Skip to content

Commit fcd11d4

Browse files
FrankSchnickeFrankSchnicke
authored
Merge pull request #212 from FlorianWege-IESE/authorization2
Add audience jwt bearer security property
2 parents c62dc95 + e380de1 commit fcd11d4

File tree

6 files changed

+42
-4
lines changed

6 files changed

+42
-4
lines changed

‎basyx.components/basyx.components.docker/basyx.components.AASServer/src/main/java/org/eclipse/basyx/components/aas/authorization/AuthorizedAASServerFeature.java‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -91,6 +91,10 @@ public IJwtBearerTokenAuthenticationConfigurationProvider getJwtBearerTokenAuthe
9191
return null;
9292
}
9393

94+
if (securityConfig.getAuthorizationStrategyJwtBearerTokenAuthenticationConfigurationProvider() == null) {
95+
return null;
96+
}
97+
9498
return AuthorizationDynamicClassLoader.loadInstanceDynamically(securityConfig, BaSyxSecurityConfiguration.AUTHORIZATION_STRATEGY_JWT_BEARER_TOKEN_AUTHENTICATION_CONFIGURATION_PROVIDER,
9599
IJwtBearerTokenAuthenticationConfigurationProvider.class);
96100
}

‎basyx.components/basyx.components.docker/basyx.components.AASServer/src/main/resources/security.properties‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,9 +7,11 @@
77
# ######################
88
# authorization.strategy=SimpleRbac
99
authorization.strategy=GrantedAuthority
10-
authorization.strategy.jwtBearerTokenAuthenticationConfigurationProvider=org.eclipse.basyx.components.security.authorization.internal.KeycloakJwtBearerTokenAuthenticationConfigurationProvider
10+
# authorization.strategy=Custom
11+
# authorization.strategy.jwtBearerTokenAuthenticationConfigurationProvider=org.eclipse.basyx.components.security.authorization.internal.KeycloakJwtBearerTokenAuthenticationConfigurationProvider
1112
authorization.strategy.jwtBearerTokenAuthenticationConfigurationProvider.keycloak.serverUrl=http://localhost:9005
1213
authorization.strategy.jwtBearerTokenAuthenticationConfigurationProvider.keycloak.realm=basyx-demo
14+
authorization.strategy.jwtBearerTokenAuthenticationConfigurationProvider.audience=aas-server
1315
authorization.strategy.simpleRbac.rulesFilePath=/rbac_rules.json
1416
authorization.strategy.simpleRbac.subjectInformationProvider=org.eclipse.basyx.extensions.shared.authorization.internal.JWTAuthenticationContextProvider
1517
authorization.strategy.simpleRbac.roleAuthenticator=org.eclipse.basyx.extensions.shared.authorization.internal.KeycloakRoleAuthenticator

‎basyx.components/basyx.components.docker/basyx.components.registry/src/main/java/org/eclipse/basyx/components/registry/RegistryComponent.java‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -361,6 +361,9 @@ private void configureContextForAuthorization(final BaSyxContext context) {
361361
}
362362

363363
private IJwtBearerTokenAuthenticationConfigurationProvider getJwtBearerTokenAuthenticationConfigurationProvider() {
364+
if (securityConfig.getAuthorizationStrategyJwtBearerTokenAuthenticationConfigurationProvider() == null) {
365+
return null;
366+
}
364367
return AuthorizationDynamicClassLoader.loadInstanceDynamically(securityConfig, BaSyxSecurityConfiguration.AUTHORIZATION_STRATEGY_JWT_BEARER_TOKEN_AUTHENTICATION_CONFIGURATION_PROVIDER,
365368
IJwtBearerTokenAuthenticationConfigurationProvider.class);
366369
}

‎basyx.components/basyx.components.docker/basyx.components.registry/src/main/resources/security.properties‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,9 +7,11 @@
77
# ######################
88
# authorization.strategy=SimpleRbac
99
authorization.strategy=GrantedAuthority
10-
authorization.strategy.jwtBearerTokenAuthenticationConfigurationProvider=org.eclipse.basyx.components.security.authorization.internal.KeycloakJwtBearerTokenAuthenticationConfigurationProvider
10+
# authorization.strategy=Custom
11+
# authorization.strategy.jwtBearerTokenAuthenticationConfigurationProvider=org.eclipse.basyx.components.security.authorization.internal.KeycloakJwtBearerTokenAuthenticationConfigurationProvider
1112
authorization.strategy.jwtBearerTokenAuthenticationConfigurationProvider.keycloak.serverUrl=http://127.0.0.1:9005/auth
1213
authorization.strategy.jwtBearerTokenAuthenticationConfigurationProvider.keycloak.realm=basyx-demo
14+
authorization.strategy.jwtBearerTokenAuthenticationConfigurationProvider.audience=aas-registry
1315
authorization.strategy.simpleRbac.rulesFilePath=/rbac_rules.json
1416
authorization.strategy.simpleRbac.subjectInformationProvider=org.eclipse.basyx.extensions.shared.authorization.internal.JWTAuthenticationContextProvider
1517
authorization.strategy.simpleRbac.roleAuthenticator=org.eclipse.basyx.extensions.shared.authorization.internal.KeycloakRoleAuthenticator

‎basyx.components/basyx.components.lib/src/main/java/org/eclipse/basyx/components/configuration/BaSyxSecurityConfiguration.java‎

Lines changed: 10 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -49,6 +49,7 @@ public class BaSyxSecurityConfiguration extends BaSyxConfiguration {
4949
public static final String AUTHORIZATION_STRATEGY_JWT_BEARER_TOKEN_AUTHENTICATION_CONFIGURATION_PROVIDER = "authorization.strategy.jwtBearerTokenAuthenticationConfigurationProvider";
5050
public static final String AUTHORIZATION_STRATEGY_JWT_BEARER_TOKEN_AUTHENTICATION_CONFIGURATION_PROVIDER_KEYCLOAK_SERVER_URL = "authorization.strategy.jwtBearerTokenAuthenticationConfigurationProvider.keycloak.serverUrl";
5151
public static final String AUTHORIZATION_STRATEGY_JWT_BEARER_TOKEN_AUTHENTICATION_CONFIGURATION_PROVIDER_KEYCLOAK_REALM = "authorization.strategy.jwtBearerTokenAuthenticationConfigurationProvider.keycloak.realm";
52+
public static final String AUTHORIZATION_STRATEGY_JWT_BEARER_TOKEN_AUTHENTICATION_CONFIGURATION_PROVIDER_AUDIENCE = "authorization.strategy.jwtBearerTokenAuthenticationConfigurationProvider.audience";
5253
public static final String AUTHORIZATION_STRATEGY_SIMPLERBAC_RULES_FILE_PATH = "authorization.strategy.simpleRbac.rulesFilePath";
5354
public static final String AUTHORIZATION_STRATEGY_SIMPLERBAC_ROLE_AUTHENTICATOR = "authorization.strategy.simpleRbac.roleAuthenticator";
5455
public static final String AUTHORIZATION_STRATEGY_SIMPLERBAC_SUBJECT_INFORMATION_PROVIDER = "authorization.strategy.simpleRbac.subjectInformationProvider";
@@ -92,7 +93,7 @@ public BaSyxSecurityConfiguration() {
9293
*/
9394
public void loadFromEnvironmentVariables() {
9495
String[] properties = { AUTHORIZATION_STRATEGY, AUTHORIZATION_STRATEGY_JWT_BEARER_TOKEN_AUTHENTICATION_CONFIGURATION_PROVIDER, AUTHORIZATION_STRATEGY_JWT_BEARER_TOKEN_AUTHENTICATION_CONFIGURATION_PROVIDER_KEYCLOAK_SERVER_URL,
95-
AUTHORIZATION_STRATEGY_JWT_BEARER_TOKEN_AUTHENTICATION_CONFIGURATION_PROVIDER_KEYCLOAK_REALM, AUTHORIZATION_STRATEGY_SIMPLERBAC_RULES_FILE_PATH, AUTHORIZATION_STRATEGY_SIMPLERBAC_ROLE_AUTHENTICATOR,
96+
AUTHORIZATION_STRATEGY_JWT_BEARER_TOKEN_AUTHENTICATION_CONFIGURATION_PROVIDER_KEYCLOAK_REALM, AUTHORIZATION_STRATEGY_JWT_BEARER_TOKEN_AUTHENTICATION_CONFIGURATION_PROVIDER_AUDIENCE, AUTHORIZATION_STRATEGY_SIMPLERBAC_RULES_FILE_PATH, AUTHORIZATION_STRATEGY_SIMPLERBAC_ROLE_AUTHENTICATOR,
9697
AUTHORIZATION_STRATEGY_SIMPLERBAC_SUBJECT_INFORMATION_PROVIDER, AUTHORIZATION_STRATEGY_GRANTEDAUTHORITY_GRANTED_AUTHORITY_GRANTED_AUTHORITY_AUTHENTICATOR, AUTHORIZATION_STRATEGY_GRANTEDAUTHORITY_SUBJECT_INFORMATION_PROVIDER,
9798
AUTHORIZATION_STRATEGY_CUSTOM_AUTHORIZERS_PROVIDER, AUTHORIZATION_STRATEGY_CUSTOM_SUBJECT_INFORMATION_PROVIDER, };
9899
loadFromEnvironmentVariables(ENV_PREFIX, properties);
@@ -135,6 +136,14 @@ public void setAuthorizationStrategyJwtBearerTokenAuthenticationConfigurationPro
135136
setProperty(AUTHORIZATION_STRATEGY_JWT_BEARER_TOKEN_AUTHENTICATION_CONFIGURATION_PROVIDER_KEYCLOAK_REALM, authorizationStrategyJwtBearerTokenAuthenticationConfigurationProviderKeycloakRealm);
136137
}
137138

139+
public String getAuthorizationStrategyJwtBearerTokenAuthenticationConfigurationProviderAudience() {
140+
return getProperty(AUTHORIZATION_STRATEGY_JWT_BEARER_TOKEN_AUTHENTICATION_CONFIGURATION_PROVIDER_AUDIENCE);
141+
}
142+
143+
public void setAuthorizationStrategyJwtBearerTokenAuthenticationConfigurationProviderAudience(String authorizationStrategyJwtBearerTokenAuthenticationConfigurationProviderAudience) {
144+
setProperty(AUTHORIZATION_STRATEGY_JWT_BEARER_TOKEN_AUTHENTICATION_CONFIGURATION_PROVIDER_AUDIENCE, authorizationStrategyJwtBearerTokenAuthenticationConfigurationProviderAudience);
145+
}
146+
138147
public String getAuthorizationStrategySimpleRbacRulesFilePath() {
139148
return getProperty(AUTHORIZATION_STRATEGY_SIMPLERBAC_RULES_FILE_PATH);
140149
}

‎basyx.components/basyx.components.lib/src/main/java/org/eclipse/basyx/components/security/authorization/internal/KeycloakJwtBearerTokenAuthenticationConfigurationProvider.java‎

Lines changed: 19 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -24,6 +24,7 @@
2424
******************************************************************************/
2525
package org.eclipse.basyx.components.security.authorization.internal;
2626

27+
import org.apache.commons.lang3.StringUtils;
2728
import org.eclipse.basyx.components.configuration.BaSyxSecurityConfiguration;
2829
import org.eclipse.basyx.extensions.shared.authorization.internal.KeycloakService;
2930
import org.eclipse.basyx.vab.protocol.http.server.JwtBearerTokenAuthenticationConfiguration;
@@ -46,6 +47,23 @@ public JwtBearerTokenAuthenticationConfiguration get(BaSyxSecurityConfiguration
4647

4748
final KeycloakService keycloakService = new KeycloakService(serverUrl, realm);
4849

49-
return keycloakService.createJwtBearerTokenAuthenticationConfiguration();
50+
final String audience = getAudience(securityConfig);
51+
52+
final JwtBearerTokenAuthenticationConfiguration keycloakServiceJwtBearerTokenAuthenticationConfiguration = keycloakService.createJwtBearerTokenAuthenticationConfiguration();
53+
54+
final String issuerUri = keycloakServiceJwtBearerTokenAuthenticationConfiguration.getIssuerUri();
55+
final String jwkSetUri = keycloakServiceJwtBearerTokenAuthenticationConfiguration.getJwkSetUri();
56+
57+
return JwtBearerTokenAuthenticationConfiguration.of(issuerUri, jwkSetUri, audience);
58+
}
59+
60+
private String getAudience(final BaSyxSecurityConfiguration securityConfig) {
61+
final String audience = securityConfig.getAuthorizationStrategyJwtBearerTokenAuthenticationConfigurationProviderAudience();
62+
63+
if (audience == null || StringUtils.isBlank(audience)) {
64+
return null;
65+
}
66+
67+
return audience;
5068
}
5169
}

0 commit comments

Comments
 (0)