | ||
| } | ||
|
|
||
| public String getUuid() { | ||
| return uuid; | ||
| } | ||
|
|
||
| public LocalDateTime getExpirationDate() { | ||
| return expirationDate; | ||
| } | ||
|
|
||
| public String getAccessKey() { | ||
| return accessKey; | ||
| } | ||
|
|
||
| public List<String> getScopes() { | ||
| return scopes; | ||
| } | ||
|
|
||
| @Override | ||
| public String toString() { | ||
| return MoreObjects.toStringHelper(this) | ||
| .add("application", application) | ||
| .add("accessKey", accessKey) | ||
| .add("email", email) | ||
| .add("uuid", uuid) | ||
| .add("expirationDate", expirationDate.toString()) | ||
| .add("scopes", scopes) | ||
| .toString(); | ||
| } | ||
| } |
102 changes: 102 additions & 0 deletions
102
...in/java/net/ripe/db/whois/update/authentication/credential/ApiKeyCredentialValidator.java
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,102 @@ | ||
| package net.ripe.db.whois.update.authentication.credential; | ||
|
|
||
| import net.ripe.db.whois.common.apiKey.OAuthSession; | ||
| import net.ripe.db.whois.common.rpsl.ObjectType; | ||
| import net.ripe.db.whois.common.rpsl.RpslObject; | ||
| import net.ripe.db.whois.update.domain.APIKeyCredential; | ||
| import net.ripe.db.whois.update.domain.PreparedUpdate; | ||
| import net.ripe.db.whois.update.domain.SsoCredential; | ||
| import net.ripe.db.whois.update.domain.Update; | ||
| import net.ripe.db.whois.update.domain.UpdateContext; | ||
| import net.ripe.db.whois.update.log.LoggerContext; | ||
| import org.springframework.beans.factory.annotation.Autowired; | ||
| import org.springframework.beans.factory.annotation.Value; | ||
| import org.springframework.stereotype.Component; | ||
|
|
||
| import java.util.Collection; | ||
|
|
||
| @Component | ||
| public class ApiKeyCredentialValidator implements CredentialValidator<APIKeyCredential, SsoCredential> { | ||
| private final LoggerContext loggerContext; | ||
|
|
||
| @Value("${apikey.authenticate.enabled:false}") | ||
| private boolean enabled; | ||
|
|
||
| @Autowired | ||
| public ApiKeyCredentialValidator(final LoggerContext loggerContext) { | ||
| this.loggerContext = loggerContext; | ||
| } | ||
|
|
||
| @Override | ||
| public Class<SsoCredential> getSupportedCredentials() { | ||
| return SsoCredential.class; | ||
| } | ||
|
|
||
| @Override | ||
| public Class<APIKeyCredential> getSupportedOfferedCredentialType() { | ||
| return APIKeyCredential.class; | ||
| } | ||
|
|
||
| @Override | ||
| public boolean hasValidCredential(final PreparedUpdate update, final UpdateContext updateContext, final Collection<APIKeyCredential> offeredCredentials, final SsoCredential knownCredential, final RpslObject maintainer) { | ||
| if(!enabled) { | ||
| return false; | ||
| } | ||
|
|
||
| for (final APIKeyCredential offered : offeredCredentials) { | ||
|
|
||
| final OAuthSession oAuthSession = offered.getOfferedOAuthSession(); | ||
|
|
||
| if(!oAuthSession.getScopes().isEmpty()) { | ||
| final ScopeFormatter scopeFormatter = new ScopeFormatter(offered.getOfferedOAuthSession().getScopes().getFirst()); | ||
| if(!validateScope(maintainer, scopeFormatter)) { | ||
| continue; | ||
| } | ||
| } | ||
|
|
||
| if (oAuthSession.getUuid().equals(knownCredential.getKnownUuid())) { | ||
| log(update, String.format("Validated %s with API KEY for user: %s with apiKey: %s.", update.getFormattedKey(), oAuthSession.getEmail(), oAuthSession.getAccessKey())); | ||
|
|
||
| update.getUpdate().setEffectiveCredential(oAuthSession.getAccessKey(), Update.EffectiveCredentialType.APIKEY); | ||
| return true; | ||
| } | ||
| } | ||
| return false; | ||
| } | ||
|
|
||
| private void log(final PreparedUpdate update, final String message) { | ||
| loggerContext.logString(update.getUpdate(), getClass().getCanonicalName(), message); | ||
| } | ||
|
|
||
| private static boolean validateScope(final RpslObject maintainer, final ScopeFormatter scopeFormatter) { | ||
| return scopeFormatter.getAppName().equalsIgnoreCase("whois") | ||
| && scopeFormatter.getScopeType().equalsIgnoreCase(ObjectType.MNTNER.getName()) | ||
| && scopeFormatter.getScopeKey().equalsIgnoreCase(maintainer.getKey().toString()); | ||
| } | ||
|
|
||
| static class ScopeFormatter { | ||
|
|
||
| final String appName; | ||
| final String scopeType; | ||
| final String scopeKey; | ||
|
|
||
| public ScopeFormatter(final String scope) { | ||
| final String[] parts = scope.split(":|\\."); | ||
| this.appName = parts[0]; | ||
| this.scopeType = parts[1]; | ||
| this.scopeKey = parts[2]; | ||
| } | ||
|
|
||
| public String getScopeType() { | ||
| return scopeType; | ||
| } | ||
|
|
||
| public String getScopeKey() { | ||
| return scopeKey; | ||
| } | ||
|
|
||
| public String getAppName() { | ||
| return appName; | ||
| } | ||
| } | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
26 changes: 26 additions & 0 deletions
26
whois-update/src/main/java/net/ripe/db/whois/update/domain/APIKeyCredential.java
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,26 @@ | ||
| package net.ripe.db.whois.update.domain; | ||
|
|
||
| import com.google.common.base.Splitter; | ||
| import net.ripe.db.whois.common.apiKey.OAuthSession; | ||
| import net.ripe.db.whois.common.sso.UserSession; | ||
|
|
||
| public class APIKeyCredential implements Credential { | ||
|
|
||
| private final OAuthSession offeredOAuthSession; | ||
|
|
||
| private APIKeyCredential(final OAuthSession offeredOAuthSession) { | ||
| this.offeredOAuthSession = offeredOAuthSession; | ||
| } | ||
|
|
||
| public static Credential createOfferedCredential(final OAuthSession offeredOAuthSession) { | ||
| return new APIKeyCredential(offeredOAuthSession); | ||
| } | ||
|
|
||
| public OAuthSession getOfferedOAuthSession() { | ||
| return offeredOAuthSession; | ||
| } | ||
| @Override | ||
| public String toString() { | ||
| return String.format("APIKeyCredential{offeredUserSession=%s}", offeredOAuthSession); | ||
| } | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.