Improved websocket session handling

Author: hhund

dsf-bpe/dsf-bpe-server/src/main/java/dev/dsf/bpe/authentication/IdentityProviderImpl.java

@@ -80,14 +80,14 @@ public Identity getIdentity(X509Certificate[] certificates)
 			Organization o = localOrganization.get();
 			Endpoint e = localEndpoint.get();
 
-			return new PractitionerIdentityImpl(o, e, getDsfRolesFor(p, certWrapper.thumbprint(), null, null),
-					certWrapper, p, getPractitionerRolesFor(p, certWrapper.thumbprint(), null, null), null);
+			return new PractitionerIdentityImpl(o, e, getDsfRolesFor(p, certWrapper.getThumbprint(), null, null),
+					certWrapper, p, getPractitionerRolesFor(p, certWrapper.getThumbprint(), null, null), null);
 		}
 		else
 		{
 			logger.warn(
 					"Certificate with thumbprint '{}' for '{}' unknown, not configured as local user or local organization unknown",
-					certWrapper.thumbprint(), certWrapper.subjectDn());
+					certWrapper.getThumbprint(), certWrapper.getSubjectDn());
 			return null;
 		}
 	}

dsf-common/dsf-common-auth/src/main/java/dev/dsf/common/auth/DsfOpenIdCredentials.java

@@ -42,4 +42,9 @@ public interface DsfOpenIdCredentials
 	 * @return <b>defaultValue</b> if no {@link String} entry with the given <b>key</b> in id-token
 	 */
 	String getStringClaimOrDefault(String key, String defaultValue);
+
+	/**
+	 * @return <code>true</code> if token not expired
+	 */
+	boolean isNotExpired();
 }

dsf-common/dsf-common-auth/src/main/java/dev/dsf/common/auth/conf/AbstractIdentity.java

@@ -85,6 +85,12 @@ public boolean equals(Object obj)
 		return Objects.equals(organizationIdentifierValue, ((AbstractIdentity) obj).organizationIdentifierValue);
 	}
 
+	@Override
+	public boolean isNotExpired()
+	{
+		return certificate != null && certificate.isNotExpired();
+	}
+
 	@Override
 	public boolean isLocalIdentity()
 	{

dsf-common/dsf-common-auth/src/main/java/dev/dsf/common/auth/conf/AbstractIdentityProvider.java

@@ -17,8 +17,6 @@
 
 import java.net.URI;
 import java.net.URISyntaxException;
-import java.security.cert.CertificateEncodingException;
-import java.security.cert.X509Certificate;
 import java.util.Arrays;
 import java.util.List;
 import java.util.Map;
@@ -260,26 +258,10 @@ protected final Optional<Practitioner> toPractitioner(X509CertificateWrapper cer
 		if (certWrapper == null)
 			return Optional.empty();
 
-		if (!thumbprints.contains(certWrapper.thumbprint()))
+		if (!thumbprints.contains(certWrapper.getThumbprint()))
 			return Optional.empty();
 
-		return toJcaX509CertificateHolder(certWrapper.certificate())
-				.flatMap(ch -> toPractitioner(ch, certWrapper.thumbprint()));
-	}
-
-	private Optional<JcaX509CertificateHolder> toJcaX509CertificateHolder(X509Certificate certificate)
-	{
-		try
-		{
-			return Optional.of(new JcaX509CertificateHolder(certificate));
-		}
-		catch (CertificateEncodingException e)
-		{
-			logger.debug("Unable to decode certificate", e);
-			logger.warn("Unable to decode certificate: {} - {}", e.getClass().getName(), e.getMessage());
-
-			return Optional.empty();
-		}
+		return toPractitioner(certWrapper.toJcaX509CertificateHolder(), certWrapper.getThumbprint());
 	}
 
 	private Optional<Practitioner> toPractitioner(JcaX509CertificateHolder certificate, String thumbprint)

dsf-common/dsf-common-auth/src/main/java/dev/dsf/common/auth/conf/Identity.java

@@ -27,6 +27,11 @@ public interface Identity extends Principal
 	String ORGANIZATION_IDENTIFIER_SYSTEM = "http://dsf.dev/sid/organization-identifier";
 	String ENDPOINT_IDENTIFIER_SYSTEM = "http://dsf.dev/sid/endpoint-identifier";
 
+	/**
+	 * @return <code>true</code> if credentials are not expired
+	 */
+	boolean isNotExpired();
+
 	boolean isLocalIdentity();
 
 	/**
@@ -38,6 +43,10 @@ public interface Identity extends Principal
 
 	Set<DsfRole> getDsfRoles();
 
+	/**
+	 * @param role
+	 * @return <code>true</code> if Identity has the given role
+	 */
 	boolean hasDsfRole(DsfRole role);
 
 	/**

dsf-common/dsf-common-auth/src/main/java/dev/dsf/common/auth/conf/PractitionerIdentityImpl.java

@@ -100,6 +100,15 @@ public boolean equals(Object obj)
 				&& Objects.equals(practitionerIdentifierValue, other.practitionerIdentifierValue);
 	}
 
+	@Override
+	public boolean isNotExpired()
+	{
+		if (credentials != null)
+			return credentials.isNotExpired();
+		else
+			return super.isNotExpired();
+	}
+
 	@Override
 	public String getName()
 	{

dsf-common/dsf-common-auth/src/main/java/dev/dsf/common/auth/conf/X509CertificateWrapper.java

@@ -19,19 +19,31 @@
 import java.security.NoSuchAlgorithmException;
 import java.security.cert.CertificateEncodingException;
 import java.security.cert.X509Certificate;
+import java.time.Instant;
 
 import javax.security.auth.x500.X500Principal;
 
 import org.apache.commons.codec.binary.Hex;
+import org.bouncycastle.cert.jcajce.JcaX509CertificateHolder;
 
-public record X509CertificateWrapper(X509Certificate certificate, String thumbprint, String subjectDn)
+public class X509CertificateWrapper
 {
+	private final X509Certificate certificate;
+	private final String thumbprint;
+	private final String subjectDn;
+
+	private final Instant expiration;
+
 	public X509CertificateWrapper(X509Certificate certificate)
 	{
-		this(certificate, getThumbprint(certificate), getSubjectDn(certificate));
+		this.certificate = certificate;
+		this.thumbprint = toThumbprint(certificate);
+		this.subjectDn = toSubjectDn(certificate);
+
+		this.expiration = certificate == null ? null : certificate.getNotAfter().toInstant();
 	}
 
-	private static String getThumbprint(X509Certificate certificate)
+	private static String toThumbprint(X509Certificate certificate)
 	{
 		try
 		{
@@ -44,8 +56,40 @@ private static String getThumbprint(X509Certificate certificate)
 		}
 	}
 
-	private static String getSubjectDn(X509Certificate certificate)
+	private static String toSubjectDn(X509Certificate certificate)
 	{
 		return certificate.getSubjectX500Principal().getName(X500Principal.RFC1779);
 	}
+
+	public X509Certificate getCertificate()
+	{
+		return certificate;
+	}
+
+	public String getThumbprint()
+	{
+		return thumbprint;
+	}
+
+	public String getSubjectDn()
+	{
+		return subjectDn;
+	}
+
+	public JcaX509CertificateHolder toJcaX509CertificateHolder()
+	{
+		try
+		{
+			return new JcaX509CertificateHolder(certificate);
+		}
+		catch (CertificateEncodingException e)
+		{
+			throw new RuntimeException(e);
+		}
+	}
+
+	public boolean isNotExpired()
+	{
+		return expiration != null && Instant.now().isBefore(expiration);
+	}
 }

dsf-common/dsf-common-auth/src/main/java/dev/dsf/common/auth/logging/CurrentUserMdcLogger.java

@@ -50,9 +50,9 @@ protected void before(OrganizationIdentity organization)
 	{
 		before((Identity) organization);
 
-		organization.getCertificate().map(X509CertificateWrapper::thumbprint)
+		organization.getCertificate().map(X509CertificateWrapper::getThumbprint)
 				.ifPresent(t -> MDC.put(DSF_ORGANIZATION_THUMBPRINT, t));
-		organization.getCertificate().map(X509CertificateWrapper::subjectDn)
+		organization.getCertificate().map(X509CertificateWrapper::getSubjectDn)
 				.ifPresent(d -> MDC.put(DSF_ORGANIZATION_DN, d));
 
 		MDC.put(DSF_ORGANIZATION_IDENTIFIER, organization.getOrganizationIdentifierValue());
@@ -64,9 +64,9 @@ protected void before(PractitionerIdentity practitioner)
 	{
 		before((Identity) practitioner);
 
-		practitioner.getCertificate().map(X509CertificateWrapper::thumbprint)
+		practitioner.getCertificate().map(X509CertificateWrapper::getThumbprint)
 				.ifPresent(t -> MDC.put(DSF_PRACTITIONER_THUMBPRINT, t));
-		practitioner.getCertificate().map(X509CertificateWrapper::subjectDn)
+		practitioner.getCertificate().map(X509CertificateWrapper::getSubjectDn)
 				.ifPresent(d -> MDC.put(DSF_PRACTITIONER_DN, d));
 		practitioner.getCredentials().map(DsfOpenIdCredentials::getUserId)
 				.ifPresent(i -> MDC.put(DSF_PRACTITIONER_SUB, i));

dsf-common/dsf-common-jetty/src/main/java/dev/dsf/common/auth/DsfOpenIdCredentialsImpl.java

@@ -15,6 +15,7 @@
  */
 package dev.dsf.common.auth;
 
+import java.time.Instant;
 import java.util.Collections;
 import java.util.Map;
 
@@ -29,16 +30,26 @@ public class DsfOpenIdCredentialsImpl implements DsfOpenIdCredentials
 	private final Map<String, Object> idToken;
 	private final Map<String, Object> accessToken;
 
+	private final Instant expiration;
+
 	public DsfOpenIdCredentialsImpl(OpenIdCredentials credentials)
 	{
-		this.idToken = JwtDecoder.decode((String) credentials.getResponse().get(ID_TOKEN));
-		this.accessToken = JwtDecoder.decode((String) credentials.getResponse().get(ACCESS_TOKEN));
+		this(JwtDecoder.decode((String) credentials.getResponse().get(ID_TOKEN)),
+				JwtDecoder.decode((String) credentials.getResponse().get(ACCESS_TOKEN)));
 	}
 
 	public DsfOpenIdCredentialsImpl(String accessToken)
 	{
-		this.idToken = Map.of();
-		this.accessToken = JwtDecoder.decode(accessToken);
+		this(Map.of(), JwtDecoder.decode(accessToken));
+	}
+
+	private DsfOpenIdCredentialsImpl(Map<String, Object> idToken, Map<String, Object> accessToken)
+	{
+		this.idToken = idToken;
+		this.accessToken = accessToken;
+
+		Long exp = getLongClaim("exp");
+		expiration = exp == null ? null : Instant.ofEpochSecond(exp);
 	}
 
 	@Override
@@ -72,4 +83,10 @@ public String getStringClaimOrDefault(String key, String defaultValue)
 		Object o = getAccessToken().getOrDefault(key, defaultValue);
 		return o instanceof String s ? s : defaultValue;
 	}
+
+	@Override
+	public boolean isNotExpired()
+	{
+		return expiration != null && Instant.now().isBefore(expiration);
+	}
 }

dsf-common/dsf-common-jetty/src/main/java/dev/dsf/common/auth/DsfOpenIdLoginService.java

@@ -63,9 +63,7 @@ public boolean validate(UserIdentity user)
 			return false;
 		}
 
-		long expiry = identity.getCredentials().get().getLongClaim("exp");
-		long currentTimeSeconds = (long) (System.currentTimeMillis() / 1000F);
-		if (currentTimeSeconds > expiry)
+		if (!identity.isNotExpired())
 		{
 			logger.debug("ID Token has expired");
 			return false;