Support appending sec-* headers as configured, resolved from authenticated user

.github/workflows/codeql-analysis.yml

@@ -34,12 +34,14 @@ jobs:
     steps:
     - name: Checkout repository
       uses: actions/checkout@v3
+      with:
+        submodules: 'true'
 
     - name: "Setting up Java"
       uses: actions/setup-java@v2
       with:
         distribution: 'adopt'
-        java-version: '17'
+        java-version: '11'
         cache: 'maven'
 
     - name: Initialize CodeQL
@@ -52,3 +54,4 @@ jobs:
 
     - name: Perform CodeQL Analysis
       uses: github/codeql-action/analyze@v2
+

.github/workflows/docker.yml

@@ -13,24 +13,29 @@ jobs:
     steps:
     - name: "Checking out"
       uses: actions/checkout@v3
+      with:
+        submodules: 'true'
 
     - name: "Setting up Java"
       uses: actions/setup-java@v2
       with:
         distribution: 'adopt'
-        java-version: '17'
+        java-version: '11'
         cache: 'maven'
 
-    - name: mvn clean test verify
-      run: ./mvnw clean test verify -ntp -T1C
+    - name: Build georchestra dependencies
+      run: ./mvnw -f georchestra/ clean install -pl :georchestra-ldap-account-management -am -DskipTests -P-all -ntp
+
+    - name: Build gateway
+      run: ./mvnw verify -pl :georchestra-gateway -ntp -T1C
 
     - name: Calculating docker image tag
       id: version
       run: echo ::set-output name=VERSION::$(echo $GITHUB_REF | cut -d / -f 3)
 
     - name: "Building a docker image"
       if: github.repository == 'georchestra/georchestra-gateway'
-      run: ./mvnw -DimageTag=${{ steps.version.outputs.VERSION }} spring-boot:build-image -ntp
+      run: ./mvnw -f gateway/ -DimageTag=${{ steps.version.outputs.VERSION }} spring-boot:build-image -ntp -DskipTests
 
     - name: "Logging in to docker.io"
       if: github.repository == 'georchestra/georchestra-gateway'

.gitmodules

@@ -0,0 +1,4 @@
+[submodule "georchestra"]
+	path = georchestra
+	url = https://github.com/georchestra/georchestra.git
+	shallow = true

.mvn/jvm.config

@@ -0,0 +1,6 @@
+--add-exports jdk.compiler/com.sun.tools.javac.api=ALL-UNNAMED
+--add-exports jdk.compiler/com.sun.tools.javac.file=ALL-UNNAMED
+--add-exports jdk.compiler/com.sun.tools.javac.parser=ALL-UNNAMED
+--add-exports jdk.compiler/com.sun.tools.javac.tree=ALL-UNNAMED
+--add-exports jdk.compiler/com.sun.tools.javac.util=ALL-UNNAMED
+

configuration.md

@@ -0,0 +1,72 @@
+
+# Configuration properties
+
+## Configuration object model
+
+```mermaid
+classDiagram
+  GatewayConfigProperties *-- HeaderMappings : defaultHeaders
+  GatewayConfigProperties *-- "0..*" RoleBasedAccessRule : globalAccessRules
+  GatewayConfigProperties *-- "0..*" Service
+  Service *-- HeaderMappings : headers
+  Service *-- "0..*" RoleBasedAccessRule : accessRules
+  class GatewayConfigProperties{
+    Map<String, Service> services
+  }
+  class HeaderMappings{
+    boolean proxy
+    boolean username
+    boolean roles
+    boolean org
+    boolean orgname
+    boolean email
+    boolean firstname
+    boolean lastname
+    boolean tel
+    boolean jsonUser
+    boolean jsonOrganization
+  }
+  class RoleBasedAccessRule{
+    List~String~ interceptUrl
+    boolean anonymous
+    List~String~ allowedRoles
+  }
+  class Service{
+    URL target
+  }
+```
+
+## Example YAML configuration
+
+```yaml
+georchestra:
+  gateway:
+    default-headers:
+      proxy: true
+      username: true
+      roles: true
+      org: true
+      orgname: true
+    global-access-rules:
+    - intercept-url: /**
+      anonymous: true
+    services:
+      analytics:
+        target: http://analytics:8080/analytics/
+        access-rules:
+        - intercept-url: /analytics/**
+          allowed-roles: SUPERUSER, ORGADMIN
+      atlas: 
+        target: http://atlas:8080/atlas/
+      console: 
+        target: http://console:8080/console/
+        access-rules:
+        - intercept-url:
+          - /console/public/**
+          - /console/manager/public/**
+          anonymous: true
+        - intercept-url:
+          - /console/private/**
+          - /console/manager/**
+          allowed-roles: SUPERUSER, ORGADMIN
+```

gateway/pom.xml

@@ -0,0 +1,241 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 https://maven.apache.org/xsd/maven-4.0.0.xsd">
+  <modelVersion>4.0.0</modelVersion>
+  <parent>
+    <groupId>org.georchestra</groupId>
+    <artifactId>georchestra-gateway-parent</artifactId>
+    <version>${revision}</version>
+  </parent>
+  <artifactId>georchestra-gateway</artifactId>
+  <name>gateway</name>
+  <description>geOrchestra application gateway</description>
+  <properties>
+    <java.version>11</java.version>
+    <imageTag>${project.version}</imageTag>
+    <spring-boot.build-image.imageName>georchestra/gateway:${imageTag}</spring-boot.build-image.imageName>
+  </properties>
+  <dependencies>
+    <dependency>
+      <groupId>org.georchestra</groupId>
+      <artifactId>georchestra-ldap-account-management</artifactId>
+    </dependency>
+    <dependency>
+      <groupId>org.springframework.boot</groupId>
+      <artifactId>spring-boot-starter-oauth2-client</artifactId>
+    </dependency>
+    <dependency>
+      <groupId>org.springframework.boot</groupId>
+      <artifactId>spring-boot-starter-security</artifactId>
+    </dependency>
+    <dependency>
+      <groupId>org.springframework.security</groupId>
+      <artifactId>spring-security-ldap</artifactId>
+    </dependency>
+    <dependency>
+      <groupId>org.springframework.cloud</groupId>
+      <artifactId>spring-cloud-starter-gateway</artifactId>
+    </dependency>
+    <dependency>
+      <groupId>org.springframework.boot</groupId>
+      <artifactId>spring-boot-starter-actuator</artifactId>
+    </dependency>
+    <dependency>
+      <groupId>org.projectlombok</groupId>
+      <artifactId>lombok</artifactId>
+      <optional>true</optional>
+    </dependency>
+    <dependency>
+      <!-- Annotation processor that generates metadata about classes annotated with @ConfigurationProperties. -->
+      <!-- This metadata is used by IDEs to provide auto-completion and documentation for the properties when editing application.properties 
+        and application.yaml -->
+      <groupId>org.springframework.boot</groupId>
+      <artifactId>spring-boot-configuration-processor</artifactId>
+      <optional>true</optional>
+    </dependency>
+    <dependency>
+      <!-- Generates META-INF/spring-autoconfigure-metadata.properties for inclusion in the project's jar. -->
+      <!-- This file helps with startup time, but is not necessary for your app to function correctly. -->
+      <groupId>org.springframework.boot</groupId>
+      <artifactId>spring-boot-autoconfigure-processor</artifactId>
+      <optional>true</optional>
+    </dependency>
+    <dependency>
+      <groupId>org.springframework.boot</groupId>
+      <artifactId>spring-boot-devtools</artifactId>
+      <scope>runtime</scope>
+      <optional>true</optional>
+    </dependency>
+    <dependency>
+      <groupId>org.springframework.boot</groupId>
+      <artifactId>spring-boot-starter-test</artifactId>
+      <scope>test</scope>
+    </dependency>
+    <!-- <dependency> -->
+    <!-- <groupId>org.springframework.security</groupId> -->
+    <!-- <artifactId>spring-security-test</artifactId> -->
+    <!-- <scope>test</scope> -->
+    <!-- </dependency> -->
+  </dependencies>
+  <build>
+    <plugins>
+      <plugin>
+        <groupId>net.revelc.code.formatter</groupId>
+        <artifactId>formatter-maven-plugin</artifactId>
+        <executions>
+          <execution>
+            <goals>
+              <goal>${fmt.action}</goal>
+            </goals>
+          </execution>
+        </executions>
+        <inherited>true</inherited>
+        <configuration>
+          <skip>${fmt.skip}</skip>
+          <configFile>${maven.multiModuleProjectDirectory}/.mvn/formatter.xml</configFile>
+          <compilerSource>${java.version}</compilerSource>
+          <compilerCompliance>${java.version}</compilerCompliance>
+          <compilerTargetPlatform>${java.version}</compilerTargetPlatform>
+          <!-- Use Unix and Mac style line endings -->
+          <lineEnding>LF</lineEnding>
+          <encoding>UTF-8</encoding>
+          <skipJsFormatting>true</skipJsFormatting>
+          <skipCssFormatting>true</skipCssFormatting>
+          <skipHtmlFormatting>true</skipHtmlFormatting>
+          <skipJsonFormatting>true</skipJsonFormatting>
+          <skipXmlFormatting>true</skipXmlFormatting>
+          <skipJavaFormatting>false</skipJavaFormatting>
+        </configuration>
+      </plugin>
+      <plugin>
+        <groupId>org.apache.maven.plugins</groupId>
+        <artifactId>maven-enforcer-plugin</artifactId>
+        <executions>
+          <execution>
+            <id>enforce-maven-and-java</id>
+            <goals>
+              <goal>enforce</goal>
+            </goals>
+            <configuration>
+              <rules>
+                <requireJavaVersion>
+                  <version>[11,)</version>
+                </requireJavaVersion>
+                <requireMavenVersion>
+                  <version>[3.6.3,)</version>
+                </requireMavenVersion>
+              </rules>
+            </configuration>
+          </execution>
+        </executions>
+      </plugin>
+      <plugin>
+        <groupId>com.github.ekryd.sortpom</groupId>
+        <artifactId>sortpom-maven-plugin</artifactId>
+        <executions>
+          <execution>
+            <phase>verify</phase>
+            <goals>
+              <goal>${pom.fmt.action}</goal>
+            </goals>
+          </execution>
+        </executions>
+        <configuration>
+          <skip>${pom.fmt.skip}</skip>
+          <pomFile>pom.xml</pomFile>
+          <keepBlankLines>true</keepBlankLines>
+          <spaceBeforeCloseEmptyElement>false</spaceBeforeCloseEmptyElement>
+          <createBackupFile>false</createBackupFile>
+          <verifyFail>stop</verifyFail>
+          <verifyFailOn>strict</verifyFailOn>
+        </configuration>
+      </plugin>
+      <plugin>
+        <groupId>org.codehaus.mojo</groupId>
+        <artifactId>flatten-maven-plugin</artifactId>
+        <executions>
+          <execution>
+            <id>flatten</id>
+            <phase>process-resources</phase>
+            <goals>
+              <goal>flatten</goal>
+            </goals>
+          </execution>
+          <execution>
+            <id>flatten.clean</id>
+            <phase>clean</phase>
+            <goals>
+              <goal>clean</goal>
+            </goals>
+          </execution>
+        </executions>
+        <configuration>
+          <updatePomFile>true</updatePomFile>
+          <!--flattenMode>resolveCiFriendliesOnly</flattenMode -->
+          <flattenMode>oss</flattenMode>
+        </configuration>
+      </plugin>
+      <plugin>
+        <groupId>org.springframework.boot</groupId>
+        <artifactId>spring-boot-maven-plugin</artifactId>
+        <executions>
+          <execution>
+            <id>build-info</id>
+            <goals>
+              <goal>build-info</goal>
+            </goals>
+          </execution>
+        </executions>
+      </plugin>
+      <plugin>
+        <groupId>org.jacoco</groupId>
+        <artifactId>jacoco-maven-plugin</artifactId>
+        <version>0.8.8</version>
+        <executions>
+          <execution>
+            <id>prepare-agent</id>
+            <goals>
+              <goal>prepare-agent</goal>
+            </goals>
+          </execution>
+          <execution>
+            <id>report</id>
+            <phase>test</phase>
+            <goals>
+              <goal>report</goal>
+            </goals>
+          </execution>
+        </executions>
+      </plugin>
+    </plugins>
+  </build>
+
+  <profiles>
+    <profile>
+      <id>docker</id>
+      <activation>
+        <activeByDefault>false</activeByDefault>
+      </activation>
+      <build>
+        <plugins>
+          <plugin>
+            <groupId>org.springframework.boot</groupId>
+            <artifactId>spring-boot-maven-plugin</artifactId>
+            <executions>
+              <execution>
+                <id>build-image</id>
+                <goals>
+                  <goal>build-image</goal>
+                </goals>
+              </execution>
+            </executions>
+            <configuration>
+              <image>
+                <pullPolicy>IF_NOT_PRESENT</pullPolicy>
+              </image>
+            </configuration>
+          </plugin>
+        </plugins>
+      </build>
+    </profile>
+  </profiles>
+</project>