-
Notifications
You must be signed in to change notification settings - Fork 43
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Adds authorization support for preconfigured AAS Environment (#325)
* Adds Authorization for Preconfigured AAS Environment Signed-off-by: FriedJannik <Jannik.Fried@iese.fraunhofer.de> Co-authored-by: Aaron Zielstorff <aaron.zielstorff@iese.fraunhofer.de> Co-authored-by: Mohammad Ghazanfar Ali Danish <ghazanfar.danish@iese.fraunhofer.de> * Adds Dummy Component for Preconfigured Environment * Adds Check if Authorization is enabled - Embeds Preconfiguration to current Test Classes Signed-off-by: FriedJannik <Jannik.Fried@iese.fraunhofer.de> Co-authored-by: Aaron Zielstorff <aaron.zielstorff@iese.fraunhofer.de> * Removes wrong set config flag * Updates realm/BaSyx-realm.json * Revert "Updates realm/BaSyx-realm.json" This reverts commit cd32396. * Adapts BaSyx-realm.json * Adapts changes according to code review * Refactors Preconfiguration Authorization * Adds missing Bean for test * Re-adds necessary configuration for tests * Adapts Preconfiguration Loader * Adds missing Bean Signed-off-by: FriedJannik <Jannik.Fried@iese.fraunhofer.de> * Adds Test for AccessTokenProviderFactory Co-authored-by: Aaron Zielstorff <aaron.zielstorff@iese.fraunhofer.de> Signed-off-by: FriedJannik <Jannik.Fried@iese.fraunhofer.de> * Adapts changes according to code review --------- Signed-off-by: FriedJannik <Jannik.Fried@iese.fraunhofer.de> Co-authored-by: Aaron Zielstorff <aaron.zielstorff@iese.fraunhofer.de> Co-authored-by: Mohammad Ghazanfar Ali Danish <ghazanfar.danish@iese.fraunhofer.de>
- Loading branch information
3 people
committed
Jul 23, 2024
1 parent
4b3218a
commit d9de413
Showing
17 changed files
with
336 additions
and
38 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
128 changes: 128 additions & 0 deletions
128
.../aasenvironment/feature/authorization/AuthorizedAASEnvironmentPreconfigurationLoader.java
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,128 @@ | ||
| /******************************************************************************* | ||
| * Copyright (C) 2024 the Eclipse BaSyx Authors | ||
| * | ||
| * Permission is hereby granted, free of charge, to any person obtaining | ||
| * a copy of this software and associated documentation files (the | ||
| * "Software"), to deal in the Software without restriction, including | ||
| * without limitation the rights to use, copy, modify, merge, publish, | ||
| * distribute, sublicense, and/or sell copies of the Software, and to | ||
| * permit persons to whom the Software is furnished to do so, subject to | ||
| * the following conditions: | ||
| * | ||
| * The above copyright notice and this permission notice shall be | ||
| * included in all copies or substantial portions of the Software. | ||
| * | ||
| * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, | ||
| * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF | ||
| * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND | ||
| * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE | ||
| * LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION | ||
| * OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION | ||
| * WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. | ||
| * | ||
| * SPDX-License-Identifier: MIT | ||
| ******************************************************************************/ | ||
|
|
||
| package org.eclipse.digitaltwin.basyx.aasenvironment.feature.authorization; | ||
|
|
||
| import org.apache.commons.io.IOUtils; | ||
| import org.apache.poi.openxml4j.exceptions.InvalidFormatException; | ||
| import org.eclipse.digitaltwin.aas4j.v3.dataformat.core.DeserializationException; | ||
| import org.eclipse.digitaltwin.basyx.aasenvironment.AasEnvironment; | ||
| import org.eclipse.digitaltwin.basyx.aasenvironment.preconfiguration.AasEnvironmentPreconfigurationLoader; | ||
| import org.eclipse.digitaltwin.basyx.authorization.jwt.JwtTokenDecoder; | ||
| import org.eclipse.digitaltwin.basyx.authorization.jwt.PublicKeyUtils; | ||
| import org.eclipse.digitaltwin.basyx.client.internal.authorization.AccessTokenProviderFactory; | ||
| import org.eclipse.digitaltwin.basyx.client.internal.authorization.TokenManager; | ||
| import org.eclipse.digitaltwin.basyx.client.internal.authorization.grant.AccessTokenProvider; | ||
| import org.eclipse.digitaltwin.basyx.client.internal.authorization.grant.GrantType; | ||
| import org.springframework.beans.factory.annotation.Value; | ||
| import org.springframework.core.io.ClassPathResource; | ||
| import org.springframework.core.io.ResourceLoader; | ||
| import org.springframework.security.core.context.SecurityContextHolder; | ||
| import org.springframework.security.oauth2.jwt.Jwt; | ||
| import org.springframework.security.oauth2.server.resource.authentication.JwtAuthenticationToken; | ||
|
|
||
| import java.io.FileNotFoundException; | ||
| import java.io.IOException; | ||
| import java.io.InputStream; | ||
| import java.nio.charset.StandardCharsets; | ||
| import java.security.interfaces.RSAPublicKey; | ||
| import java.util.Collection; | ||
| import java.util.List; | ||
|
|
||
| public class AuthorizedAASEnvironmentPreconfigurationLoader extends AasEnvironmentPreconfigurationLoader { | ||
|
|
||
| @Value("${basyx.aasenvironment.authorization.preconfiguration.token-endpoint:#{null}}") | ||
| private String authenticationServerTokenEndpoint; | ||
|
|
||
| @Value("${basyx.aasenvironment.authorization.preconfiguration.client-id:#{null}}") | ||
| private String clientId; | ||
|
|
||
| @Value("${basyx.aasenvironment.authorization.preconfiguration.client-secret:#{null}}") | ||
| private String clientSecret; | ||
|
|
||
| @Value("${basyx.aasenvironment.authorization.preconfiguration.username:#{null}}") | ||
| private String username; | ||
|
|
||
| @Value("${basyx.aasenvironment.authorization.preconfiguration.password:#{null}}") | ||
| private String password; | ||
|
|
||
| @Value("${basyx.aasenvironment.authorization.preconfiguration.grant-type:#{null}}") | ||
| private String grantType; | ||
|
|
||
| @Value("${basyx.aasenvironment.authorization.preconfiguration.scopes:#{null}}") | ||
| private Collection<String> scopes; | ||
|
|
||
| @Value("${basyx.environment:#{null}}") | ||
| private String basyxEnvironment; | ||
|
|
||
| private AccessTokenProvider tokenProvider; | ||
|
|
||
| public AuthorizedAASEnvironmentPreconfigurationLoader(ResourceLoader resourceLoader, List<String> pathsToLoad) { | ||
| super(resourceLoader, pathsToLoad); | ||
| } | ||
|
|
||
| @Override | ||
| public void loadPreconfiguredEnvironments(AasEnvironment aasEnvironment) throws IOException, InvalidFormatException, DeserializationException { | ||
| if(isEnvironmentSet()) { | ||
| setUpTokenProvider(); | ||
| configureSecurityContext(); | ||
| } | ||
| super.loadPreconfiguredEnvironments(aasEnvironment); | ||
| SecurityContextHolder.clearContext(); | ||
| } | ||
|
|
||
|
|
||
| private void setUpTokenProvider() { | ||
| AccessTokenProviderFactory factory = new AccessTokenProviderFactory(GrantType.valueOf(grantType),scopes); | ||
| factory.setClientCredentials(clientId, clientSecret); | ||
| factory.setPasswordCredentials(username, password); | ||
| this.tokenProvider = factory.create(); | ||
| } | ||
|
|
||
| private void configureSecurityContext() throws FileNotFoundException, IOException { | ||
| TokenManager tokenManager = new TokenManager(authenticationServerTokenEndpoint, tokenProvider); | ||
| String adminToken = tokenManager.getAccessToken(); | ||
|
|
||
| String modulus = getStringFromFile("authorization/modulus.txt"); | ||
| String exponent = "AQAB"; | ||
|
|
||
| RSAPublicKey rsaPublicKey = PublicKeyUtils.buildPublicKey(modulus, exponent); | ||
|
|
||
| Jwt jwt = JwtTokenDecoder.decodeJwt(adminToken, rsaPublicKey); | ||
|
|
||
| SecurityContextHolder.getContext().setAuthentication(new JwtAuthenticationToken(jwt)); | ||
| } | ||
|
|
||
|
|
||
| private String getStringFromFile(String fileName) throws FileNotFoundException, IOException { | ||
| ClassPathResource classPathResource = new ClassPathResource(fileName); | ||
| InputStream in = classPathResource.getInputStream(); | ||
| return IOUtils.toString(in, StandardCharsets.UTF_8.name()); | ||
| } | ||
|
|
||
| private boolean isEnvironmentSet() { | ||
| return basyxEnvironment != null; | ||
| } | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.