wip

Signed-off-by: Richard Salac <richard.salac@broadcom.com>

Author: richard-salac

api-catalog-services/src/main/java/org/zowe/apiml/apicatalog/config/SecurityConfiguration.java

@@ -322,7 +322,6 @@ WebFilter tokenAuthenticationFilter(
                         }
                     })
                     .map(pair -> ReactiveSecurityContextHolder.withAuthentication(
-                        //TODO: WTF?! token used as username?
                         createAuthenticated(pair.getValue().getUserId(), pair.getKey(), TokenAuthentication.Type.JWT)
                     ))
                     .orElse(context)

apiml-security-common/src/main/java/org/zowe/apiml/security/common/token/TokenAuthentication.java

@@ -31,20 +31,26 @@
 public class TokenAuthentication extends AbstractAuthenticationToken {
 
     @Serial
-    //TODO: regenerate
     private static final long serialVersionUID = 82346593850419807L;
 
     private static final String DOMAIN_CLAIM_NAME = "dom";
     private static final String SCOPES = "scopes";
 
 
+    @Getter
     private final JWT jwt;
     private final JWTClaimsSet claims;
+    @Getter
     private final QueryResponse queryResponse;
 
     @Getter
     private Type type;
 
+    public enum Type {
+        JWT,
+        OIDC
+    }
+
     public TokenAuthentication(String tokenString) {
         this(tokenString, (Type) null);
     }
@@ -89,10 +95,6 @@ public static TokenAuthentication createAuthenticated(String userId, String toke
         return tokenAuthentication;
     }
 
-    public JWT getJwt() {
-        return jwt;
-    }
-
     public boolean isExpired() {
         return queryResponse.isExpired();
     }
@@ -109,24 +111,6 @@ public String getClaimAsString(String claimName) throws ParseException {
         return claims.getClaimAsString(claimName);
     }
 
-    public QueryResponse getQueryResponse() {
-        return queryResponse;
-    }
-
-//    public TokenAuthenticationEnhanced(String token, Type type) {
-//        this(null, token, type);
-//    }
-//
-//    public TokenAuthenticationEnhanced(String username, String token) {
-//        this(username, token, (Type) null);
-//    }
-//
-//    public TokenAuthenticationEnhanced(String username, String token, Type type) {
-//        super(Collections.emptyList());
-//        this.token = token;
-//        this.type = type;
-//    }
-
     /**
      * @return the token that prove the username is correct
      */
@@ -144,29 +128,12 @@ public String getPrincipal() {
         return queryResponse.getUserId();
     }
 
-//    /**
-//     * Creates the TokenAuthentication with fulfilled username (principal), token and marked as authenticated.
-//     * @param username Username, who is authenticated
-//     * @param token Token, which authenticate the user
-//     * @return TokenAuthentication marked as authenticated with username, token
-//     */
-//    public static TokenAuthenticationEnhanced createAuthenticated(String username, String token, Type type) {
-//        final TokenAuthenticationEnhanced out = new TokenAuthenticationEnhanced(username, token, type);
-//        out.setAuthenticated(true);
-//        return out;
-//    }
-
     @SuppressWarnings("squid:S3655")
     public static TokenAuthentication createAuthenticatedFromHeader(String token, String authHeader) {
         var loginRequest = LoginFilter.getCredentialFromAuthorizationHeader(Optional.of(authHeader));
         return createAuthenticated(loginRequest.get().getUsername(), token, Type.JWT);
     }
 
-    public enum Type {
-        JWT,
-        OIDC
-    }
-
     private QueryResponse parseQueryResponse(JWTClaimsSet claims) {
         Object scopesObject = claims.getClaim(SCOPES);
         List<String> scopes = Collections.emptyList();

apiml-security-common/src/main/java/org/zowe/apiml/security/common/token/TokenAuthentication_BCK.java

@@ -45,21 +45,6 @@ public class JwtUtils {
      * @throws TokenNotValidException in case of invalid input, or TokenExpireException if JWT is expired
      */
     public JWTClaimsSet getJwtClaims(String jwt) {
-        return getJwtClaimsInternal(jwt, true);
-    }
-
-    /**
-     * This method reads the claims without validating the token signature. It should be used only if the validity was checked in the calling code. Ignores token expiration.
-     *
-     * @param jwt token to be parsed
-     * @return parsed claims
-     * @throws TokenNotValidException in case of invalid input
-     */
-    public JWTClaimsSet getJwtClaimsIgnoreExpiration(String jwt) {
-        return getJwtClaimsInternal(jwt, false);
-    }
-
-    private JWTClaimsSet getJwtClaimsInternal(String jwt, boolean validateExpiration) {
         /*
          * Removes signature, because we don't have key to verify z/OS tokens, and we just need to read claim.
          * Verification is done by SAF itself. JWT library doesn't parse signed key without verification.
@@ -69,10 +54,9 @@ private JWTClaimsSet getJwtClaimsInternal(String jwt, boolean validateExpiration
             var token = JWTParser.parse(jwtWithoutSignature);
             var claims = token.getJWTClaimsSet();
 
-            if (validateExpiration && claims.getExpirationTime().toInstant().isBefore(Instant.now())) {
+            if (claims.getExpirationTime().toInstant().isBefore(Instant.now())) {
                 throw new ExpiredJWTException("JWT token is expired");
             }
-
             return token.getJWTClaimsSet();
         } catch (RuntimeException | ParseException | BadJWTException exception) {
             throw handleJwtParserException(exception);

apiml-security-common/src/main/java/org/zowe/apiml/security/common/util/JwtUtils.java

@@ -87,7 +87,6 @@ dependencies {
     testImplementation libs.rest.assured.web.test.client
     testImplementation libs.opentelemetry.sdk.testing
     testImplementation libs.opentelemetry.sdk.extension.autoconfigure.spi
-    testImplementation libs.bundles.infinispan
 
     compileOnly libs.lombok
     annotationProcessor libs.lombok

apiml/build.gradle

@@ -29,6 +29,7 @@
 import org.zowe.apiml.security.common.config.AuthConfigurationProperties;
 import org.zowe.apiml.security.common.token.OIDCProvider;
 import org.zowe.apiml.security.common.token.TokenAuthentication;
+import org.zowe.apiml.security.common.util.JWTTestUtils;
 import org.zowe.apiml.zaas.security.mapping.AuthenticationMapper;
 import org.zowe.apiml.zaas.security.service.schema.source.OIDCAuthSource;
 import reactor.core.publisher.Mono;
@@ -46,8 +47,8 @@
 @ExtendWith(MockitoExtension.class)
 class OIDCAuthFilterTest {
 
-    private static final String OIDC_TOKEN = "eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCIsImtpZCI6InRlc3Qta2V5In0.eyJzdWIiOiJ0ZXN0dXNlckBleGFtcGxlLmNvbSIsImlhdCI6MTcxMTUyMDAwMCwiZXhwIjo5OTk5OTk5OTk5fQ.fake-signature";
     private static final String MAINFRAME_USER = "TESTUSER";
+    public static final String OIDC_TOKEN = JWTTestUtils.createDummyJwtToken(MAINFRAME_USER, "https://oidc.provider");
     private static final List<String> USER_ID_FIELD_PATH = List.of("sub");
 
     @Mock private OIDCProvider oidcProvider;
@@ -184,7 +185,7 @@ void thenSkipOidcValidation() {
             var exchange = MockServerWebExchange.from(request);
             when(chain.filter(exchange)).thenReturn(Mono.empty());
 
-            Authentication existingAuth = TokenAuthentication.createAuthenticated("EXISTING_USER", "some-jwt", TokenAuthentication.Type.JWT);
+            Authentication existingAuth = TokenAuthentication.createAuthenticated("EXISTING_USER", JWTTestUtils.createDummyAPIMLToken("EXISTING_USER"), TokenAuthentication.Type.JWT);
             var securityContext = new SecurityContextImpl(existingAuth);
 
             var result = filter.filter(exchange, chain)

apiml/src/test/java/org/zowe/apiml/acceptance/CachesConfigurationTest.java

@@ -212,8 +212,6 @@ synchronized LazyCacheManager cacheManager(ResourceLoader resourceLoader, Applic
         if (applicationInfo.isModulith()) {
             caches = new HashMap<>();
 
-            //Security distributed caches
-            //TODO resolve size and lifespan
             caches.put(CACHE_ZOWE, getDistributedCacheConfig());
             caches.put(CACHE_ZOWE_INVALIDATED_TOKEN, getDistributedCacheConfig());
             caches.put("invalidatedJwtTokens", getDistributedCacheConfig());
@@ -232,9 +230,8 @@ synchronized LazyCacheManager cacheManager(ResourceLoader resourceLoader, Applic
 
         } else {
             caches = new HashMap<>();
-            //TODO resolve size and lifespan
-            var defaultCacheconfig = getDistributedCacheConfig();
-            Arrays.asList(CACHE_ZOWE, CACHE_ZOWE_INVALIDATED_TOKEN).forEach( c -> caches.put(c,defaultCacheconfig));
+            var defaultCacheConfig = getDistributedCacheConfig();
+            Arrays.asList(CACHE_ZOWE, CACHE_ZOWE_INVALIDATED_TOKEN).forEach( c -> caches.put(c,defaultCacheConfig));
         }
 
         return new LazyCacheManager(getCacheManagerConfig(resourceLoader), caches);

apiml/src/test/java/org/zowe/apiml/filter/OIDCAuthFilterTest.java

@@ -326,7 +326,6 @@ private boolean createCache(String cacheName) {
                 try {
                     underInit.defineConfiguration(cacheName, cacheConfig);
                 } catch (Exception e) {
-                    //Todo improve message
                     log.warn("Configuration for cache {} already exists", cacheName, e);
                 }
             } catch (Exception e) {

caching-service/src/main/java/org/zowe/apiml/caching/service/infinispan/config/InfinispanConfig.java

@@ -65,12 +65,12 @@
 
         <serialization marshaller="org.infinispan.jboss.marshalling.commons.GenericJBossMarshaller">
             <allow-list>
-                <class>org.zowe.apiml.caching.model.KeyValue</class>
-                <class>org.zowe.apiml.security.common.token.TokenAuthentication_BCK</class>
-                <class>org.zowe.apiml.security.common.token.TokenAuthentication_BCK$Type</class>
-                <class>java.util.HashMap</class>
-                <class>java.util.Arrays$ArrayList</class>
-                <class>java.security.cert.Certificate$CertificateRep</class>
+                <regex>org.zowe.apiml.caching.*</regex>
+                <regex>org.zowe.apiml.security.common.token.*</regex>
+                <regex>com.nimbusds.jwt.*</regex>
+                <regex>com.nimbusds.jose.*</regex>
+                <regex>java.util.*</regex>
+                <regex>java.security.cert.*</regex>
             </allow-list>
         </serialization>