Use token profile and delete check users #140

achour94 · 2025-05-12T17:23:06Z

This PR enhances API security by implementing token audience validation against a configurable whitelist for both JWT and opaque tokens, ensuring only authorized applications can access the gateway.
Split audience validation into two separate lists:
* allowedAudiences: Exclusively for validating the aud claim in JWT tokens
* allowedClients: For validating client_id claim in JWT tokens and client IDs in opaque tokens
Profile claims from JWT tokens are now extracted and added as roles headers to downstream requests, enabling role-based authorization across backend services.
User admin validation checks were removed.

Signed-off-by: achour94 <berrahmaachour@gmail.com>

jonenst · 2025-05-14T20:03:24Z

src/main/java/org/gridsuite/gateway/filters/AbstractGlobalPreFilter.java

+
+        if (maybeSubList != null && !maybeSubList.isEmpty()) {
+            String sub = maybeSubList.getFirst();
+            return userAdminService.userRecordConnection(sub, false)


do fire and forget instead of waiting for the recorded user connection now that we don't need the response anymore

jonenst · 2025-05-14T20:23:45Z

src/main/java/org/gridsuite/gateway/filters/UserAdminControlGlobalPreFilter.java

-
    public UserAdminControlGlobalPreFilter(UserAdminService userAdminService) {
-        this.userAdminService = userAdminService;
+        super(userAdminService);


Add a comment for this class saying that this comes after other filters (getOrder), and we don't use it to reject request, only to record connection. Optionally remove the dead code that rejects (clientList and else block at the end) or add a comment saying it can't happen and needs to be refactored

jonenst · 2025-05-14T20:23:54Z

src/main/java/org/gridsuite/gateway/filters/UserAdminControlGlobalPreFilter.java

-            return userAdminService.userExists(sub).flatMap(userExist -> Boolean.TRUE.equals(userExist) ? chain.filter(exchange) : completeWithCode(exchange, HttpStatus.FORBIDDEN));
+            // Record the connection with isConnectionAccepted=true
+            // and continue with the filter chain regardless of the result
+            return userAdminService.userRecordConnection(sub, true)


fire and forget

jonenst · 2025-05-14T20:26:46Z

src/main/java/org/gridsuite/gateway/filters/TokenValidatorGlobalPreFilter.java

+     * @param exchange The server web exchange
+     * @return Mono<Void> with unauthorized response if validation fails, null if validation passes
+     */
+    private Mono<Void> validateAudienceOrClientId(JWTClaimsSet jwtClaimsSet, ServerWebExchange exchange) {


Maybe better to return a synchronous value (boolean true false, or void/exception like the lib validator) and completeWithCode in the caller

jonenst · 2025-05-14T20:27:11Z

src/main/java/org/gridsuite/gateway/filters/TokenValidatorGlobalPreFilter.java

+     * @param exchange The server web exchange
+     * @return Mono<Void> with unauthorized response if validation fails, null if validation passes
+     */
+    private Mono<Void> validateClientId(String clientId, ServerWebExchange exchange) {


Same Maybe better to return a synchronous value (boolean true false, or void/exception like the lib validator) and completeWithCode in the caller

jonenst · 2025-05-14T20:28:21Z

src/main/resources/allowed-issuers.yml

@@ -1,3 +1,5 @@
-allowed-issuers: #, #
+allowed-issuers: http://172.17.0.1:9090


move to application-local.yml ?

also we have "localhost" everywhere (except once in explore-server, probably no reason), instead of the docker localhost. Maybe keep that for homogeneity

Or just move it to the docker compose deployment?

it's already in deployment, just does not work when we don't work with docker images

we check issuers using String.startsWith() so localhost will not work in this case since issuer in the token is 172.17.0.1

jonenst · 2025-05-14T20:30:04Z

src/main/resources/allowed-issuers.yml

@@ -1,3 +1,5 @@
-allowed-issuers: #, #
+allowed-issuers: http://172.17.0.1:9090
+allowed-audiences: gridexplore-client, gridadmin-client, griddyna-client, gridstudy-client, gridexplore-local, gridadmin-local, griddyna-local, gridstudy-local


better to put this in the docker compose deployment only?

but it does not work if we start gateway locally using intellij !

Signed-off-by: achour94 <berrahmaachour@gmail.com>

src/main/java/org/gridsuite/gateway/filters/AbstractGlobalPreFilter.java

src/main/java/org/gridsuite/gateway/filters/TokenValidatorGlobalPreFilter.java

Signed-off-by: achour94 <berrahmaachour@gmail.com>

src/main/java/org/gridsuite/gateway/filters/AbstractGlobalPreFilter.java

Signed-off-by: achour94 <berrahmaachour@gmail.com>

TheMaskedTurtle

the isValidAudienceOrClientId method is missing the by-pass for Demo env, where we don't perform audiance check if allowedAudiences is empty

src/main/java/org/gridsuite/gateway/filters/TokenValidatorGlobalPreFilter.java

Signed-off-by: achour94 <berrahmaachour@gmail.com>

sonarqubecloud · 2025-05-20T09:00:24Z

Quality Gate passed

Issues
1 New issue
0 Accepted issues

Measures
0 Security Hotspots
83.3% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

Use token profile and delete check users

9758756

Signed-off-by: achour94 <berrahmaachour@gmail.com>

achour94 self-assigned this May 12, 2025

achour94 mentioned this pull request May 13, 2025

Remove user validation gridsuite/commons-ui#770

Merged

achour94 added 2 commits May 14, 2025 17:44

Split audience validation into two separate lists

860063a

Signed-off-by: achour94 <berrahmaachour@gmail.com>

Split audience validation into two separate lists

33504f1

Signed-off-by: achour94 <berrahmaachour@gmail.com>

jonenst reviewed May 14, 2025

View reviewed changes

achour94 added 6 commits May 14, 2025 23:22

Resolve comments

514de93

Signed-off-by: achour94 <berrahmaachour@gmail.com>

Resolve comments

8870e7f

Signed-off-by: achour94 <berrahmaachour@gmail.com>

Resolve comments

6b846d4

Signed-off-by: achour94 <berrahmaachour@gmail.com>

Resolve comments

6374fc8

Signed-off-by: achour94 <berrahmaachour@gmail.com>

Resolve comments

c4e5ac5

Signed-off-by: achour94 <berrahmaachour@gmail.com>

Resolve comments

d01a480

Signed-off-by: achour94 <berrahmaachour@gmail.com>

TheMaskedTurtle reviewed May 15, 2025

View reviewed changes

Resolve comments

395c2e1

Signed-off-by: achour94 <berrahmaachour@gmail.com>

achour94 requested a review from TheMaskedTurtle May 15, 2025 13:27

TheMaskedTurtle reviewed May 15, 2025

View reviewed changes

src/main/java/org/gridsuite/gateway/filters/AbstractGlobalPreFilter.java Outdated Show resolved Hide resolved

achour94 added 2 commits May 15, 2025 16:40

Resolve comments

50b9832

Signed-off-by: achour94 <berrahmaachour@gmail.com>

Resolve comments

04dd50d

Signed-off-by: achour94 <berrahmaachour@gmail.com>

achour94 requested a review from TheMaskedTurtle May 15, 2025 14:56

Merge branch 'main' into use-token-profile-claims

6afddaa

TheMaskedTurtle requested changes May 19, 2025

View reviewed changes

src/main/java/org/gridsuite/gateway/filters/TokenValidatorGlobalPreFilter.java Outdated Show resolved Hide resolved

Resolve comments

a0c346c

Signed-off-by: achour94 <berrahmaachour@gmail.com>

achour94 requested a review from TheMaskedTurtle May 19, 2025 13:46

Resolve comments

3e40da3

Signed-off-by: achour94 <berrahmaachour@gmail.com>

TheMaskedTurtle approved these changes May 20, 2025

View reviewed changes

achour94 merged commit 8eeedc2 into main May 20, 2025
4 checks passed

achour94 deleted the use-token-profile-claims branch May 20, 2025 13:12

		@@ -1,3 +1,5 @@
		allowed-issuers: #, #
		allowed-issuers: http://172.17.0.1:9090

Use token profile and delete check users #140

Use token profile and delete check users #140

Uh oh!

Conversation

achour94 commented May 12, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

TheMaskedTurtle left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

sonarqubecloud bot commented May 20, 2025

Quality Gate passed

Uh oh!

Uh oh!

Uh oh!

achour94 commented May 12, 2025 •

edited

Loading