Skip to content

Commit d151b67

Browse files
vinokurigvinokurig
committed
Revert "Get rid of the redundant multiuser module (#691)"
This reverts commit 147df19.
1 parent bacb734 commit d151b67

File tree

362 files changed

+30716
-66
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

362 files changed

+30716
-66
lines changed

‎assembly/assembly-wsmaster-war/pom.xml‎

Lines changed: 84 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -35,6 +35,10 @@
3535
<groupId>ch.qos.logback</groupId>
3636
<artifactId>logback-classic</artifactId>
3737
</dependency>
38+
<dependency>
39+
<groupId>com.auth0</groupId>
40+
<artifactId>jwks-rsa</artifactId>
41+
</dependency>
3842
<dependency>
3943
<groupId>com.google.guava</groupId>
4044
<artifactId>guava</artifactId>
@@ -63,6 +67,10 @@
6367
<groupId>io.jaegertracing</groupId>
6468
<artifactId>jaeger-tracerresolver</artifactId>
6569
</dependency>
70+
<dependency>
71+
<groupId>io.jsonwebtoken</groupId>
72+
<artifactId>jjwt-api</artifactId>
73+
</dependency>
6674
<dependency>
6775
<groupId>io.jsonwebtoken</groupId>
6876
<artifactId>jjwt-impl</artifactId>
@@ -227,6 +235,82 @@
227235
<groupId>org.eclipse.che.infrastructure</groupId>
228236
<artifactId>infrastructure-openshift</artifactId>
229237
</dependency>
238+
<dependency>
239+
<groupId>org.eclipse.che.infrastructure</groupId>
240+
<artifactId>infrastructure-permission</artifactId>
241+
</dependency>
242+
<dependency>
243+
<groupId>org.eclipse.che.multiuser</groupId>
244+
<artifactId>che-multiuser-api-authentication-commons</artifactId>
245+
</dependency>
246+
<dependency>
247+
<groupId>org.eclipse.che.multiuser</groupId>
248+
<artifactId>che-multiuser-api-authorization</artifactId>
249+
</dependency>
250+
<dependency>
251+
<groupId>org.eclipse.che.multiuser</groupId>
252+
<artifactId>che-multiuser-api-authorization-impl</artifactId>
253+
</dependency>
254+
<dependency>
255+
<groupId>org.eclipse.che.multiuser</groupId>
256+
<artifactId>che-multiuser-api-permission</artifactId>
257+
</dependency>
258+
<dependency>
259+
<groupId>org.eclipse.che.multiuser</groupId>
260+
<artifactId>che-multiuser-api-workspace-activity</artifactId>
261+
</dependency>
262+
<dependency>
263+
<groupId>org.eclipse.che.multiuser</groupId>
264+
<artifactId>che-multiuser-keycloak-server</artifactId>
265+
</dependency>
266+
<dependency>
267+
<groupId>org.eclipse.che.multiuser</groupId>
268+
<artifactId>che-multiuser-keycloak-token-provider</artifactId>
269+
</dependency>
270+
<dependency>
271+
<groupId>org.eclipse.che.multiuser</groupId>
272+
<artifactId>che-multiuser-machine-authentication</artifactId>
273+
</dependency>
274+
<dependency>
275+
<groupId>org.eclipse.che.multiuser</groupId>
276+
<artifactId>che-multiuser-oidc</artifactId>
277+
</dependency>
278+
<dependency>
279+
<groupId>org.eclipse.che.multiuser</groupId>
280+
<artifactId>che-multiuser-permission-devfile</artifactId>
281+
</dependency>
282+
<dependency>
283+
<groupId>org.eclipse.che.multiuser</groupId>
284+
<artifactId>che-multiuser-permission-logger</artifactId>
285+
</dependency>
286+
<dependency>
287+
<groupId>org.eclipse.che.multiuser</groupId>
288+
<artifactId>che-multiuser-permission-resource</artifactId>
289+
</dependency>
290+
<dependency>
291+
<groupId>org.eclipse.che.multiuser</groupId>
292+
<artifactId>che-multiuser-permission-system</artifactId>
293+
</dependency>
294+
<dependency>
295+
<groupId>org.eclipse.che.multiuser</groupId>
296+
<artifactId>che-multiuser-permission-user</artifactId>
297+
</dependency>
298+
<dependency>
299+
<groupId>org.eclipse.che.multiuser</groupId>
300+
<artifactId>che-multiuser-permission-workspace</artifactId>
301+
</dependency>
302+
<dependency>
303+
<groupId>org.eclipse.che.multiuser</groupId>
304+
<artifactId>che-multiuser-permission-workspace-activity</artifactId>
305+
</dependency>
306+
<dependency>
307+
<groupId>org.eclipse.che.multiuser</groupId>
308+
<artifactId>che-multiuser-personal-account</artifactId>
309+
</dependency>
310+
<dependency>
311+
<groupId>org.eclipse.che.multiuser</groupId>
312+
<artifactId>che-multiuser-sql-schema</artifactId>
313+
</dependency>
230314
<dependency>
231315
<groupId>org.eclipse.persistence</groupId>
232316
<artifactId>org.eclipse.persistence.core</artifactId>

‎assembly/assembly-wsmaster-war/src/main/java/org/eclipse/che/api/deploy/WsMasterModule.java‎

Lines changed: 73 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -13,13 +13,17 @@
1313

1414
import static com.google.inject.matcher.Matchers.subclassesOf;
1515
import static org.eclipse.che.inject.Matchers.names;
16+
import static org.eclipse.che.multiuser.api.permission.server.SystemDomain.SYSTEM_DOMAIN_ACTIONS;
1617

18+
import com.auth0.jwk.JwkProvider;
1719
import com.google.inject.AbstractModule;
1820
import com.google.inject.TypeLiteral;
1921
import com.google.inject.assistedinject.FactoryModuleBuilder;
2022
import com.google.inject.multibindings.MapBinder;
2123
import com.google.inject.multibindings.Multibinder;
2224
import com.google.inject.name.Names;
25+
import io.jsonwebtoken.JwtParser;
26+
import io.jsonwebtoken.SigningKeyResolver;
2327
import java.util.HashMap;
2428
import java.util.Map;
2529
import org.eclipse.che.api.core.notification.RemoteSubscriptionStorage;
@@ -63,7 +67,6 @@
6367
import org.eclipse.che.api.workspace.server.WorkspaceStatusCache;
6468
import org.eclipse.che.api.workspace.server.devfile.DevfileModule;
6569
import org.eclipse.che.api.workspace.server.hc.ServersCheckerFactory;
66-
import org.eclipse.che.api.workspace.server.jpa.WorkspaceJpaModule;
6770
import org.eclipse.che.api.workspace.server.spi.provision.InternalEnvironmentProvisioner;
6871
import org.eclipse.che.api.workspace.server.spi.provision.MachineNameProvisioner;
6972
import org.eclipse.che.api.workspace.server.spi.provision.env.AgentAuthEnableEnvVarProvider;
@@ -79,11 +82,22 @@
7982
import org.eclipse.che.api.workspace.server.spi.provision.env.WorkspaceIdEnvVarProvider;
8083
import org.eclipse.che.api.workspace.server.spi.provision.env.WorkspaceNameEnvVarProvider;
8184
import org.eclipse.che.api.workspace.server.spi.provision.env.WorkspaceNamespaceNameEnvVarProvider;
82-
import org.eclipse.che.api.workspace.server.token.MachineTokenProvider;
8385
import org.eclipse.che.api.workspace.server.wsplugins.ChePluginsApplier;
8486
import org.eclipse.che.commons.observability.deploy.ExecutorWrapperModule;
8587
import org.eclipse.che.core.tracing.metrics.TracingMetricsModule;
8688
import org.eclipse.che.inject.DynaModule;
89+
import org.eclipse.che.multiuser.api.authentication.commons.token.HeaderRequestTokenExtractor;
90+
import org.eclipse.che.multiuser.api.authentication.commons.token.RequestTokenExtractor;
91+
import org.eclipse.che.multiuser.api.permission.server.PermissionChecker;
92+
import org.eclipse.che.multiuser.api.permission.server.PermissionCheckerImpl;
93+
import org.eclipse.che.multiuser.api.workspace.activity.MultiUserWorkspaceActivityModule;
94+
import org.eclipse.che.multiuser.machine.authentication.server.MachineAuthModule;
95+
import org.eclipse.che.multiuser.oidc.OIDCInfo;
96+
import org.eclipse.che.multiuser.oidc.OIDCInfoProvider;
97+
import org.eclipse.che.multiuser.oidc.OIDCJwkProvider;
98+
import org.eclipse.che.multiuser.oidc.OIDCJwtParserProvider;
99+
import org.eclipse.che.multiuser.oidc.OIDCSigningKeyResolver;
100+
import org.eclipse.che.multiuser.permission.user.UserServicePermissionsFilter;
87101
import org.eclipse.che.security.PBKDF2PasswordEncryptor;
88102
import org.eclipse.che.security.PasswordEncryptor;
89103
import org.eclipse.che.security.oauth.EmbeddedOAuthAPI;
@@ -94,7 +108,6 @@
94108
import org.eclipse.che.workspace.infrastructure.kubernetes.KubernetesInfrastructure;
95109
import org.eclipse.che.workspace.infrastructure.kubernetes.environment.KubernetesEnvironment;
96110
import org.eclipse.che.workspace.infrastructure.kubernetes.multiuser.oauth.KubernetesOidcProviderConfigFactory;
97-
import org.eclipse.che.workspace.infrastructure.kubernetes.multiuser.oauth.RequestTokenExtractor;
98111
import org.eclipse.che.workspace.infrastructure.kubernetes.server.secure.SecureServerExposer;
99112
import org.eclipse.che.workspace.infrastructure.kubernetes.server.secure.SecureServerExposerFactory;
100113
import org.eclipse.che.workspace.infrastructure.kubernetes.server.secure.jwtproxy.PassThroughProxySecureServerExposer;
@@ -107,7 +120,7 @@
107120
import org.eclipse.che.workspace.infrastructure.openshift.OpenShiftInfraModule;
108121
import org.eclipse.che.workspace.infrastructure.openshift.OpenShiftInfrastructure;
109122
import org.eclipse.che.workspace.infrastructure.openshift.environment.OpenShiftEnvironment;
110-
import org.eclipse.che.workspace.infrastructure.openshift.multiuser.oauth.HeaderRequestTokenExtractor;
123+
import org.eclipse.che.workspace.infrastructure.openshift.multiuser.oauth.KeycloakProviderConfigFactory;
111124
import org.eclipse.persistence.config.PersistenceUnitProperties;
112125

113126
/** @author andrew00x */
@@ -311,6 +324,9 @@ private void configureMultiUserMode(
311324
if (OpenShiftInfrastructure.NAME.equals(infrastructure)
312325
|| KubernetesInfrastructure.NAME.equals(infrastructure)) {
313326
install(new ReplicationModule(persistenceProperties));
327+
bind(
328+
org.eclipse.che.multiuser.permission.workspace.infra.kubernetes
329+
.BrokerServicePermissionFilter.class);
314330
configureJwtProxySecureProvisioner(infrastructure);
315331
} else {
316332
bind(RemoteSubscriptionStorage.class)
@@ -321,24 +337,70 @@ private void configureMultiUserMode(
321337
.to(org.eclipse.che.api.workspace.server.DefaultWorkspaceStatusCache.class);
322338
}
323339

324-
bind(KubernetesClientConfigFactory.class).to(KubernetesOidcProviderConfigFactory.class);
340+
if (Boolean.parseBoolean(System.getenv("CHE_AUTH_NATIVEUSER"))) {
341+
bind(KubernetesClientConfigFactory.class).to(KubernetesOidcProviderConfigFactory.class);
342+
} else if (OpenShiftInfrastructure.NAME.equals(infrastructure)) {
343+
bind(KubernetesClientConfigFactory.class).to(KeycloakProviderConfigFactory.class);
344+
}
325345

326346
persistenceProperties.put(
327347
PersistenceUnitProperties.EXCEPTION_HANDLER_CLASS,
328348
"org.eclipse.che.core.db.postgresql.jpa.eclipselink.PostgreSqlExceptionHandler");
329349

330-
bind(RequestTokenExtractor.class).to(HeaderRequestTokenExtractor.class);
331-
bind(ProfileDao.class).to(JpaProfileDao.class);
332-
bind(OAuthAPI.class).to(EmbeddedOAuthAPI.class).asEagerSingleton();
350+
install(
351+
new org.eclipse.che.multiuser.permission.workspace.server.WorkspaceApiPermissionsModule());
352+
install(
353+
new org.eclipse.che.multiuser.permission.workspace.server.jpa
354+
.MultiuserWorkspaceJpaModule());
355+
install(new MultiUserWorkspaceActivityModule());
356+
install(
357+
new org.eclipse.che.multiuser.permission.devfile.server.jpa
358+
.MultiuserUserDevfileJpaModule());
359+
install(
360+
new org.eclipse.che.multiuser.permission.devfile.server.UserDevfileApiPermissionsModule());
361+
362+
// Permission filters
363+
bind(org.eclipse.che.multiuser.permission.system.SystemServicePermissionsFilter.class);
364+
bind(org.eclipse.che.multiuser.permission.system.JvmServicePermissionsFilter.class);
365+
bind(
366+
org.eclipse.che.multiuser.permission.system.SystemEventsSubscriptionPermissionsCheck.class);
367+
368+
Multibinder<String> binder =
369+
Multibinder.newSetBinder(binder(), String.class, Names.named(SYSTEM_DOMAIN_ACTIONS));
370+
binder.addBinding().toInstance(UserServicePermissionsFilter.MANAGE_USERS_ACTION);
371+
bind(org.eclipse.che.multiuser.permission.user.UserProfileServicePermissionsFilter.class);
372+
bind(org.eclipse.che.multiuser.permission.user.UserServicePermissionsFilter.class);
373+
bind(org.eclipse.che.multiuser.permission.logger.LoggerServicePermissionsFilter.class);
374+
375+
bind(org.eclipse.che.multiuser.permission.workspace.activity.ActivityPermissionsFilter.class);
376+
377+
bind(
378+
org.eclipse.che.multiuser.permission.resource.filters.ResourceServicePermissionsFilter
379+
.class);
380+
bind(
381+
org.eclipse.che.multiuser.permission.resource.filters
382+
.FreeResourcesLimitServicePermissionsFilter.class);
383+
384+
if (Boolean.parseBoolean(System.getenv("CHE_AUTH_NATIVEUSER"))) {
385+
bind(RequestTokenExtractor.class).to(HeaderRequestTokenExtractor.class);
386+
if (KubernetesInfrastructure.NAME.equals(infrastructure)) {
387+
bind(OIDCInfo.class).toProvider(OIDCInfoProvider.class).asEagerSingleton();
388+
bind(SigningKeyResolver.class).to(OIDCSigningKeyResolver.class);
389+
bind(JwtParser.class).toProvider(OIDCJwtParserProvider.class);
390+
bind(JwkProvider.class).toProvider(OIDCJwkProvider.class);
391+
}
392+
bind(TokenValidator.class).to(NotImplementedTokenValidator.class);
393+
bind(ProfileDao.class).to(JpaProfileDao.class);
394+
bind(OAuthAPI.class).to(EmbeddedOAuthAPI.class).asEagerSingleton();
395+
}
333396

334-
install(new WorkspaceJpaModule());
335-
bind(TokenValidator.class).to(NotImplementedTokenValidator.class);
336-
bind(MachineTokenProvider.class).to(MachineTokenProvider.EmptyMachineTokenProvider.class);
397+
install(new MachineAuthModule());
337398

338399
// User and profile - use profile from keycloak and other stuff is JPA
339400
bind(PasswordEncryptor.class).to(PBKDF2PasswordEncryptor.class);
340401
bind(UserDao.class).to(JpaUserDao.class);
341402
bind(PreferenceDao.class).to(JpaPreferenceDao.class);
403+
bind(PermissionChecker.class).to(PermissionCheckerImpl.class);
342404

343405
bindConstant().annotatedWith(Names.named("che.agents.auth_enabled")).to(true);
344406
}

‎assembly/assembly-wsmaster-war/src/main/java/org/eclipse/che/api/deploy/WsMasterServletModule.java‎

Lines changed: 16 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -17,8 +17,10 @@
1717
import org.eclipse.che.commons.logback.filter.RequestIdLoggerFilter;
1818
import org.eclipse.che.inject.ConfigurationException;
1919
import org.eclipse.che.inject.DynaModule;
20+
import org.eclipse.che.multiuser.keycloak.server.deploy.KeycloakServletModule;
21+
import org.eclipse.che.multiuser.machine.authentication.server.MachineLoginFilter;
22+
import org.eclipse.che.multiuser.oidc.filter.OidcTokenInitializationFilter;
2023
import org.eclipse.che.workspace.infrastructure.kubernetes.KubernetesInfrastructure;
21-
import org.eclipse.che.workspace.infrastructure.kubernetes.multiuser.oauth.OidcTokenInitializationFilter;
2224
import org.eclipse.che.workspace.infrastructure.openshift.OpenShiftInfrastructure;
2325
import org.eclipse.che.workspace.infrastructure.openshift.multiuser.oauth.OpenshiftTokenInitializationFilter;
2426
import org.everrest.guice.servlet.GuiceEverrestServlet;
@@ -45,7 +47,14 @@ protected void configureServlets() {
4547
// Matching group SHOULD contain forward slash.
4648
serveRegex("^(?!/websocket.?)(.*)")
4749
.with(GuiceEverrestServlet.class, ImmutableMap.of("openapi.context.id", "org.eclipse.che"));
48-
configureNativeUserMode();
50+
51+
if (Boolean.parseBoolean(System.getenv("CHE_AUTH_NATIVEUSER"))) {
52+
LOG.info("Running in native-user mode ...");
53+
configureNativeUserMode();
54+
} else {
55+
LOG.info("Running in classic multi-user mode ...");
56+
configureMultiUserMode();
57+
}
4958

5059
if (Boolean.valueOf(System.getenv("CHE_METRICS_ENABLED"))) {
5160
install(new org.eclipse.che.core.metrics.MetricsServletModule());
@@ -62,6 +71,11 @@ private boolean isCheCorsEnabled() {
6271
}
6372
}
6473

74+
private void configureMultiUserMode() {
75+
filterRegex(".*").through(MachineLoginFilter.class);
76+
install(new KeycloakServletModule());
77+
}
78+
6579
private void configureNativeUserMode() {
6680
final String infrastructure = System.getenv("CHE_INFRASTRUCTURE_ACTIVE");
6781
if (OpenShiftInfrastructure.NAME.equals(infrastructure)) {

‎assembly/assembly-wsmaster-war/src/main/webapp/WEB-INF/web.xml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -36,4 +36,8 @@
3636
<resource-env-ref-type>javax.sql.DataSource</resource-env-ref-type>
3737
</resource-env-ref>
3838

39+
<listener>
40+
<listener-class>org.eclipse.che.multiuser.api.authentication.commons.DestroySessionListener</listener-class>
41+
</listener>
42+
3943
</web-app>

‎infrastructures/infrastructure-permission/pom.xml‎

Lines changed: 75 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,75 @@
1+
<?xml version="1.0" encoding="UTF-8"?>
2+
<!--
3+
4+
Copyright (c) 2012-2025 Red Hat, Inc.
5+
This program and the accompanying materials are made
6+
available under the terms of the Eclipse Public License 2.0
7+
which is available at https://www.eclipse.org/legal/epl-2.0/
8+
9+
SPDX-License-Identifier: EPL-2.0
10+
11+
Contributors:
12+
Red Hat, Inc. - initial API and implementation
13+
14+
-->
15+
<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
16+
<modelVersion>4.0.0</modelVersion>
17+
<parent>
18+
<artifactId>che-infrastructures-parent</artifactId>
19+
<groupId>org.eclipse.che.infrastructure</groupId>
20+
<version>7.103.0-SNAPSHOT</version>
21+
</parent>
22+
<artifactId>infrastructure-permission</artifactId>
23+
<name>Infrastructure :: Kubernetes Permissions</name>
24+
<dependencies>
25+
<dependency>
26+
<groupId>jakarta.inject</groupId>
27+
<artifactId>jakarta.inject-api</artifactId>
28+
</dependency>
29+
<dependency>
30+
<groupId>org.eclipse.che.core</groupId>
31+
<artifactId>che-core-api-core</artifactId>
32+
</dependency>
33+
<dependency>
34+
<groupId>org.eclipse.che.core</groupId>
35+
<artifactId>che-core-api-workspace-shared</artifactId>
36+
</dependency>
37+
<dependency>
38+
<groupId>org.eclipse.che.infrastructure</groupId>
39+
<artifactId>infrastructure-kubernetes</artifactId>
40+
</dependency>
41+
<dependency>
42+
<groupId>org.eclipse.che.multiuser</groupId>
43+
<artifactId>che-multiuser-api-permission</artifactId>
44+
</dependency>
45+
<dependency>
46+
<groupId>org.eclipse.che.multiuser</groupId>
47+
<artifactId>che-multiuser-permission-workspace</artifactId>
48+
</dependency>
49+
<dependency>
50+
<groupId>ch.qos.logback</groupId>
51+
<artifactId>logback-classic</artifactId>
52+
<scope>test</scope>
53+
</dependency>
54+
<dependency>
55+
<groupId>org.eclipse.che.core</groupId>
56+
<artifactId>che-core-api-dto</artifactId>
57+
<scope>test</scope>
58+
</dependency>
59+
<dependency>
60+
<groupId>org.mockito</groupId>
61+
<artifactId>mockito-core</artifactId>
62+
<scope>test</scope>
63+
</dependency>
64+
<dependency>
65+
<groupId>org.mockito</groupId>
66+
<artifactId>mockito-testng</artifactId>
67+
<scope>test</scope>
68+
</dependency>
69+
<dependency>
70+
<groupId>org.testng</groupId>
71+
<artifactId>testng</artifactId>
72+
<scope>test</scope>
73+
</dependency>
74+
</dependencies>
75+
</project>

0 commit comments

Comments
 (0)