Update users at runtime #196

britzl · 2021-04-08T13:59:57Z

No description provided.

britzl · 2021-04-09T08:56:33Z

README_SECURITY.md

@@ -68,3 +68,5 @@ This defines two users: "bob" and "may". Bob has permission to create Windows, L
 Authentication is performed using standard Basic access authentication. The authentication data can be sent as an `Authorization` request header, but that is inconvenient when using the command line tools (bob.jar) or the Defold editor. The username and password can be sent as part of the build server URL set in the Preferences window of the editor and using the `--build-server` option to bob.jar:

    java -jar bob.jar --build-server https://bob:super5ecret@myextender.com
+
+It is also possible to specify a username and password in the environment variables DM_EXTENDER_USERNAME and DM_EXTENDER_PASSWORD.


This was added in a previous PR for those uncomfortable with adding the username and password in the URL itself. We forgot to add documentation for this though.

britzl · 2021-04-09T08:57:20Z

.gitmodules

@@ -1,3 +1,7 @@
 [submodule "server/scripts/shared"]
 	path = server/scripts/shared
 	url = git@github.com:defold/aws-build-tools.git
+
+[submodule "server/scripts/task-definitions"]


The AWS task definitions are here. These now contain application.yml overrides with paths to resources we do not wish to share openly.

britzl · 2021-04-09T09:10:11Z

server/src/main/java/com/defold/extender/WebSecurityConfig.java

-		}
-		return users;
-	}
+	private InMemoryUserDetailsManager userDetailsManager = new InMemoryUserDetailsManager();


We start with an empty user details manager. It will get updated before the first build via the UserUpdateService.

britzl · 2021-04-09T09:10:49Z

server/src/main/java/com/defold/extender/WebSecurityConfig.java

+		auth.userDetailsService(userDetailsManager);
+	}
+
+	@Bean


Expose the user details manager as a Spring Bean so that we can access it from the UserUpdateService

britzl · 2021-04-09T09:11:20Z

server/src/main/java/com/defold/extender/services/UserUpdateService.java

+
+    private long lastUpdateTimestamp = 0;
+
+    private Properties loadUsers() {


Load the users from the user resource (file or url)

Good comment that could be in the code :)

README_SECURITY.md

JCash · 2021-04-09T09:24:14Z

README_SECURITY.md

-may = top5ecret,ROLE_MACOS,enabled
+extender:
+    authentication:
+        users: https://www.mysite.com/extender-users


Perhaps make it clearer that it expects a text file?
In our task definition we use an explicit url to a users.txt.

Well it doesn't actually have to be a file. It does an HTTP GET so anything that serves a response in the correct format is fine. It could be a REST API that grabs the users from a DB.

This can perhaps be clarified though.

JCash · 2021-04-09T09:26:30Z

README_SECURITY.md

+The same by passing an environment variable when launching Docker:
+
+```
+docker run ... -e extender.authentication.users=https://www.mysite.com/extender-users extender/extender;


I don't see a change for run-local.sh?
How does this work with the current workflow? (I.e. when I build for Switch)

I'll move the extender.authentication.platforms config to the task definition.

JCash · 2021-04-09T09:47:20Z

server/src/main/java/com/defold/extender/services/UserUpdateService.java

+
+    private long lastUpdateTimestamp = 0;
+
+    private Properties loadUsers() {


Good comment that could be in the code :)

JCash · 2021-04-09T09:51:38Z

server/src/main/java/com/defold/extender/services/UserUpdateService.java

+            List<String> userSettings = Arrays.asList(users.getProperty(username).split(","));
+            final String password = userSettings.get(0);
+            final boolean disabled = userSettings.get(userSettings.size() - 1).equals("disabled");
+            final String[] authorities = userSettings.subList(0, userSettings.size() - 1).toArray(new String[0]);


Doesn't this add the password too?

What do you mean by this? Yes, we update/create users with a set of authorities/roles and a password.

My question is, is "authorities[0] == password" ?
Or am I reading it wrong?

Oh, good catch! Yes indeed, the password was included as one of the authorities.

JCash · 2021-04-09T10:00:13Z

server/src/main/java/com/defold/extender/services/UserUpdateService.java

+        return users;
+    }
+
+    // user = password,ROLE_ANDROID,ROLE_IOS,ROLE_HTML5,ROLE_WINDOWS,ROLE_LINUX,ROLE_MACOS,ROLE_SWITCH,disabled


Is this a "standard" format?
If we later need to add/remove info to this (not sure what, but let's say email), will it be easy to do? Will it be easy to remove fields?
Not sure we need to, just making sure the format is as solid we can make it/want it.

Yeah, so the InMemoryUserDetailsManager accepts a Properties instance as one of its constructors:

https://docs.spring.io/spring-security/site/docs/4.2.20.RELEASE/apidocs/org/springframework/security/provisioning/InMemoryUserDetailsManager.html#InMemoryUserDetailsManager-java.util.Properties-

I can't seem to find the example of how it is used anymore.

BUT since we aren't creating the InMemoryUserDetailsManager with a Properties instance in the constructor we're actually free to change the format if we like.

👍
It's good that we can change it.

Workflow question: Will it be easy?
I'm thinking of the update workflow here.
Let's say we update the parsing function, since we want to add/remove a field.
We then need to build stage server, and point it to a separate users.txt.
During these two weeks (the beta period), we need to update two separate users.txt to keep them working for our users.
Then, after two weeks, we can merge the stage/users.txt to the prod/users.txt.

I'm not going to push for any changes at this point though.since this is yet theoretical and not an actual use case yet.

Yeah, I get what you are saying. What we do know is that password comes first, then a list of authorities/roles all prefixed with ROLE_ and finally a value indicating if the user is enabled or not. We're not locked into a format which we cannot change at this moment, but I agree that it makes sense to pick a more extensible format.

server/src/main/java/com/defold/extender/services/UserUpdateService.java

JCash · 2021-04-09T10:36:55Z

server/src/main/java/com/defold/extender/services/UserUpdateService.java

+            List<String> userSettings = Arrays.asList(users.getProperty(username).split(","));
+            final String password = userSettings.get(0);
+            final boolean disabled = userSettings.get(userSettings.size() - 1).equals("disabled");
+            final String[] authorities = userSettings.subList(0, userSettings.size() - 1).toArray(new String[0]);


My question is, is "authorities[0] == password" ?
Or am I reading it wrong?

JCash · 2021-04-09T10:43:02Z

server/src/main/java/com/defold/extender/services/UserUpdateService.java

+        return users;
+    }
+
+    // user = password,ROLE_ANDROID,ROLE_IOS,ROLE_HTML5,ROLE_WINDOWS,ROLE_LINUX,ROLE_MACOS,ROLE_SWITCH,disabled


👍
It's good that we can change it.

Workflow question: Will it be easy?
I'm thinking of the update workflow here.
Let's say we update the parsing function, since we want to add/remove a field.
We then need to build stage server, and point it to a separate users.txt.
During these two weeks (the beta period), we need to update two separate users.txt to keep them working for our users.
Then, after two weeks, we can merge the stage/users.txt to the prod/users.txt.

I'm not going to push for any changes at this point though.since this is yet theoretical and not an actual use case yet.

britzl added 2 commits April 8, 2021 15:58

Copy custom users.txt

6d7050a

Added note on DM_EXTENDER_USERNAME and PASSWORD vars

0149e55

JCash approved these changes Apr 8, 2021

View reviewed changes

britzl added 3 commits April 9, 2021 09:30

Refresh list of authenticated users at runtime

746ce26

Moved task definitions to a submodule

a8f7c5d

Update build.sh

e3a0bb3

britzl commented Apr 9, 2021

View reviewed changes

Update README_SECURITY.md

47325ae

britzl commented Apr 9, 2021

View reviewed changes

britzl changed the title ~~Copy custom users file if specified~~ Update users at runtime Apr 9, 2021

Changed submodule url

a3ce4c8

JCash requested changes Apr 9, 2021

View reviewed changes

britzl added 3 commits April 9, 2021 11:40

Review fix for security docs

c2969a8

Use logger

e6bcc7a

Default is to allow all platforms

f60dbfa

britzl requested a review from JCash April 9, 2021 09:42

JCash approved these changes Apr 9, 2021

View reviewed changes

Added some code comments

6643fb0

JCash reviewed Apr 9, 2021

View reviewed changes

Review fix

af72961

JCash approved these changes Apr 9, 2021

View reviewed changes

britzl merged commit 72eb384 into dev Apr 9, 2021

JCash deleted the dev-copy-custom-users-file branch April 9, 2021 14:13

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Update users at runtime #196

Update users at runtime #196

britzl commented Apr 8, 2021

britzl Apr 9, 2021

britzl Apr 9, 2021

britzl Apr 9, 2021

britzl Apr 9, 2021

britzl Apr 9, 2021

JCash Apr 9, 2021

JCash Apr 9, 2021

britzl Apr 9, 2021

JCash Apr 9, 2021

britzl Apr 9, 2021

JCash Apr 9, 2021

JCash Apr 9, 2021

britzl Apr 9, 2021

JCash Apr 9, 2021

britzl Apr 9, 2021

JCash Apr 9, 2021

britzl Apr 9, 2021

JCash Apr 9, 2021

britzl Apr 9, 2021

JCash Apr 9, 2021

JCash Apr 9, 2021


		private long lastUpdateTimestamp = 0;

		private Properties loadUsers() {

Update users at runtime #196

Update users at runtime #196

Conversation

britzl commented Apr 8, 2021

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment