Skip to content

Commit f0a5eab

Browse files
asloobqasloobq
committed
Admin auditlogs 401s
1 parent b02ac75 commit f0a5eab

16 files changed

+244
-213
lines changed

‎src/main/java/com/uid2/admin/Main.java‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -30,6 +30,7 @@
3030
import com.uid2.admin.vertx.service.*;
3131
import com.uid2.shared.Const;
3232
import com.uid2.shared.Utils;
33+
import com.uid2.shared.audit.Audit;
3334
import com.uid2.shared.secret.KeyHasher;
3435
import com.uid2.shared.secret.SecureKeyGenerator;
3536
import com.uid2.shared.auth.EnclaveIdentifierProvider;
@@ -259,7 +260,7 @@ public void run() {
259260
clientSideKeypairService,
260261
new ServiceService(auth, writeLock, serviceStoreWriter, serviceProvider, siteProvider, serviceLinkProvider),
261262
new ServiceLinkService(auth, writeLock, serviceLinkStoreWriter, serviceLinkProvider, serviceProvider, siteProvider),
262-
new OperatorKeyService(config, auth, writeLock, operatorKeyStoreWriter, operatorKeyProvider, siteProvider, keyGenerator, keyHasher, cloudEncryptionKeyManager),
263+
new OperatorKeyService(config, auth, writeLock, operatorKeyStoreWriter, operatorKeyProvider, siteProvider, keyGenerator, keyHasher, cloudEncryptionKeyManager, new Audit(Main.class.getPackage().getName())),
263264
new SaltService(auth, writeLock, saltStoreWriter, saltProvider, saltRotation),
264265
new SiteService(auth, writeLock, siteStoreWriter, siteProvider, clientKeyProvider),
265266
new PartnerConfigService(auth, writeLock, partnerStoreWriter, partnerConfigProvider),

‎src/main/java/com/uid2/admin/auth/AdminAuthMiddleware.java‎

Lines changed: 6 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -9,8 +9,6 @@
99
import io.vertx.ext.web.RoutingContext;
1010
import org.slf4j.Logger;
1111
import org.slf4j.LoggerFactory;
12-
import com.uid2.shared.audit.AuditParams;
13-
import com.uid2.shared.audit.Audit;
1412

1513
import java.util.*;
1614

@@ -19,7 +17,6 @@ public class AdminAuthMiddleware {
1917
private final AuthProvider authProvider;
2018
private final String environment;
2119
private final boolean isAuthDisabled;
22-
private final Audit audit;
2320

2421
final Map<Role, List<OktaGroup>> roleToOktaGroups = new EnumMap<>(Role.class);
2522
public AdminAuthMiddleware(AuthProvider authProvider, JsonObject config) {
@@ -29,7 +26,6 @@ public AdminAuthMiddleware(AuthProvider authProvider, JsonObject config) {
2926
roleToOktaGroups.put(Role.MAINTAINER, parseOktaGroups(config.getString(AdminConst.ROLE_OKTA_GROUP_MAP_MAINTAINER)));
3027
roleToOktaGroups.put(Role.PRIVILEGED, parseOktaGroups(config.getString(AdminConst.ROLE_OKTA_GROUP_MAP_PRIVILEGED)));
3128
roleToOktaGroups.put(Role.SUPER_USER, parseOktaGroups(config.getString(AdminConst.ROLE_OKTA_GROUP_MAP_SUPER_USER)));
32-
this.audit = new Audit(AdminAuthMiddleware.class.getPackage().getName());
3329
}
3430

3531
private List<OktaGroup> parseOktaGroups(final String oktaGroups) {
@@ -44,29 +40,16 @@ private List<OktaGroup> parseOktaGroups(final String oktaGroups) {
4440
return allOktaGroups;
4541
}
4642

47-
public Handler<RoutingContext> handle(Handler<RoutingContext> handler, AuditParams params, Role... roles) {
43+
public Handler<RoutingContext> handle(Handler<RoutingContext> handler, Role... roles) {
4844
if (isAuthDisabled) return handler;
4945
if (roles == null || roles.length == 0) {
5046
throw new IllegalArgumentException("must specify at least one role");
5147
}
52-
Handler<RoutingContext> loggedHandler = logAndHandle(handler, params);
53-
AdminAuthHandler adminAuthHandler = new AdminAuthHandler(loggedHandler, authProvider, Set.of(roles),
48+
AdminAuthHandler adminAuthHandler = new AdminAuthHandler(handler, authProvider, Set.of(roles),
5449
environment, roleToOktaGroups);
5550
return adminAuthHandler::handle;
5651
}
5752

58-
public Handler<RoutingContext> handle(Handler<RoutingContext> handler, Role... roles) {
59-
return this.handle(handler, new AuditParams(), roles);
60-
}
61-
62-
63-
private Handler<RoutingContext> logAndHandle(Handler<RoutingContext> handler, AuditParams params) {
64-
return ctx -> {
65-
ctx.addBodyEndHandler(v -> this.audit.log(ctx, params));
66-
handler.handle(ctx);
67-
};
68-
}
69-
7053
private static class AdminAuthHandler {
7154
private final String environment;
7255
private final Handler<RoutingContext> innerHandler;
@@ -125,6 +108,7 @@ public void handle(RoutingContext rc) {
125108
}
126109
if(idToken != null) {
127110
validateIdToken(rc, idToken);
111+
rc.next();
128112
return;
129113
}
130114

@@ -133,9 +117,11 @@ public void handle(RoutingContext rc) {
133117
String accessToken = extractBearerToken(authHeaderValue);
134118
if(accessToken == null) {
135119
rc.response().putHeader("REQUIRES_AUTH", "1").setStatusCode(401).end();
120+
rc.next();
136121
return;
137122
}
138123
validateAccessToken(rc, accessToken);
124+
139125
}
140126

141127
private void validateAccessToken(RoutingContext rc, String accessToken) {
@@ -160,6 +146,7 @@ private void validateAccessToken(RoutingContext rc, String accessToken) {
160146
} else {
161147
rc.response().setStatusCode(401).end();
162148
}
149+
rc.next();
163150
}
164151

165152
private void validateIdToken(RoutingContext rc, String idToken) {

‎src/main/java/com/uid2/admin/vertx/service/ClientKeyService.java‎

Lines changed: 47 additions & 47 deletions
Original file line numberDiff line numberDiff line change
@@ -91,53 +91,53 @@ public void setupRoutes(Router router) {
9191
router.get(API_CLIENT_REVEAL.toString()).handler(
9292
auth.handle(this::handleClientReveal, Role.PRIVILEGED));
9393

94-
router.post(API_CLIENT_ADD.toString()).blockingHandler(auth.handle((ctx) -> {
95-
synchronized (writeLock) {
96-
this.handleClientAdd(ctx);
97-
}
98-
}, new AuditParams(List.of("name", "roles", "site_id"), Collections.emptyList()), Role.MAINTAINER, Role.SHARING_PORTAL));
99-
100-
router.post(API_CLIENT_DEL.toString()).blockingHandler(auth.handle((ctx) -> {
101-
synchronized (writeLock) {
102-
this.handleClientDel(ctx);
103-
}
104-
}, new AuditParams(List.of("contact"), Collections.emptyList()), Role.SUPER_USER));
105-
106-
router.post(API_CLIENT_UPDATE.toString()).blockingHandler(auth.handle((ctx) -> {
107-
synchronized (writeLock) {
108-
this.handleClientUpdate(ctx);
109-
}
110-
}, new AuditParams(List.of("contact"), Collections.emptyList()), Role.MAINTAINER));
111-
112-
router.post(API_CLIENT_DISABLE.toString()).blockingHandler(auth.handle((ctx) -> {
113-
synchronized (writeLock) {
114-
this.handleClientDisable(ctx);
115-
}
116-
}, new AuditParams(List.of("contact"), Collections.emptyList()), Role.MAINTAINER, Role.SHARING_PORTAL));
117-
118-
router.post(API_CLIENT_ENABLE.toString()).blockingHandler(auth.handle((ctx) -> {
119-
synchronized (writeLock) {
120-
this.handleClientEnable(ctx);
121-
}
122-
}, new AuditParams(List.of("contact"), Collections.emptyList()), Role.MAINTAINER));
123-
124-
router.post(API_CLIENT_ROLES.toString()).blockingHandler(auth.handle((ctx) -> {
125-
synchronized (writeLock) {
126-
this.handleClientRoles(ctx);
127-
}
128-
}, new AuditParams(List.of("contact", "roles"), Collections.emptyList()), Role.PRIVILEGED, Role.SHARING_PORTAL));
129-
130-
router.post(API_CLIENT_CONTACT.toString()).blockingHandler(auth.handle((ctx) -> {
131-
synchronized (writeLock) {
132-
this.handleClientContact(ctx);
133-
}
134-
}, Role.MAINTAINER));
135-
136-
router.post(API_CLIENT_RENAME.toString()).blockingHandler(auth.handle((ctx) -> {
137-
synchronized (writeLock) {
138-
this.handleClientRename(ctx);
139-
}
140-
}, new AuditParams(List.of("contact", "newName"), Collections.emptyList()), Role.MAINTAINER, Role.SHARING_PORTAL));
94+
// router.post(API_CLIENT_ADD.toString()).blockingHandler(auth.handle((ctx) -> {
95+
// synchronized (writeLock) {
96+
// this.handleClientAdd(ctx);
97+
// }
98+
// }, new AuditParams(List.of("name", "roles", "site_id"), Collections.emptyList()), Role.MAINTAINER, Role.SHARING_PORTAL));
99+
//
100+
// router.post(API_CLIENT_DEL.toString()).blockingHandler(auth.handle((ctx) -> {
101+
// synchronized (writeLock) {
102+
// this.handleClientDel(ctx);
103+
// }
104+
// }, new AuditParams(List.of("contact"), Collections.emptyList()), Role.SUPER_USER));
105+
//
106+
// router.post(API_CLIENT_UPDATE.toString()).blockingHandler(auth.handle((ctx) -> {
107+
// synchronized (writeLock) {
108+
// this.handleClientUpdate(ctx);
109+
// }
110+
// }, new AuditParams(List.of("contact"), Collections.emptyList()), Role.MAINTAINER));
111+
//
112+
// router.post(API_CLIENT_DISABLE.toString()).blockingHandler(auth.handle((ctx) -> {
113+
// synchronized (writeLock) {
114+
// this.handleClientDisable(ctx);
115+
// }
116+
// }, new AuditParams(List.of("contact"), Collections.emptyList()), Role.MAINTAINER, Role.SHARING_PORTAL));
117+
//
118+
// router.post(API_CLIENT_ENABLE.toString()).blockingHandler(auth.handle((ctx) -> {
119+
// synchronized (writeLock) {
120+
// this.handleClientEnable(ctx);
121+
// }
122+
// }, new AuditParams(List.of("contact"), Collections.emptyList()), Role.MAINTAINER));
123+
//
124+
// router.post(API_CLIENT_ROLES.toString()).blockingHandler(auth.handle((ctx) -> {
125+
// synchronized (writeLock) {
126+
// this.handleClientRoles(ctx);
127+
// }
128+
// }, new AuditParams(List.of("contact", "roles"), Collections.emptyList()), Role.PRIVILEGED, Role.SHARING_PORTAL));
129+
//
130+
// router.post(API_CLIENT_CONTACT.toString()).blockingHandler(auth.handle((ctx) -> {
131+
// synchronized (writeLock) {
132+
// this.handleClientContact(ctx);
133+
// }
134+
// }, Role.MAINTAINER));
135+
//
136+
// router.post(API_CLIENT_RENAME.toString()).blockingHandler(auth.handle((ctx) -> {
137+
// synchronized (writeLock) {
138+
// this.handleClientRename(ctx);
139+
// }
140+
// }, new AuditParams(List.of("contact", "newName"), Collections.emptyList()), Role.MAINTAINER, Role.SHARING_PORTAL));
141141
}
142142

143143
private void handleRewriteMetadata(RoutingContext rc) {

‎src/main/java/com/uid2/admin/vertx/service/ClientSideKeypairService.java‎

Lines changed: 15 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -66,21 +66,21 @@ public ClientSideKeypairService(JsonObject config,
6666

6767
@Override
6868
public void setupRoutes(Router router) {
69-
router.post(API_CLIENT_SIDE_KEYPAIRS_ADD.toString()).blockingHandler(auth.handle((ctx) -> {
70-
synchronized (writeLock) {
71-
this.handleAddKeypair(ctx);
72-
}
73-
}, new AuditParams(Collections.emptyList(), List.of("site_id", "name", "contact", "disabled")), Role.MAINTAINER, Role.SHARING_PORTAL));
74-
router.post(API_CLIENT_SIDE_KEYPAIRS_UPDATE.toString()).blockingHandler(auth.handle((ctx) -> {
75-
synchronized (writeLock) {
76-
this.handleUpdateKeypair(ctx);
77-
}
78-
}, new AuditParams(Collections.emptyList(), List.of("subscription_id", "name", "contact", "disabled")), Role.MAINTAINER, Role.SHARING_PORTAL));
79-
router.post(API_CLIENT_SIDE_KEYPAIRS_DELETE.toString()).blockingHandler(auth.handle((ctx) -> {
80-
synchronized (writeLock) {
81-
this.handleDeleteKeypair(ctx);
82-
}
83-
}, new AuditParams(Collections.emptyList(), List.of("subscription_id")), Role.PRIVILEGED, Role.SHARING_PORTAL));
69+
// router.post(API_CLIENT_SIDE_KEYPAIRS_ADD.toString()).blockingHandler(auth.handle((ctx) -> {
70+
// synchronized (writeLock) {
71+
// this.handleAddKeypair(ctx);
72+
// }
73+
// }, new AuditParams(Collections.emptyList(), List.of("site_id", "name", "contact", "disabled")), Role.MAINTAINER, Role.SHARING_PORTAL));
74+
// router.post(API_CLIENT_SIDE_KEYPAIRS_UPDATE.toString()).blockingHandler(auth.handle((ctx) -> {
75+
// synchronized (writeLock) {
76+
// this.handleUpdateKeypair(ctx);
77+
// }
78+
// }, new AuditParams(Collections.emptyList(), List.of("subscription_id", "name", "contact", "disabled")), Role.MAINTAINER, Role.SHARING_PORTAL));
79+
// router.post(API_CLIENT_SIDE_KEYPAIRS_DELETE.toString()).blockingHandler(auth.handle((ctx) -> {
80+
// synchronized (writeLock) {
81+
// this.handleDeleteKeypair(ctx);
82+
// }
83+
// }, new AuditParams(Collections.emptyList(), List.of("subscription_id")), Role.PRIVILEGED, Role.SHARING_PORTAL));
8484
router.get(API_CLIENT_SIDE_KEYPAIRS_LIST.toString()).handler(
8585
auth.handle(this::handleListAllKeypairs, Role.MAINTAINER, Role.METRICS_EXPORT));
8686
router.get(API_CLIENT_SIDE_KEYPAIRS_SUBSCRIPTIONID.toString()).handler(

‎src/main/java/com/uid2/admin/vertx/service/CloudEncryptionKeyService.java‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -42,9 +42,9 @@ public void setupRoutes(Router router) {
4242
auth.handle(this::handleList, Role.MAINTAINER)
4343
);
4444

45-
router.post(Endpoints.CLOUD_ENCRYPTION_KEY_ROTATE.toString()).handler(
46-
auth.handle(this::handleRotate, new AuditParams(List.of("fail"), Collections.emptyList()), Role.MAINTAINER, Role.SECRET_ROTATION)
47-
);
45+
// router.post(Endpoints.CLOUD_ENCRYPTION_KEY_ROTATE.toString()).handler(
46+
// auth.handle(this::handleRotate, new AuditParams(List.of("fail"), Collections.emptyList()), Role.MAINTAINER, Role.SECRET_ROTATION)
47+
// );
4848
}
4949

5050
private void handleMetadata(RoutingContext rc) {

‎src/main/java/com/uid2/admin/vertx/service/EnclaveIdService.java‎

Lines changed: 10 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -53,16 +53,16 @@ public void setupRoutes(Router router) {
5353
router.get(API_ENCLAVE_LIST.toString()).handler(
5454
auth.handle(this::handleEnclaveList, Role.MAINTAINER));
5555

56-
router.post(API_ENCLAVE_ADD.toString()).blockingHandler(auth.handle((ctx) -> {
57-
synchronized (writeLock) {
58-
this.handleEnclaveAdd(ctx);
59-
}
60-
}, new AuditParams(List.of("name", "protocol", "enclave_id"), Collections.emptyList()), Role.PRIVILEGED));
61-
router.post(API_ENCLAVE_DEL.toString()).blockingHandler(auth.handle((ctx) -> {
62-
synchronized (writeLock) {
63-
this.handleEnclaveDel(ctx);
64-
}
65-
}, new AuditParams(List.of("name"), Collections.emptyList()), Role.SUPER_USER));
56+
// router.post(API_ENCLAVE_ADD.toString()).blockingHandler(auth.handle((ctx) -> {
57+
// synchronized (writeLock) {
58+
// this.handleEnclaveAdd(ctx);
59+
// }
60+
// }, new AuditParams(List.of("name", "protocol", "enclave_id"), Collections.emptyList()), Role.PRIVILEGED));
61+
// router.post(API_ENCLAVE_DEL.toString()).blockingHandler(auth.handle((ctx) -> {
62+
// synchronized (writeLock) {
63+
// this.handleEnclaveDel(ctx);
64+
// }
65+
// }, new AuditParams(List.of("name"), Collections.emptyList()), Role.SUPER_USER));
6666
}
6767

6868
private void handleEnclaveMetadata(RoutingContext rc) {

‎src/main/java/com/uid2/admin/vertx/service/EncryptionKeyService.java‎

Lines changed: 19 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -144,25 +144,25 @@ public void setupRoutes(Router router) {
144144
}
145145
}, Role.MAINTAINER, Role.SECRET_ROTATION));
146146

147-
router.post(API_KEY_ADD.toString()).blockingHandler(auth.handle((ctx) -> {
148-
synchronized (writeLock) {
149-
this.handleAddSiteKey(ctx);
150-
}
151-
}, new AuditParams(List.of("site_id", "activates_in_seconds"), Collections.emptyList()), Role.MAINTAINER));
152-
153-
router.post(API_KEY_ROTATE_SITE.toString()).blockingHandler(auth.handle((ctx) -> {
154-
synchronized (writeLock) {
155-
this.handleRotateSiteKey(ctx);
156-
}
157-
}, new AuditParams(List.of("site_id"), Collections.emptyList()), Role.MAINTAINER));
158-
159-
if(enableKeysets) {
160-
router.post(API_KEY_ROTATE_KEYSET_KEY.toString()).blockingHandler(auth.handle((ctx) -> {
161-
synchronized (writeLock) {
162-
this.handleRotateKeysetKey(ctx);
163-
}
164-
}, new AuditParams(List.of("keyset_id"), Collections.emptyList()), Role.MAINTAINER));
165-
}
147+
// router.post(API_KEY_ADD.toString()).blockingHandler(auth.handle((ctx) -> {
148+
// synchronized (writeLock) {
149+
// this.handleAddSiteKey(ctx);
150+
// }
151+
// }, new AuditParams(List.of("site_id", "activates_in_seconds"), Collections.emptyList()), Role.MAINTAINER));
152+
//
153+
// router.post(API_KEY_ROTATE_SITE.toString()).blockingHandler(auth.handle((ctx) -> {
154+
// synchronized (writeLock) {
155+
// this.handleRotateSiteKey(ctx);
156+
// }
157+
// }, new AuditParams(List.of("site_id"), Collections.emptyList()), Role.MAINTAINER));
158+
//
159+
// if(enableKeysets) {
160+
// router.post(API_KEY_ROTATE_KEYSET_KEY.toString()).blockingHandler(auth.handle((ctx) -> {
161+
// synchronized (writeLock) {
162+
// this.handleRotateKeysetKey(ctx);
163+
// }
164+
// }, new AuditParams(List.of("keyset_id"), Collections.emptyList()), Role.MAINTAINER));
165+
// }
166166

167167
router.post(API_KEY_ROTATE_ALL_SITES.toString()).blockingHandler(auth.handle((ctx) -> {
168168
synchronized (writeLock) {

0 commit comments

Comments
 (0)