Skip to content

Commit 5f32c09

Browse files
achmeloachmelo
authored
fix: disable x509 (#2659)
* fix: enable hsts (#2565) Signed-off-by: achmelo <a.chmelo@gmail.com> Signed-off-by: achmelo <a.chmelo@gmail.com> (cherry picked from commit 4cffe97) * use flag to disable x509 for SSO Signed-off-by: achmelo <a.chmelo@gmail.com> * remove transitive servlet-api Signed-off-by: achmelo <a.chmelo@gmail.com> * fix unit tests Signed-off-by: achmelo <a.chmelo@gmail.com> * use PR number for publish task Signed-off-by: achmelo <a.chmelo@gmail.com> * snapshot version in properties Signed-off-by: achmelo <a.chmelo@gmail.com> Signed-off-by: achmelo <a.chmelo@gmail.com>
1 parent decf6fe commit 5f32c09

File tree

6 files changed

+31
-26
lines changed

6 files changed

+31
-26
lines changed

‎.github/workflows/pull-request-snapshot-release.yml

Lines changed: 7 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@ on:
66
workflow_dispatch:
77
inputs:
88
pull_request:
9-
description: 'The pull request snapshot that is going to be released (i.e PR-XXXX)'
9+
description: 'The pull request snapshot that is going to be released (i.e XXXX)'
1010
required: true
1111

1212
env:
@@ -19,20 +19,22 @@ jobs:
1919
timeout-minutes: 30
2020

2121
steps:
22-
- uses: actions/checkout@v2
22+
- uses: actions/checkout@v3
2323
with:
2424
ref: ${{ github.head_ref }}
2525

2626
- uses: ./.github/actions/setup
2727

2828
- name: Release with Gradle
2929
run: |
30-
BRANCH_NAME=PR-${{ env.PR_NUMBER }}
31-
sed -i '/version=/ s/-SNAPSHOT/-'"$BRANCH_NAME"'-SNAPSHOT/' ./gradle.properties
32-
./gradlew build publishAllVersions -Pzowe.deploy.username=$ARTIFACTORY_USERNAME -Pzowe.deploy.password=$ARTIFACTORY_PASSWORD -Partifactory_user=$ARTIFACTORY_USERNAME -Partifactory_password=$ARTIFACTORY_USERNAME -PpullRequest=$BRANCH_NAME
30+
PR_NUMBER=PR-${{ env.PR_NUMBER }}
31+
sed -i '/version=/ s/-SNAPSHOT/-'"$PR_NUMBER"'-SNAPSHOT/' ./gradle.properties
32+
./gradlew build publishAllVersions -Pzowe.deploy.username=$ARTIFACTORY_USERNAME -Pzowe.deploy.password=$ARTIFACTORY_PASSWORD -Partifactory_user=$ARTIFACTORY_USERNAME -Partifactory_password=$ARTIFACTORY_USERNAME -PpullRequest=$PR_NUMBER
3333
env:
3434
ARTIFACTORY_USERNAME: ${{ secrets.ARTIFACTORY_USERNAME }}
3535
ARTIFACTORY_PASSWORD: ${{ secrets.ARTIFACTORY_PASSWORD }}
36+
BRANCH_NAME: ${{ github.ref_name }}
37+
BUILD_NUMBER: ${{ github.run_number }}
3638

3739
- uses: ./.github/actions/teardown
3840

‎discovery-service/build.gradle

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -57,7 +57,9 @@ configurations.all {
5757
}
5858

5959
dependencies {
60-
implementation(project(':security-service-client-spring'))
60+
implementation(project(':security-service-client-spring')) {
61+
exclude group: "javax.servlet", module: "servlet-api"
62+
}
6163
implementation(libraries.spring_boot_starter_web) {
6264
exclude group: "org.apache.tomcat.embed", module: "tomcat-embed-el"
6365
}
@@ -76,6 +78,7 @@ dependencies {
7678
}
7779
implementation(libraries.eureka_core) {
7880
exclude group: "com.amazonaws", module: "aws-java-sdk-core"
81+
exclude group: "javax.servlet", module: "servlet-api"
7982
}
8083
implementation libraries.aws_sdk_core
8184
implementation libraries.gson

‎gateway-service/src/main/java/org/zowe/apiml/gateway/security/service/schema/source/DefaultAuthSourceService.java

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,7 @@
1212
import lombok.extern.slf4j.Slf4j;
1313
import org.springframework.beans.factory.annotation.Autowired;
1414
import org.springframework.beans.factory.annotation.Qualifier;
15+
import org.springframework.beans.factory.annotation.Value;
1516
import org.springframework.context.annotation.EnableAspectJAutoProxy;
1617
import org.springframework.context.annotation.Primary;
1718
import org.springframework.context.annotation.Scope;
@@ -41,6 +42,9 @@
4142
public class DefaultAuthSourceService implements AuthSourceService {
4243
private final Map<AuthSourceType, AuthSourceService> map = new EnumMap<>(AuthSourceType.class);
4344

45+
@Value("${apiml.security.x509.enabled:false}")
46+
private boolean isClientCertEnabled;
47+
4448
/**
4549
* Build the map of the specific implementations of {@link AuthSourceService} for processing of different type of authentications
4650
*
@@ -67,7 +71,7 @@ public DefaultAuthSourceService(@Autowired JwtAuthSourceService jwtAuthSourceSer
6771
public Optional<AuthSource> getAuthSourceFromRequest() {
6872
AuthSourceService service = getService(AuthSourceType.JWT);
6973
Optional<AuthSource> authSource = service.getAuthSourceFromRequest();
70-
if (!authSource.isPresent()) {
74+
if (!authSource.isPresent() && isClientCertEnabled) {
7175
service = getService(AuthSourceType.CLIENT_CERT);
7276
authSource = service.getAuthSourceFromRequest();
7377
}

‎gateway-service/src/test/java/org/zowe/apiml/gateway/security/service/schema/source/DefaultAuthSourceServiceTest.java

Lines changed: 13 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -9,29 +9,23 @@
99
*/
1010
package org.zowe.apiml.gateway.security.service.schema.source;
1111

12-
import static org.junit.jupiter.api.Assertions.assertFalse;
13-
import static org.junit.jupiter.api.Assertions.assertTrue;
14-
import static org.mockito.ArgumentMatchers.any;
15-
import static org.mockito.Mockito.mock;
16-
import static org.mockito.Mockito.times;
17-
import static org.mockito.Mockito.verify;
18-
import static org.mockito.Mockito.verifyNoInteractions;
19-
import static org.mockito.Mockito.when;
20-
21-
import java.security.cert.X509Certificate;
22-
import java.util.Date;
23-
import java.util.Optional;
24-
import org.junit.jupiter.api.Assertions;
25-
import org.junit.jupiter.api.BeforeEach;
26-
import org.junit.jupiter.api.Nested;
27-
import org.junit.jupiter.api.Test;
28-
import org.junit.jupiter.api.TestInstance;
12+
import org.junit.jupiter.api.*;
2913
import org.junit.jupiter.api.extension.ExtendWith;
3014
import org.mockito.junit.jupiter.MockitoExtension;
15+
import org.springframework.test.util.ReflectionTestUtils;
3116
import org.zowe.apiml.gateway.security.service.schema.source.AuthSource.Origin;
3217
import org.zowe.apiml.gateway.security.service.schema.source.AuthSource.Parsed;
3318
import org.zowe.apiml.gateway.utils.CleanCurrentRequestContextTest;
3419

20+
import java.security.cert.X509Certificate;
21+
import java.util.Date;
22+
import java.util.Optional;
23+
24+
import static org.junit.jupiter.api.Assertions.assertFalse;
25+
import static org.junit.jupiter.api.Assertions.assertTrue;
26+
import static org.mockito.ArgumentMatchers.any;
27+
import static org.mockito.Mockito.*;
28+
3529
@ExtendWith(MockitoExtension.class)
3630
public class DefaultAuthSourceServiceTest extends CleanCurrentRequestContextTest {
3731
private X509Certificate x509Certificate;
@@ -46,6 +40,7 @@ void init() {
4640
x509MFAuthSourceService = mock(X509AuthSourceService.class);
4741
serviceUnderTest = new DefaultAuthSourceService(jwtAuthSourceService, x509MFAuthSourceService);
4842
x509Certificate = mock(X509Certificate.class);
43+
ReflectionTestUtils.setField(serviceUnderTest, "isClientCertEnabled", true);
4944
}
5045

5146
@Nested
@@ -114,7 +109,6 @@ void thenX509AuthSourceIsPresent() {
114109
when(x509MFAuthSourceService.getAuthSourceFromRequest()).thenReturn(Optional.of(x509AuthSource));
115110

116111
Optional<AuthSource> authSource = serviceUnderTest.getAuthSourceFromRequest();
117-
118112
verify(jwtAuthSourceService, times(1)).getAuthSourceFromRequest();
119113
verify(x509MFAuthSourceService, times(1)).getAuthSourceFromRequest();
120114

@@ -184,6 +178,7 @@ void thenX509AuthSourceIsPresent() {
184178
@TestInstance(TestInstance.Lifecycle.PER_CLASS)
185179
class WhenUnknownAuthSource {
186180
private final DummyAuthSource dummyAuthSource = new DummyAuthSource();
181+
187182
@Test
188183
void thenAuthSourceIsInvalid() {
189184
Assertions.assertThrows(IllegalArgumentException.class, () -> serviceUnderTest.isValid(dummyAuthSource));

‎gateway-service/src/test/resources/application.yml

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -36,6 +36,7 @@ apiml:
3636
x509:
3737
externalMapperUrl: http://localhost:8542/certificate/x509/map
3838
externalMapperUser: validUserForMap
39+
enabled: true
3940
auth:
4041
provider: dummy
4142
zosmf:

‎gradle.properties

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -17,7 +17,7 @@ artifactoryPublishingMavenRepo=https://zowe.jfrog.io/zowe/libs-release-local
1717
artifactoryPublishingMavenSnapshotRepo=https://zowe.jfrog.io/zowe/libs-snapshot-local
1818

1919
# Artifacts version
20-
version=1.28.14
20+
version=1.28.14-SNAPSHOT
2121

2222
defaultSpringBootVersion=2.0.2.RELEASE
2323
defaultSpringBootCloudVersion=2.0.0.RELEASE

0 commit comments

Comments
 (0)