Add JWT Auth to Integrity Checker

[wezell]

Just like we did with the PushPublishing Endpoint, we need to add JWT support to the Integritychecker.

See: #16796

[victoralfaro-dotcms]

Tested with receiver cluster with Apache load balancer.
Defined a token in the receiver cluster.

And used it as "secret" in the PP endpoint configuration:

Conflicts were detected successfully and token validation is mentioned in the logs.
These are the logs from one of the nodes picking the first request:

01-Oct-2020 16:54:00.144 WARNING [url:GET//demo.dotcms.com/api/v1/apitoken/dotcms.org.1/tokens | lang:1 | ip:0:0:0:0:0:0:0:1 | Admin:false | start:10-01-2020 03:37:10 CST  ref:http://localhost:8082/c/portal/layout?p_l_id=a8e430e3-8010-40cf-ade1-5978e61241a8&p_p_id=users&p_p_action=0&&dm_rlout=1&r=1601588341224&in_frame=true&frame=detailFrame&container=true&angularCurrentPortlet=users  ?showRevoked=false] org.glassfish.jersey.servlet.WebComponent.filterFormParameters A servlet request to the URI http://localhost:8082/api/v1/apitoken/dotcms.org.1/tokens?showRevoked=false contains form parameters in the request body but the request body has been consumed by the servlet or a servlet filter accessing the request parameters. Only resource methods using @FormParam will work as expected. Resource methods consuming the request body by other means will not work as expected.
16:54:08.339  INFO  timedcache.TimedCacheProvider - ***	 Building Cache : apitokencache, size:1000, seconds:3600,Concurrency:32 (every 60000 millis)
01-Oct-2020 16:54:08.405 WARNING [url:GET//demo.dotcms.com/api/v1/apitoken/dotcms.org.1/tokens | lang:1 | ip:0:0:0:0:0:0:0:1 | Admin:false | start:10-01-2020 03:37:12 CST  ref:http://localhost:8082/c/portal/layout?p_l_id=a8e430e3-8010-40cf-ade1-5978e61241a8&p_p_id=users&p_p_action=0&&dm_rlout=1&r=1601588341224&in_frame=true&frame=detailFrame&container=true&angularCurrentPortlet=users  ?showRevoked=false] org.glassfish.jersey.servlet.WebComponent.filterFormParameters A servlet request to the URI http://localhost:8082/api/v1/apitoken/dotcms.org.1/tokens?showRevoked=false contains form parameters in the request body but the request body has been consumed by the servlet or a servlet filter accessing the request parameters. Only resource methods using @FormParam will work as expected. Resource methods consuming the request body by other means will not work as expected.
16:56:34.486  INFO  rest.IntegrityResource - Receiver at localhost:8082:> job triggered for endpoint id: 127.0.0.1 and requester id: 5497c54a-03a5-499e-9833-3430221c869b
16:56:34.512  INFO  integritycheckers.IntegrityUtil - Starting integrity data generation job for endpoint apib84de3c2-4277-4930-a8f9-3ad721f80581
16:56:34.514  INFO  integritycheckers.IntegrityUtil - Writing '/Users/victoralfaro/dev/dotcms/dotcms-data/assets/integrity/apib84de3c2-4277-4930-a8f9-3ad721f80581/FoldersToCheck.csv' to zip file
16:56:34.517  INFO  integritycheckers.IntegrityUtil - Writing '/Users/victoralfaro/dev/dotcms/dotcms-data/assets/integrity/apib84de3c2-4277-4930-a8f9-3ad721f80581/StructuresToCheck.csv' to zip file
16:56:34.533  INFO  integritycheckers.IntegrityUtil - Writing '/Users/victoralfaro/dev/dotcms/dotcms-data/assets/integrity/apib84de3c2-4277-4930-a8f9-3ad721f80581/ContentPagesToCheck.csv' to zip file
16:56:34.536  INFO  integritycheckers.IntegrityUtil - Writing '/Users/victoralfaro/dev/dotcms/dotcms-data/assets/integrity/apib84de3c2-4277-4930-a8f9-3ad721f80581/ContentFileAssetsToCheck.csv' to zip file
16:56:34.540  INFO  integritycheckers.IntegrityUtil - Writing '/Users/victoralfaro/dev/dotcms/dotcms-data/assets/integrity/apib84de3c2-4277-4930-a8f9-3ad721f80581/CmsRolesToCheck.csv' to zip file
16:56:34.544  INFO  job.IntegrityDataGenerationJob - Job execution for endpoint apib84de3c2-4277-4930-a8f9-3ad721f80581 has finished

Then the second node picks the request asking about the status:

01-Oct-2020 16:56:11.046 WARNING [url:GET//demo.dotcms.com/api/v1/apitoken/dotcms.org.1/tokens | lang:1 | ip:0:0:0:0:0:0:0:1 | Admin:false | start:10-01-2020 04:54:52 CST  ref:http://localhost:8081/c/portal/layout?p_l_id=a8e430e3-8010-40cf-ade1-5978e61241a8&p_p_id=users&p_p_action=0&&dm_rlout=1&r=1601592905302&in_frame=true&frame=detailFrame&container=true&angularCurrentPortlet=users  ?showRevoked=false] org.glassfish.jersey.servlet.WebComponent.filterFormParameters A servlet request to the URI http://localhost:8081/api/v1/apitoken/dotcms.org.1/tokens?showRevoked=false contains form parameters in the request body but the request body has been consumed by the servlet or a servlet filter accessing the request parameters. Only resource methods using @FormParam will work as expected. Resource methods consuming the request body by other means will not work as expected.
16:56:50.504  INFO  timedcache.TimedCacheProvider - ***	 Building Cache : apitokencache, size:1000, seconds:3600,Concurrency:32 (every 60000 millis)
16:56:51.084  INFO  rest.IntegrityResource - Receiver at localhost:8081:> integrity data generation for endpoint id apib84de3c2-4277-4930-a8f9-3ad721f80581 has finished and saved at /Users/victoralfaro/dev/dotcms/dotcms-data/assets/integrity/apib84de3c2-4277-4930-a8f9-3ad721f80581/DataToCheck.zip

[bryanboza]

After those changes, now we can run the Integrity checker if you don't have license on the receiver side, this because you can generate the token in the community edition and don't need an extra configuration on the receiver side. Then we need to find some way to validate the license on the receiver side.

[wezell]

This should do it :
new WebResource.InitBuilder().requireLicense(true)

[freddyucv]

PR: #19488

[victoralfaro-dotcms]

Integrity Check is not running do to the JWT issues. This is the log:

0:37:35.931  INFO  util.SecurityLogger - class com.dotcms.auth.providers.jwt.factories.ApiTokenAPI : JWT Failed from ipaddress:127.0.0.1 JWT signature does not match locally computed signature. JWT validity cannot be asserted and should not be trusted. -- ip:127.0.0.1,user:null
00:37:35.931  WARN  factories.ApiTokenAPI - JWT signature does not match locally computed signature. JWT validity cannot be asserted and should not be trusted.
00:37:35.932  WARN  pusher.PushPublisher - Endpoint or endpoint key is null:null
00:37:35.932  ERROR rest.IntegrityResource - Receiver at localhost:8082> :Receiver at localhost:8082:> Authentication Token is invalid for ip: 127.0.0.1
00:37:37.959  INFO  util.SecurityLogger - class com.dotcms.auth.providers.jwt.factories.ApiTokenAPI : JWT Failed from ipaddress:127.0.0.1 JWT signature does not match locally computed signature. JWT validity cannot be asserted and should not be trusted. -- ip:127.0.0.1,user:null
00:37:37.959  WARN  factories.ApiTokenAPI - JWT signature does not match locally computed signature. JWT validity cannot be asserted and should not be trusted.
00:37:37.959  WARN  pusher.PushPublisher - Endpoint or endpoint key is null:null
00:37:37.959  ERROR rest.IntegrityResource - Receiver at localhost:8082> :Receiver at localhost:8082:> Authentication Token is invalid for ip: 127.0.0.1

[bryanboza]

Problems trying to fix integrity conflicts:
To reproduce:
1- Create a new folder and add some pages into it
2- Push it
3- Delete the folder from sender and create a new folder with the same name
4- Try to fix conflicts on receiver
5- Repeat the steps 3 and 4 again

Here the log: https://gist.github.com/bryanboza/65e87393af56bcb431ee971f0068397b

[bryanboza]

Fixed, tested on release-20.10.1 // Postgres // FF