Skip to content

Commit 1965db2

Browse files
chenkinschenkins
authored
Merge pull request #174 from shift7-ch/refactor-keycloak-sync
 Refactor Keycloak Sync.
2 parents da72184 + 96bfe02 commit 1965db2

File tree

6 files changed

+43
-36
lines changed

6 files changed

+43
-36
lines changed

‎hub/src/main/java/cloud/katta/workflows/CreateVaultService.java‎

Lines changed: 9 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -120,6 +120,7 @@ public void createVault(final UserKeys userKeys, final StorageProfileDtoWrapper
120120
.uvfMetadataFile(uvfMetadataFile)
121121
.uvfKeySet(jwks.serializePublicRecoverykey());
122122

123+
// create storage dto
123124
final String hashedRootDirId = metadataPayload.computeRootDirIdHash();
124125
final CreateS3STSBucketDto storageDto = new CreateS3STSBucketDto()
125126
.vaultId(vaultModel.vaultId().toString())
@@ -130,6 +131,13 @@ public void createVault(final UserKeys userKeys, final StorageProfileDtoWrapper
130131
.region(metadataPayload.storage().getRegion());
131132
log.debug("Created storage dto {}", storageDto);
132133

134+
// (1) create vault in hub, incl. Keycloak sync
135+
final boolean minio = storageProfileWrapper.getStsRoleArn() != null && storageProfileWrapper.getStsRoleArn2() == null;
136+
final boolean aws = storageProfileWrapper.getStsRoleArn() != null && storageProfileWrapper.getStsRoleArn2() != null;
137+
log.debug("Create vault {}, minio={}, aws={}", vaultDto, minio, aws);
138+
vaultResource.apiVaultsVaultIdPut(vaultDto.getId(), vaultDto, minio, aws);
139+
140+
// (2) create bucket
133141
final HostPasswordStore keychain = PasswordStoreFactory.get();
134142

135143
final OAuthTokens tokens = keychain.findOAuthTokens(hubSession.getHost());
@@ -156,11 +164,8 @@ public void createVault(final UserKeys userKeys, final StorageProfileDtoWrapper
156164
.awsSecretKey(stsTokens.getSecretAccessKey())
157165
.sessionToken(stsTokens.getSessionToken()));
158166
}
159-
// create vault in hub
160-
log.debug("Create vault {}", vaultDto);
161-
vaultResource.apiVaultsVaultIdPut(vaultDto.getId(), vaultDto);
162167

163-
// upload JWE
168+
// (3) upload JWE to hub
164169
log.debug("Upload JWE {} for vault {}", uvfMetadataFile, vaultDto);
165170
final UserDto userDto = users.apiUsersMeGet(false, false);
166171
vaultResource.apiVaultsVaultIdAccessTokensPost(vaultDto.getId(), Collections.singletonMap(userDto.getId(), jwks.toOwnerAccessToken().encryptForUser(userKeys.ecdhKeyPair().getPublic())));

‎hub/src/main/resources/openapi.json‎

Lines changed: 25 additions & 28 deletions
Original file line numberDiff line numberDiff line change
@@ -8,44 +8,20 @@
88
"access_token": {
99
"type": "string"
1010
},
11-
"expires_in": {
12-
"type": "integer",
13-
"format": "int64"
14-
},
15-
"refresh_expires_in": {
16-
"type": "integer",
17-
"format": "int64"
18-
},
19-
"refresh_token": {
11+
"issued_token_type": {
2012
"type": "string"
2113
},
2214
"token_type": {
2315
"type": "string"
2416
},
25-
"id_token": {
26-
"type": "string"
27-
},
28-
"not-before-policy": {
17+
"expires_in": {
2918
"type": "integer",
30-
"format": "int32"
31-
},
32-
"session_state": {
33-
"type": "string"
34-
},
35-
"otherClaims": {
36-
"type": "object",
37-
"additionalProperties": {}
19+
"format": "int64"
3820
},
3921
"scope": {
4022
"type": "string"
4123
},
42-
"error": {
43-
"type": "string"
44-
},
45-
"error_description": {
46-
"type": "string"
47-
},
48-
"error_uri": {
24+
"refresh_token": {
4925
"type": "string"
5026
}
5127
}
@@ -1624,6 +1600,9 @@
16241600
}
16251601
}
16261602
},
1603+
"400": {
1604+
"description": "bad request"
1605+
},
16271606
"401": {
16281607
"description": "Not Authorized"
16291608
},
@@ -2500,6 +2479,24 @@
25002479
"summary": "creates or updates a vault",
25012480
"description": "Creates or updates a vault with the given vault id. The creationTime in the vaultDto is always ignored. On creation, the current server time is used and the archived field is ignored. On update, only the name, description, and archived fields are considered.",
25022481
"parameters": [
2482+
{
2483+
"description": "the role to grant to this user (defaults to False)",
2484+
"in": "query",
2485+
"name": "minio",
2486+
"schema": {
2487+
"type": "boolean",
2488+
"default": false
2489+
}
2490+
},
2491+
{
2492+
"description": "the role to grant to this user (defaults to False)",
2493+
"in": "query",
2494+
"name": "aws",
2495+
"schema": {
2496+
"type": "boolean",
2497+
"default": false
2498+
}
2499+
},
25032500
{
25042501
"name": "vaultId",
25052502
"in": "path",

‎hub/src/test/java/cloud/katta/workflows/CreateVaultServiceTest.java‎

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -67,6 +67,9 @@ void createVault() throws AccessException, SecurityFailure, BackgroundException,
6767
.id(storageProfileId)
6868
.protocol(Protocol.S3_STS)
6969
.stsEndpoint("http://audley.end.point")
70+
// AWS has both role arns filled in
71+
.stsRoleArn("arnaud")
72+
.stsRoleArn2("ducret")
7073

7174
);
7275
final StorageProfileDtoWrapper storageProfileWrapper = StorageProfileDtoWrapper.coerce(storageProfile);
@@ -104,7 +107,9 @@ public String getOAuthTokenUrl() {
104107

105108
createVaultService.createVault(userKeys, storageProfileWrapper, createVaultModel);
106109

107-
Mockito.verify(vaults, times(1)).apiVaultsVaultIdPut(eq(vaultId), any());
110+
final boolean expectedMinio = false;
111+
final boolean expectedAWS = true;
112+
Mockito.verify(vaults, times(1)).apiVaultsVaultIdPut(eq(vaultId), any(), eq(expectedMinio), eq(expectedAWS));
108113
Mockito.verify(vaults, times(1)).apiVaultsVaultIdAccessTokensPost(eq(vaultId), any());
109114
Mockito.verify(storage, times(1)).apiStorageVaultIdPut(eq(vaultId), any());
110115
}

‎hub/src/test/resources/.env‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
KATTA_SERVER_IMAGE=ghcr.io/shift7-ch/katta-server:1.5.0-SNAPSHOT-ci@sha256:7ccf1b2050d24ac230b88996e8caab741e3e6a7df0986c2a03de32d7887747bd
1+
KATTA_SERVER_IMAGE=ghcr.io/shift7-ch/katta-server:commit-226795352277656dc9a7ede0f95a620f42253e54-ci
22
HUB_PORT=8080
33
HUB_KEYCLOAK_URL=http://localhost:8180
44
HUB_KEYCLOAK_BASEPATH=

‎hub/src/test/resources/.hybrid.env‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
KATTA_SERVER_IMAGE=ghcr.io/shift7-ch/katta-server:1.5.0-SNAPSHOT-ci@sha256:7ccf1b2050d24ac230b88996e8caab741e3e6a7df0986c2a03de32d7887747bd
1+
KATTA_SERVER_IMAGE=ghcr.io/shift7-ch/katta-server:commit-226795352277656dc9a7ede0f95a620f42253e54-ci
22
HUB_PORT=8280
33
HUB_KEYCLOAK_URL=https://testing.katta.cloud
44
HUB_KEYCLOAK_BASEPATH=/kc

‎hub/src/test/resources/.local.env‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
KATTA_SERVER_IMAGE=ghcr.io/shift7-ch/katta-server:1.5.0-SNAPSHOT-ci@sha256:7ccf1b2050d24ac230b88996e8caab741e3e6a7df0986c2a03de32d7887747bd
1+
KATTA_SERVER_IMAGE=ghcr.io/shift7-ch/katta-server:commit-226795352277656dc9a7ede0f95a620f42253e54-ci
22
HUB_PORT=8280
33
HUB_KEYCLOAK_URL=http://localhost:8380
44
HUB_KEYCLOAK_BASEPATH=

0 commit comments

Comments
 (0)