update gateway to support HTTP headers authentication

georchestra · Sep 16, 2023 · 36dc704 · 36dc704
1 parent a97dc39
commit 36dc704
Show file tree

Hide file tree

Showing 3 changed files with 18 additions and 7 deletions.
diff --git a/...c/main/java/org/georchestra/gateway/filter/headers/RemoveHeadersGatewayFilterFactory.java b/...c/main/java/org/georchestra/gateway/filter/headers/RemoveHeadersGatewayFilterFactory.java
@@ -18,11 +18,14 @@
  */
 package org.georchestra.gateway.filter.headers;
 
+import java.net.InetAddress;
+import java.net.UnknownHostException;
 import java.util.Arrays;
 import java.util.HashSet;
 import java.util.List;
 import java.util.Objects;
 import java.util.regex.Pattern;
+import java.util.stream.Collectors;
 
 import org.georchestra.gateway.filter.headers.RemoveHeadersGatewayFilterFactory.RegExConfig;
 import org.georchestra.gateway.model.GatewayConfigProperties;
@@ -106,10 +109,19 @@ public GatewayFilter apply(RegExConfig regexConfig) {
     }
 
     private boolean headerAuthenticated(String serverAddress) {
-        if (configProps != null && configProps.getHeaderTrustedProxies() != null
+        if (configProps != null && !configProps.getHeaderTrustedProxies().isEmpty()
                 && configProps.isHeaderAuthentication()) {
-            HashSet hashSet = new HashSet<>(Arrays.asList(configProps.getHeaderTrustedProxies().split(";")));
-            if (!hashSet.isEmpty() && hashSet.contains(serverAddress)) {
+            if (configProps.getHeaderTrustedProxies().stream().filter(e -> serverAddress.contains(e))
+                    .collect(Collectors.toList()).size() > 0) {
+                return true;
+            }
+            if (configProps.getHeaderTrustedProxies().stream().filter(e -> {
+                try {
+                    return InetAddress.getByName(serverAddress).toString().contains(e);
+                } catch (UnknownHostException exp) {
+                    return false;
+                }
+            }).collect(Collectors.toList()).size() > 0) {
                 return true;
             }
         }

diff --git a/gateway/src/main/java/org/georchestra/gateway/model/GatewayConfigProperties.java b/gateway/src/main/java/org/georchestra/gateway/model/GatewayConfigProperties.java
@@ -40,7 +40,7 @@ public class GatewayConfigProperties {
 
     private boolean headerAuthentication = false;
 
-    private String headerTrustedProxies;
+    private List<String> headerTrustedProxies;
 
     private Map<String, List<String>> rolesMappings = Map.of();
 

diff --git a/...c/main/java/org/georchestra/gateway/security/ResolveHttpHeadersGeorchestraUserFilter.java b/...c/main/java/org/georchestra/gateway/security/ResolveHttpHeadersGeorchestraUserFilter.java
@@ -64,7 +64,8 @@ public class ResolveHttpHeadersGeorchestraUserFilter implements GlobalFilter, Or
     }
 
     public @Override Mono<Void> filter(ServerWebExchange exchange, GatewayFilterChain chain) {
-        if (exchange.getRequest().getHeaders().containsKey("sec-mellon-name-id")) {
+        if (exchange.getRequest().getHeaders().containsKey("sec-georchestra-preauthenticated")
+                && exchange.getRequest().getHeaders().get("sec-georchestra-preauthenticated").get(0).equals("true")) {
             if (config.isCreateNonExistingUsersInLDAP()) {
                 String username = exchange.getRequest().getHeaders().get("sec-username").get(0);
                 Optional<GeorchestraUser> userOpt = map(username);
@@ -118,7 +119,6 @@ protected Optional<GeorchestraUser> map(String username) {
                 roles.add("ROLE_USER");
             }
             userOpt.get().setRoles(roles);
-            userOpt.get().setOrganization("INRAE");
         }
         return userOpt;
     }
@@ -139,7 +139,6 @@ protected Optional<GeorchestraUser> map(ServerWebExchange exchange) {
             roles.add("ROLE_USER");
         }
         user.setRoles(roles);
-        user.setOrganization("INRAE");
         return Optional.of(user);
     }