Skip to content

Commit 1644a8c

Browse files
CarsonCookCarsonCook
authored
fix: timing issue with loading jwt secret (#1301)
* Move ZosmfConfiguration into AuthConfigurationProperties Cleans up code and improves handling of zosmfJwtAutoconfiguration so case does not matter Signed-off-by: Carson Cook <carson.cook@ibm.com> * Immediately load jwt secret if zosmf set to ltpa Signed-off-by: Carson Cook <carson.cook@ibm.com> * Add event listener for new service registration Signed-off-by: Carson Cook <carson.cook@ibm.com> * Add unit tests for event listener Signed-off-by: Carson Cook <carson.cook@ibm.com> * Add timeout to event listening Signed-off-by: Carson Cook <carson.cook@ibm.com> * Cleanup zosmf listener code Signed-off-by: Carson Cook <carson.cook@ibm.com> * Improve unit testing Signed-off-by: Carson Cook <carson.cook@ibm.com> * Fix code smells Signed-off-by: Carson Cook <carson.cook@ibm.com> * Immediately load jwt secret then validate when needed Signed-off-by: Carson Cook <carson.cook@ibm.com> * Clarify log message that GW shuts down Signed-off-by: Carson Cook <carson.cook@ibm.com>
1 parent 33e8190 commit 1644a8c

File tree

11 files changed

+325
-200
lines changed

11 files changed

+325
-200
lines changed

‎apiml-security-common/src/main/java/org/zowe/apiml/security/common/config/AuthConfigurationProperties.java

Lines changed: 9 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -10,14 +10,13 @@
1010
package org.zowe.apiml.security.common.config;
1111

1212
import lombok.Data;
13-
import org.springframework.beans.factory.annotation.Value;
1413
import org.springframework.boot.context.properties.ConfigurationProperties;
1514
import org.springframework.security.authentication.AuthenticationServiceException;
1615
import org.springframework.stereotype.Component;
16+
import org.zowe.apiml.auth.AuthenticationScheme;
1717
import org.zowe.apiml.constants.ApimlConstants;
1818
import org.zowe.apiml.message.log.ApimlLogger;
1919
import org.zowe.apiml.product.logging.annotations.InjectApimlLogger;
20-
import org.zowe.apiml.auth.AuthenticationScheme;
2120

2221

2322
/**
@@ -54,9 +53,15 @@ public class AuthConfigurationProperties {
5453
private AuthConfigurationProperties.PassTicket passTicket;
5554

5655
private String jwtKeyAlias;
56+
private String zosmfJwtEndpoint = "/jwt/ibm/api/zOSMFBuilder/jwk";
5757

58-
@Value("${apiml.security.auth.zosmfJwtEndpoint:/jwt/ibm/api/zOSMFBuilder/jwk}")
59-
private String zosmfJwtEndpoint;
58+
private JWT_AUTOCONFIGURATION_MODE zosmfJwtAutoconfiguration = JWT_AUTOCONFIGURATION_MODE.AUTO;
59+
60+
public enum JWT_AUTOCONFIGURATION_MODE {
61+
AUTO,
62+
LTPA,
63+
JWT
64+
}
6065

6166
//Token properties
6267
@Data

‎gateway-service/src/main/java/org/zowe/apiml/gateway/security/config/ComponentsConfiguration.java

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -10,10 +10,11 @@
1010
package org.zowe.apiml.gateway.security.config;
1111

1212
import org.springframework.cloud.client.discovery.DiscoveryClient;
13-
import org.springframework.context.annotation.*;
13+
import org.springframework.context.annotation.Bean;
14+
import org.springframework.context.annotation.Configuration;
15+
import org.springframework.context.annotation.Lazy;
1416
import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
1517
import org.zowe.apiml.gateway.security.login.Providers;
16-
import org.zowe.apiml.gateway.security.login.zosmf.ZosmfConfiguration;
1718
import org.zowe.apiml.gateway.security.service.zosmf.ZosmfService;
1819
import org.zowe.apiml.passticket.PassTicketService;
1920
import org.zowe.apiml.security.common.config.AuthConfigurationProperties;
@@ -51,10 +52,9 @@ public Providers loginProviders(
5152
DiscoveryClient discoveryClient,
5253
AuthConfigurationProperties authConfigurationProperties,
5354
ZosmfService zosmfService,
54-
@Lazy CompoundAuthProvider compoundAuthProvider,
55-
ZosmfConfiguration zosmfConfiguration
55+
@Lazy CompoundAuthProvider compoundAuthProvider
5656
) {
57-
return new Providers(discoveryClient, authConfigurationProperties, compoundAuthProvider, zosmfService, zosmfConfiguration);
57+
return new Providers(discoveryClient, authConfigurationProperties, compoundAuthProvider, zosmfService);
5858
}
5959

6060
}

‎gateway-service/src/main/java/org/zowe/apiml/gateway/security/login/Providers.java

Lines changed: 14 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -14,7 +14,6 @@
1414
import org.springframework.cloud.client.discovery.DiscoveryClient;
1515
import org.springframework.security.authentication.AuthenticationServiceException;
1616
import org.zowe.apiml.gateway.security.config.CompoundAuthProvider;
17-
import org.zowe.apiml.gateway.security.login.zosmf.ZosmfConfiguration;
1817
import org.zowe.apiml.gateway.security.service.zosmf.ZosmfService;
1918
import org.zowe.apiml.security.common.config.AuthConfigurationProperties;
2019
import org.zowe.apiml.security.common.error.ServiceNotAccessibleException;
@@ -26,10 +25,10 @@ public class Providers {
2625
private final AuthConfigurationProperties authConfigurationProperties;
2726
private final CompoundAuthProvider compoundAuthProvider;
2827
private final ZosmfService zosmfService;
29-
private final ZosmfConfiguration zosmfConfiguration;
3028

3129
/**
3230
* This method decides whether the Zosmf service is available.
31+
*
3332
* @return Availability of the ZOSMF service in the system.
3433
* @throws AuthenticationServiceException if the z/OSMF service id is not configured
3534
*/
@@ -41,6 +40,7 @@ public boolean isZosmfAvailable() {
4140

4241
/**
4342
* Verify that the zOSMF is registered in the Discovery service and that we can actually reach it.
43+
*
4444
* @return true if the service is registered and properly responds.
4545
*/
4646
public boolean isZosmfAvailableAndOnline() {
@@ -59,6 +59,7 @@ public boolean isZosmfAvailableAndOnline() {
5959

6060
/**
6161
* This method decides whether the Zosmf is used for authentication
62+
*
6263
* @return Usage of the ZOSMF service in the system.
6364
*/
6465
public boolean isZosfmUsed() {
@@ -67,17 +68,27 @@ public boolean isZosfmUsed() {
6768

6869
/**
6970
* This method decides whether used zOSMF instance supports JWT tokens.
71+
*
7072
* @return True is the instance support JWT
7173
*/
7274
public boolean zosmfSupportsJwt() {
73-
switch (zosmfConfiguration.jwtAutoconfigurationMode) {
75+
switch (authConfigurationProperties.getZosmfJwtAutoconfiguration()) {
7476
case JWT:
7577
return true;
7678
case LTPA:
7779
return false;
7880
default: // AUTO
7981
return zosmfService.loginEndpointExists() && zosmfService.jwtBuilderEndpointExists();
8082
}
83+
}
8184

85+
/**
86+
* This method is used to access configuration provided by the user to determine if zOSMF supports LTPA token
87+
* instead of JWT.
88+
*
89+
* @return true if configuration was set to indicate zOSMF supports LTPA.
90+
*/
91+
public boolean isZosmfConfigurationSetToLtpa() {
92+
return authConfigurationProperties.getZosmfJwtAutoconfiguration() == AuthConfigurationProperties.JWT_AUTOCONFIGURATION_MODE.LTPA;
8293
}
8394
}

‎gateway-service/src/main/java/org/zowe/apiml/gateway/security/login/zosmf/ZosmfAuthenticationProvider.java

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -15,6 +15,7 @@
1515
import org.springframework.stereotype.Component;
1616
import org.zowe.apiml.gateway.security.service.AuthenticationService;
1717
import org.zowe.apiml.gateway.security.service.zosmf.ZosmfService;
18+
import org.zowe.apiml.security.common.config.AuthConfigurationProperties;
1819
import org.zowe.apiml.security.common.token.TokenAuthentication;
1920

2021
import static org.zowe.apiml.gateway.security.service.zosmf.ZosmfService.TokenType.JWT;
@@ -29,7 +30,7 @@ public class ZosmfAuthenticationProvider implements AuthenticationProvider {
2930

3031
private final AuthenticationService authenticationService;
3132
private final ZosmfService zosmfService;
32-
private final ZosmfConfiguration zosmfConfiguration;
33+
private final AuthConfigurationProperties authConfigurationProperties;
3334

3435
/**
3536
* Authenticate the credentials with the z/OSMF service
@@ -43,7 +44,7 @@ public Authentication authenticate(Authentication authentication) {
4344

4445
final ZosmfService.AuthenticationResponse ar = zosmfService.authenticate(authentication);
4546

46-
switch (zosmfConfiguration.jwtAutoconfigurationMode) {
47+
switch (authConfigurationProperties.getZosmfJwtAutoconfiguration()) {
4748
case LTPA:
4849
if (ar.getTokens().containsKey(LTPA)) {
4950
return getApimlJwtToken(user, ar);

‎gateway-service/src/main/java/org/zowe/apiml/gateway/security/login/zosmf/ZosmfConfiguration.java

Lines changed: 0 additions & 34 deletions
This file was deleted.

0 commit comments

Comments
 (0)