Skip to content

Commit 2ca84f0

Browse files
fhanikfhanik
committed
Add document that lists what may still be needed to be completed.
1 parent 604e613 commit 2ca84f0

File tree

2 files changed

+184
-1
lines changed

2 files changed

+184
-1
lines changed

‎docs/path-based-zones-endpoints-without-z-support.md‎

Lines changed: 183 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,183 @@
1+
# Endpoints Without `/z/{subdomain}/` Support (Discovery)
2+
3+
This document lists endpoints that do **not** yet have a dual path mapping for `/z/{subdomain}/...`. Security config may already allow `/z/*/path` in some cases; the **controller** (or filter) still only maps the non-zone path. Tests that hit these paths are listed so you can extend them with zone-path permutations or add new tests when adding `/z/` support.
4+
5+
**Legend:**
6+
- **Controller has /z/?** – Controller (or endpoint class) has a second path variant like `/z/{subdomain}/...`.
7+
- **Security has /z/*/?** – At least one security filter chain or requestMatcher includes a `/z/*/...` (or `/z/{subdomain}/...`) pattern for this path.
8+
- **Tests** – Test classes or test methods that perform requests to these paths (get/post/put/delete to the path). These are the tests that may need zone-path parameterization or new cases when you add `/z/` support.
9+
10+
---
11+
12+
## Table of Contents
13+
14+
1. ❌ [Reset / forgot password (UI)](#1-reset--forgot-password-ui)
15+
2. ❌ [Change password (UI)](#2-change-password-ui)
16+
3. ❌ [Change email / verify email (UI)](#3-change-email--verify-email-ui)
17+
4. ❌ [Force password change (UI)](#4-force-password-change-ui)
18+
5. ❌ [Logged out (UI)](#5-logged-out-ui)
19+
6. ❌ [Home and error pages (UI)](#6-home-and-error-pages-ui)
20+
7. ❌ [Session (UI)](#7-session-ui)
21+
8. ❌ [Invitations (UI + API)](#8-invitations-ui--api)
22+
9. ❌ [Profile (UI)](#9-profile-ui)
23+
10. ❌ [Passcode (API / UI)](#10-passcode-api--ui)
24+
11. ❌ [OAuth / token / client admin (API)](#11-oauth--token--client-admin-api-not-yet-covered-by-z)
25+
12. ❌ [Authenticate (API)](#12-authenticate-api)
26+
13. ❌ [Zone Switching - Path Aware Zone Sessions](#13-zone-switching---path-aware-zone-sessions)
27+
14. ❌ [Summary (high-level)](#summary-high-level)
28+
15. ✅ [Pull Request](https://github.com/cloudfoundry/uaa/pull/3730)
29+
15. ✅ [Feature Branch](https://github.com/fhanik/uaa/tree/feature/path-based-zones)
30+
---
31+
32+
## 1. Reset / forgot password (UI)
33+
34+
| Endpoint(s) | Controller / Class | Controller has /z/? | Security has /z/*/? | Tests that touch these endpoints |
35+
|-------------|--------------------|---------------------|----------------------|-----------------------------------|
36+
| `/forgot_password` | ResetPasswordController | No | Yes (LoginSecurityConfiguration login form chain) | ResetPasswordControllerMockMvcTests, ResetPasswordControllerTest, LoginMockMvcTests (forgot_password.do, links) |
37+
| `/forgot_password.do` | ResetPasswordController | No | Yes | Same as above |
38+
| `/email_sent` | ResetPasswordController | No | Yes (noSecurityEndpoints has `/z/*/email_sent`) | ResetPasswordControllerTest, AccountsControllerMockMvcTests (accounts/email_sent) |
39+
| `/reset_password` (HEAD, GET with `code`) | ResetPasswordController | No | Yes (login form chain) | ResetPasswordControllerMockMvcTests, ResetPasswordControllerTest, ResetPasswordAuthenticationEntryPointTests (forward) |
40+
| `/reset_password.do` | ResetPasswordController | No | Yes (login form + ResetPasswordAuthenticationFilter) | ResetPasswordControllerMockMvcTests, ResetPasswordControllerTest, ResetPasswordAuthenticationFilterTest |
41+
42+
**Note:** Security already has `/z/*/forgot_password`, `/z/*/reset_password**`, etc. in LoginSecurityConfiguration. The **controller** still only declares the single path (e.g. `@GetMapping("/forgot_password")`). Adding `/z/{subdomain}/...` to the controller mappings is the remaining work.
43+
44+
---
45+
46+
## 2. Change password (UI)
47+
48+
| Endpoint(s) | Controller / Class | Controller has /z/? | Security has /z/*/? | Tests that touch these endpoints |
49+
|-------------|--------------------|---------------------|----------------------|-----------------------------------|
50+
| `/change_password` | ChangePasswordController | No | No (chain is `/password_*` only) | LoginMockMvcTests (get/change_password, post/change_password.do) |
51+
| `/change_password.do` | ChangePasswordController | No | No | Same as above |
52+
53+
**Note:** LoginSecurityConfiguration has a separate chain for `/password_*` with no `/z/*/` variant. Both controller and security need updates for zone path.
54+
55+
---
56+
57+
## 3. Change email / verify email (UI)
58+
59+
| Endpoint(s) | Controller / Class | Controller has /z/? | Security has /z/*/? | Tests that touch these endpoints |
60+
|-------------|--------------------|---------------------|----------------------|-----------------------------------|
61+
| `/change_email` | ChangeEmailController | No | No (chain is `/email_*` only) | LoginMockMvcTests, ChangeEmailControllerTest |
62+
| `/change_email.do` | ChangeEmailController | No | No | Same as above |
63+
| `/verify_email` | ChangeEmailController | No | No | ChangeEmailControllerTest |
64+
65+
**Note:** LoginSecurityConfiguration has a separate chain for `/email_*` with no `/z/*/` variant. Both controller and security need updates.
66+
67+
---
68+
69+
## 4. Force password change (UI)
70+
71+
| Endpoint(s) | Controller / Class | Controller has /z/? | Security has /z/*/? | Tests that touch these endpoints |
72+
|-------------|--------------------|---------------------|----------------------|-----------------------------------|
73+
| `/force_password_change`, `/force_password_change/` | ForcePasswordChangeController | No | Yes (login form chain) | ForcePasswordChangeControllerTest, ForcePasswordChangeControllerMockMvcTest, UaaAuthenticationFailureHandlerTests (redirect + applyRequestPath) |
74+
| `/force_password_change_completed` | No controller mapping (redirect target; PasswordChangeUiRequiredFilter uses path) | N/A | No (not in noSecurityEndpoints with /z/) | ForcePasswordChangeControllerMockMvcTest (get), PasswordChangeUiRequiredFilterTest (setPathInfo) |
75+
76+
**Note:** Security already has `/z/*/force_password_change/**`. Controller has no `/z/` variant. `force_password_change_completed` is a redirect target and filter path; no explicit `@GetMapping` found—may be served as view or by default. If it gets a controller, it will need `/z/` support too.
77+
78+
---
79+
80+
## 5. Logged out (UI)
81+
82+
| Endpoint(s) | Controller / Class | Controller has /z/? | Security has /z/*/? | Tests that touch these endpoints |
83+
|-------------|--------------------|---------------------|----------------------|-----------------------------------|
84+
| `/logged_out` | LoggedOutEndpoint | No | No (noSecurityEndpoints has `/logged_out` but no `/z/*/logged_out`) | Indirect (logout flows redirect here) |
85+
86+
**Note:** SpringServletXmlSecurityConfiguration noSecurityEndpoints includes `/logged_out` only; no `/z/*/logged_out`. Controller has single path.
87+
88+
---
89+
90+
## 6. Home and error pages (UI)
91+
92+
| Endpoint(s) | Controller / Class | Controller has /z/? | Security has /z/*/? | Tests that touch these endpoints |
93+
|-------------|--------------------|---------------------|----------------------|-----------------------------------|
94+
| `/`, `/home` | HomeController | No | No | LoginMockMvcTests (get("/")), HomeControllerViewTests (get("/home")), IdentityZoneEndpointsMockMvcTests (homeRedirect link) |
95+
| `/error500` | HomeController | No | No (noSecurityEndpoints has `/error**`) | — |
96+
| `/saml_error` | HomeController | No | No (noSecurityEndpoints has `/saml_error`) | — |
97+
| `/oauth_error` | HomeController | No | No | — |
98+
| `/rejected` | HomeController | No | No (noSecurityEndpoints has `/rejected`) | — |
99+
100+
**Note:** noSecurityEndpoints does not add `/z/*/` for these. Controller has no `/z/` variants.
101+
102+
---
103+
104+
## 7. Session (UI)
105+
106+
| Endpoint(s) | Controller / Class | Controller has /z/? | Security has /z/*/? | Tests that touch these endpoints |
107+
|-------------|--------------------|---------------------|----------------------|-----------------------------------|
108+
| `/session` | SessionController | No | No (noSecurityEndpoints has `/session` but no `/z/*/session`) | SessionControllerIntegrationTests |
109+
| `/session_management` | SessionController | No | No | SessionControllerIntegrationTests |
110+
111+
---
112+
113+
## 8. Invitations (UI + API)
114+
115+
| Endpoint(s) | Controller / Class | Controller has /z/? | Security has /z/*/? | Tests that touch these endpoints |
116+
|-------------|--------------------|---------------------|----------------------|-----------------------------------|
117+
| `/invitations/accept` | InvitationsController | No | No (LoginSecurityConfiguration has /invitations/accept without /z/) | InvitationsEndpointMockMvcTests, InvitationsControllerTest, InvitationsServiceMockMvcTests, AbstractLdapMockMvcTest |
118+
| `/invitations/accept.do` | InvitationsController | No | No | Same as above |
119+
| `/invitations/accept_enterprise.do` | InvitationsController | No | No | InvitationsControllerTest, AbstractLdapMockMvcTest |
120+
| `/invitations/sent`, `/invitations/new`, `/invitations/new.do` | InvitationsController | No | No | InvitationsControllerTest (if any hit these) |
121+
| `/invite_users`, `/invite_users/` | InvitationsEndpoint (API) | No | No (LoginSecurityConfiguration /invite_users/** has no /z/) | InvitationsEndpointMockMvcTests |
122+
123+
---
124+
125+
## 9. Profile (UI)
126+
127+
| Endpoint(s) | Controller / Class | Controller has /z/? | Security has /z/*/? | Tests that touch these endpoints |
128+
|-------------|--------------------|---------------------|----------------------|-----------------------------------|
129+
| `/profile`, `/profile/` | ProfileController | No | No (login form chain has no /z/*/ for profile) | ProfileControllerMockMvcTests, LoginMockMvcTests (redirect:profile), InvitationsServiceMockMvcTests |
130+
131+
---
132+
133+
## 10. Passcode (API / UI)
134+
135+
| Endpoint(s) | Controller / Class | Controller has /z/? | Security has /z/*/? | Tests that touch these endpoints |
136+
|-------------|--------------------|---------------------|----------------------|-----------------------------------|
137+
| `/passcode` | PasscodeEndpoint | No | No (OauthEndpointSecurityConfiguration passcode matcher has no /z/) | PasscodeMockMvcTests, TokenMvcMockTests (get("/passcode")), AbstractLdapMockMvcTest, LoginInfoEndpointTests (prompt text) |
138+
139+
---
140+
141+
## 11. OAuth / token / client admin (API – not yet covered by /z/)
142+
143+
| Endpoint(s) | Controller / Class | Controller has /z/? | Security has /z/*/? | Tests that touch these endpoints |
144+
|-------------|--------------------|---------------------|----------------------|-----------------------------------|
145+
| `/oauth/confirm_access` | AccessController | No | No | — |
146+
| `/oauth/error` | AccessController | No | No | — |
147+
| `/oauth/token/revoke/user/{userId}` etc. | TokenRevocationEndpoint | No | No (OauthEndpointSecurityConfiguration /oauth/token/revoke/** has no /z/) | — |
148+
| `/check_token` | CheckTokenEndpoint | No | No | — |
149+
| `/introspect` | IntrospectEndpoint | No | No | — |
150+
| `/oauth/clients/**` | ClientAdminEndpoints, ClientMetadataAdminEndpoints | No | No (ClientAdminSecurityConfiguration has no /z/) | — |
151+
| `/identity-providers/**` | IdentityProviderEndpoints | No | No (IdentityZoneSecurityConfiguration has no /z/) | — |
152+
| `/identity-zones/**` | — | No | No | IdentityZoneEndpointsMockMvcTests (already parameterized for zone path in tests) |
153+
| `/Codes/**` | CodeStoreEndpoints | No | No | — |
154+
| `/email_verifications`, `/email_changes` | ChangeEmailEndpoints (SCIM) | No | No | — |
155+
| `/RateLimitingStatus/**` | RateLimitStatusController | No | No | — |
156+
| `/saml/metadata`, `/saml/metadata/` | SamlMetadataEndpoint | No | No (secFilterOpenSamlEndPoints has no /z/) | — |
157+
158+
---
159+
160+
## 12. Authenticate (API)
161+
162+
| Endpoint(s) | Controller / Class | Controller has /z/? | Security has /z/*/? | Tests that touch these endpoints |
163+
|-------------|--------------------|---------------------|----------------------|-----------------------------------|
164+
| `/authenticate`, `/authenticate/` | RemoteAuthenticationEndpoint | No | No (LoginSecurityConfiguration authenticate chain has no /z/) | LoginMockMvcTests (post("/authenticate")) |
165+
166+
---
167+
168+
## 13. Zone Switching - Path Aware Zone Sessions
169+
170+
Once steps 1-12 are completed, the system will work for a single session.
171+
Switching zones by changing the /z/ zone path, will cause the SessionResetFilter
172+
to kick in and redirect the user to the default zone login page.
173+
174+
There is a decision to be made at this point, do we support multiple zone sessions when using paths?
175+
If so, there will be a session implementation, very much like the one IdentityZoneResolving/Switching filters
176+
that allows the same server side session hold attributes for multiple zones at the same time
177+
178+
## Summary (high-level)
179+
180+
- **UI endpoints most likely to need `/z/` next:** reset_password, forgot_password, change_password, change_email, verify_email, force_password_change (and _completed), logged_out, home, session, invitations (accept flow), profile, passcode. Security already has `/z/*/` for several of these (forgot_password, reset_password, force_password_change, create_account, login, etc.); the **controller** mappings are what’s missing.
181+
- **Security chains that don’t yet have `/z/*/`:** `/password_*`, `/email_*`, noSecurityEndpoints for `/session`, `/session_management`, `/logged_out`, `/`, `/home`, `/error**`, `/saml_error`, `/oauth_error`, `/rejected`; invitations and invite_users; profile; passcode; OAuth confirm_access/error; token revoke; check_token; introspect; client admin; identity-providers; identity-zones; Codes; RateLimitingStatus; SAML metadata; authenticate.
182+
- **Tests:** The “Tests that touch these endpoints” column lists the test classes/methods that perform requests to the given path. When you add `/z/{subdomain}/` support for an endpoint, parameterize those tests with `ZoneResolutionMode` (or equivalent) or add dedicated zone-path tests so both default and `/z/` paths are covered.
183+

‎server/src/main/java/org/cloudfoundry/identity/uaa/SpringServletXmlFiltersConfiguration.java‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -189,7 +189,7 @@ FilterRegistrationBean<SessionResetFilter> sessionResetFilter(
189189
SessionResetFilter filter = new SessionResetFilter(
190190
new DefaultRedirectStrategy(),
191191
identityZoneManager,
192-
"/login",
192+
"/login", //TODO not zone path aware.
193193
userDatabase
194194
);
195195
FilterRegistrationBean<SessionResetFilter> bean = new FilterRegistrationBean<>(filter);

0 commit comments

Comments
 (0)