Skip to content

Commit 7bee1a5

Browse files
thjaecklethjaeckle
authored
Merge pull request #1948 from beyonnex-io/fix-ditto-devops-oauth-subjects-config
#1946 fix that alternative OIDC provider for "devops" authorization could not be configured
2 parents 8549797 + 08b9d94 commit 7bee1a5

28 files changed

+333
-253
lines changed

‎deployment/helm/ditto/Chart.yaml

+1-1
Original file line numberDiff line numberDiff line change
@@ -16,7 +16,7 @@ description: |
1616
A digital twin is a virtual, cloud based, representation of his real world counterpart
1717
(real world “Things”, e.g. devices like sensors, smart heating, connected cars, smart grids, EV charging stations etc).
1818
type: application
19-
version: 3.5.8 # chart version is effectively set by release-job
19+
version: 3.5.9-0 # chart version is effectively set by release-job
2020
appVersion: 3.5.6
2121
keywords:
2222
- iot-chart

‎deployment/helm/ditto/templates/gateway-deployment.yaml

+6-8
Original file line numberDiff line numberDiff line change
@@ -149,6 +149,12 @@ spec:
149149
"{{ printf "%s%s%s%d=%s" "-Dditto.gateway.authentication.devops.oauth.openid-connect-issuers." $key ".auth-subjects." $index $subject }}"
150150
{{- end }}
151151
{{- end }}
152+
{{- range $index, $oauthSubject := .Values.gateway.config.authentication.devops.oauthSubjects }}
153+
"{{ printf "%s%d=%s" "-Dditto.gateway.authentication.devops.devops-oauth2-subjects." $index $oauthSubject }}"
154+
{{- end }}
155+
{{- range $index, $oauthSubject := .Values.gateway.config.authentication.devops.statusOauthSubjects }}
156+
"{{ printf "%s%d=%s" "-Dditto.gateway.authentication.devops.status-oauth2-subjects." $index $oauthSubject }}"
157+
{{- end }}
152158
{{ join " " .Values.gateway.systemProps }}
153159
- name: CLUSTER_BS_REQUIRED_CONTACTS
154160
value: "{{ .Values.global.cluster.requiredContactPoints }}"
@@ -191,10 +197,6 @@ spec:
191197
secretKeyRef:
192198
name: {{ .Values.gateway.config.authentication.devops.existingSecret | default ( printf "%s-gateway-secret" ( include "ditto.fullname" . )) }}
193199
key: devops-password
194-
{{- range $index, $oauthSubject := .Values.gateway.config.authentication.devops.oauthSubjects }}
195-
- name: DEVOPS_OAUTH2_SUBJECTS.{{ $index }}
196-
value: "{{ $oauthSubject }}"
197-
{{- end }}
198200
- name: DEVOPS_STATUS_SECURED
199201
value: "{{ .Values.gateway.config.authentication.devops.statusSecured }}"
200202
- name: STATUS_AUTHENTICATION_METHOD
@@ -204,10 +206,6 @@ spec:
204206
secretKeyRef:
205207
name: {{ .Values.gateway.config.authentication.devops.existingSecret | default ( printf "%s-gateway-secret" ( include "ditto.fullname" . )) }}
206208
key: status-password
207-
{{- range $index, $oauthSubject := .Values.gateway.config.authentication.devops.statusOauthSubjects }}
208-
- name: STATUS_OAUTH2_SUBJECTS.{{ $index }}
209-
value: "{{ $oauthSubject }}"
210-
{{- end }}
211209
- name: WS_SUBSCRIBER_BACKPRESSURE
212210
value: "{{ .Values.gateway.config.websocket.subscriber.backpressureQueueSize }}"
213211
- name: WS_PUBLISHER_BACKPRESSURE

‎gateway/service/src/main/java/org/eclipse/ditto/gateway/service/endpoints/actors/AbstractConnectionsRetrievalActor.java

+11-13
Original file line numberDiff line numberDiff line change
@@ -26,6 +26,11 @@
2626

2727
import javax.annotation.Nullable;
2828

29+
import org.apache.pekko.actor.AbstractActor;
30+
import org.apache.pekko.actor.ActorRef;
31+
import org.apache.pekko.actor.ReceiveTimeout;
32+
import org.apache.pekko.japi.pf.ReceiveBuilder;
33+
import org.apache.pekko.pattern.Patterns;
2934
import org.eclipse.ditto.base.model.exceptions.DittoRuntimeException;
3035
import org.eclipse.ditto.base.model.headers.DittoHeaders;
3136
import org.eclipse.ditto.base.model.headers.WithDittoHeaders;
@@ -43,19 +48,13 @@
4348
import org.eclipse.ditto.connectivity.model.signals.commands.query.RetrieveConnectionsResponse;
4449
import org.eclipse.ditto.gateway.service.util.config.DittoGatewayConfig;
4550
import org.eclipse.ditto.gateway.service.util.config.endpoints.CommandConfig;
51+
import org.eclipse.ditto.internal.utils.config.DefaultScopedConfig;
4652
import org.eclipse.ditto.internal.utils.pekko.logging.DittoLoggerFactory;
4753
import org.eclipse.ditto.internal.utils.pekko.logging.ThreadSafeDittoLogger;
48-
import org.eclipse.ditto.internal.utils.config.DefaultScopedConfig;
4954
import org.eclipse.ditto.json.JsonArray;
5055
import org.eclipse.ditto.json.JsonCollectors;
5156
import org.eclipse.ditto.json.JsonFieldSelector;
5257

53-
import org.apache.pekko.actor.AbstractActor;
54-
import org.apache.pekko.actor.ActorRef;
55-
import org.apache.pekko.actor.ReceiveTimeout;
56-
import org.apache.pekko.japi.pf.ReceiveBuilder;
57-
import org.apache.pekko.pattern.Patterns;
58-
5958

6059
/**
6160
* Abstract actor for retrieving multiple connections.
@@ -195,20 +194,19 @@ private CompletionStage<RetrieveConnectionResponse> retrieveConnection(final Ret
195194

196195
private CompletionStage<RetrieveConnectionResponse> askConnectivity(final RetrieveConnection command) {
197196

198-
logger.withCorrelationId(command).debug("Sending command <{}> to connectivity.service.", command);
197+
final ThreadSafeDittoLogger log = logger.withCorrelationId(command);
198+
log.debug("Sending command <{}> to connectivity.service.", command);
199199
final var commandWithCorrelationId = ensureCommandHasCorrelationId(command);
200200
Duration askTimeout = initialCommand.getDittoHeaders().getTimeout().orElse(defaultTimeout);
201201
return Patterns.ask(edgeCommandForwarder, commandWithCorrelationId, askTimeout)
202202
.thenApply(response -> {
203-
logger.withCorrelationId(command)
204-
.debug("Received response <{}> from connectivity.service.", response);
203+
log.debug("Received response <{}> from connectivity service", response);
205204
throwCauseIfErrorResponse(response);
206205
throwCauseIfDittoRuntimeException(response);
207206
final RetrieveConnectionResponse mappedResponse =
208207
mapToType(response, RetrieveConnectionResponse.class, command);
209-
logger.withCorrelationId(command)
210-
.info("Received response of type <{}> from connectivity.service.",
211-
mappedResponse.getType());
208+
log.info("Received response of type <{}> for id <{}> from connectivity service",
209+
mappedResponse.getType(), mappedResponse.getEntityId());
212210
return mappedResponse;
213211
});
214212
}

‎gateway/service/src/main/java/org/eclipse/ditto/gateway/service/endpoints/directives/auth/DevOpsBasicAuthenticationDirective.java

+9-14
Original file line numberDiff line numberDiff line change
@@ -20,20 +20,21 @@
2020
import java.util.Optional;
2121
import java.util.function.Function;
2222

23-
import org.eclipse.ditto.gateway.service.util.config.security.DevOpsConfig;
24-
import org.slf4j.Logger;
25-
import org.slf4j.LoggerFactory;
26-
2723
import org.apache.pekko.http.javadsl.server.Directives;
2824
import org.apache.pekko.http.javadsl.server.Route;
2925
import org.apache.pekko.http.javadsl.server.directives.SecurityDirectives;
26+
import org.eclipse.ditto.base.model.headers.DittoHeaders;
27+
import org.eclipse.ditto.gateway.service.util.config.security.DevOpsConfig;
28+
import org.eclipse.ditto.internal.utils.pekko.logging.DittoLoggerFactory;
29+
import org.eclipse.ditto.internal.utils.pekko.logging.ThreadSafeDittoLogger;
3030

3131
/**
3232
* Custom Pekko Http directive performing basic auth for a defined {@link #USER_DEVOPS devops user}.
3333
*/
3434
public final class DevOpsBasicAuthenticationDirective implements DevopsAuthenticationDirective {
3535

36-
private static final Logger LOGGER = LoggerFactory.getLogger(DevOpsBasicAuthenticationDirective.class);
36+
private static final ThreadSafeDittoLogger LOGGER =
37+
DittoLoggerFactory.getThreadSafeLogger(DevOpsBasicAuthenticationDirective.class);
3738

3839
private static final String USER_DEVOPS = "devops";
3940

@@ -65,15 +66,9 @@ public static DevOpsBasicAuthenticationDirective status(final DevOpsConfig devOp
6566
return new DevOpsBasicAuthenticationDirective(devOpsConfig.getPassword(), devOpsConfig.getStatusPassword());
6667
}
6768

68-
/**
69-
* Authenticates the devops resources with the chosen authentication method.
70-
*
71-
* @param realm the realm to apply.
72-
* @param inner the inner route, which will be performed on successful authentication.
73-
* @return the inner route wrapped with authentication.
74-
*/
75-
public Route authenticateDevOps(final String realm, final Route inner) {
76-
LOGGER.debug("DevOps basic authentication is enabled for {}.", realm);
69+
@Override
70+
public Route authenticateDevOps(final String realm, final DittoHeaders dittoHeaders, final Route inner) {
71+
LOGGER.withCorrelationId(dittoHeaders).debug("DevOps basic authentication is enabled for {}.", realm);
7772
return Directives.authenticateBasic(realm, new BasicAuthenticator(passwords), userName -> inner);
7873
}
7974

‎gateway/service/src/main/java/org/eclipse/ditto/gateway/service/endpoints/directives/auth/DevOpsInsecureAuthenticationDirective.java

+6-6
Original file line numberDiff line numberDiff line change
@@ -12,17 +12,17 @@
1212
*/
1313
package org.eclipse.ditto.gateway.service.endpoints.directives.auth;
1414

15-
import org.slf4j.Logger;
16-
import org.slf4j.LoggerFactory;
17-
1815
import org.apache.pekko.http.javadsl.server.Route;
16+
import org.eclipse.ditto.base.model.headers.DittoHeaders;
17+
import org.eclipse.ditto.internal.utils.pekko.logging.DittoLogger;
18+
import org.eclipse.ditto.internal.utils.pekko.logging.DittoLoggerFactory;
1919

2020
/**
2121
* Authentication directive which does not perform any authentication.
2222
*/
2323
public final class DevOpsInsecureAuthenticationDirective implements DevopsAuthenticationDirective {
2424

25-
private static final Logger LOGGER = LoggerFactory.getLogger(DevOpsInsecureAuthenticationDirective.class);
25+
private static final DittoLogger LOGGER = DittoLoggerFactory.getLogger(DevOpsInsecureAuthenticationDirective.class);
2626
private static final DevOpsInsecureAuthenticationDirective INSTANCE = new DevOpsInsecureAuthenticationDirective();
2727

2828
private DevOpsInsecureAuthenticationDirective() {}
@@ -32,8 +32,8 @@ public static DevOpsInsecureAuthenticationDirective getInstance() {
3232
}
3333

3434
@Override
35-
public Route authenticateDevOps(final String realm, final Route inner) {
36-
LOGGER.warn("DevOps resource is not secured");
35+
public Route authenticateDevOps(final String realm, final DittoHeaders dittoHeaders, final Route inner) {
36+
LOGGER.withCorrelationId(dittoHeaders).warn("DevOps resource is not secured");
3737
return inner;
3838
}
3939
}

‎gateway/service/src/main/java/org/eclipse/ditto/gateway/service/endpoints/directives/auth/DevOpsOAuth2AuthenticationDirective.java

+21-20
Original file line numberDiff line numberDiff line change
@@ -30,8 +30,8 @@
3030
import org.eclipse.ditto.gateway.service.security.authentication.AuthenticationResult;
3131
import org.eclipse.ditto.gateway.service.security.authentication.jwt.JwtAuthenticationProvider;
3232
import org.eclipse.ditto.gateway.service.util.config.security.DevOpsConfig;
33-
import org.slf4j.Logger;
34-
import org.slf4j.LoggerFactory;
33+
import org.eclipse.ditto.internal.utils.pekko.logging.DittoLoggerFactory;
34+
import org.eclipse.ditto.internal.utils.pekko.logging.ThreadSafeDittoLogger;
3535

3636
import scala.util.Try;
3737

@@ -40,7 +40,8 @@
4040
*/
4141
public final class DevOpsOAuth2AuthenticationDirective implements DevopsAuthenticationDirective {
4242

43-
private static final Logger LOGGER = LoggerFactory.getLogger(DevOpsOAuth2AuthenticationDirective.class);
43+
private static final ThreadSafeDittoLogger LOGGER =
44+
DittoLoggerFactory.getThreadSafeLogger(DevOpsOAuth2AuthenticationDirective.class);
4445

4546
/**
4647
* The Http basic auth realm for the "ditto-devops" user used for /devops resource.
@@ -92,55 +93,55 @@ public static DevOpsOAuth2AuthenticationDirective devops(final DevOpsConfig devO
9293
return new DevOpsOAuth2AuthenticationDirective(jwtAuthenticationProvider, expectedSubjects);
9394
}
9495

95-
/**
96-
* Authenticates the devops resources with the chosen authentication method.
97-
*
98-
* @param realm the realm to apply.
99-
* @param inner the inner route, which will be performed on successful authentication.
100-
* @return the inner route wrapped with authentication.
101-
*/
102-
public Route authenticateDevOps(final String realm, final Route inner) {
103-
LOGGER.debug("DevOps OAuth authentication is enabled for {}.", realm);
96+
@Override
97+
public Route authenticateDevOps(final String realm, final DittoHeaders dittoHeaders, final Route inner) {
98+
final ThreadSafeDittoLogger logger = LOGGER.withCorrelationId(dittoHeaders);
99+
logger.debug("DevOps OAuth authentication is enabled for {}.", realm);
104100
return extractRequestContext(requestContext -> {
105101
final String authorizationHeaderValue = requestContext.getRequest()
106102
.getHeader("authorization")
107103
.map(HttpHeader::value)
108104
.orElse("");
109-
LOGGER.debug("Trying to use OAuth2 authentication for authorization header <{}>", authorizationHeaderValue);
105+
logger.debug("Trying to use OAuth2 authentication for authorization header <{}>", authorizationHeaderValue);
110106
final CompletionStage<AuthenticationResult> authenticationResult =
111-
jwtAuthenticationProvider.authenticate(requestContext, DittoHeaders.empty());
107+
jwtAuthenticationProvider.authenticate(requestContext, dittoHeaders);
112108

113109
final Function<Try<AuthenticationResult>, Route> handleAuthenticationTry =
114-
authenticationResultTry -> handleAuthenticationTry(authenticationResultTry, inner, requestContext);
110+
authenticationResultTry ->
111+
handleAuthenticationTry(authenticationResultTry, dittoHeaders, inner, requestContext);
115112

116113
return Directives.onComplete(authenticationResult, handleAuthenticationTry);
117114
});
118115
}
119116

120-
private Route handleAuthenticationTry(final Try<AuthenticationResult> authenticationResultTry, final Route inner,
117+
private Route handleAuthenticationTry(final Try<AuthenticationResult> authenticationResultTry,
118+
final DittoHeaders dittoHeaders,
119+
final Route inner,
121120
final RequestContext requestContext) {
122121

123122
if (authenticationResultTry.isSuccess()) {
124123
final AuthenticationResult authenticationResult = authenticationResultTry.get();
124+
final ThreadSafeDittoLogger logger = LOGGER.withCorrelationId(dittoHeaders);
125125
if (!authenticationResult.isSuccess()) {
126-
LOGGER.info("DevOps OAuth authentication was not successful for request: '{}' because of '{}'.",
126+
logger.info("DevOps OAuth authentication was not successful for request: '{}' because of '{}'.",
127127
requestContext.getRequest(), authenticationResult.getReasonOfFailure().getMessage());
128128
return Directives.failWith(authenticationResult.getReasonOfFailure());
129129
} else {
130130
final List<String> authorizationSubjectIds =
131131
authenticationResult.getAuthorizationContext().getAuthorizationSubjectIds();
132132
final boolean isAuthorized = expectedSubjects.isEmpty() || authorizationSubjectIds.stream().anyMatch(expectedSubjects::contains);
133133
if (isAuthorized) {
134-
LOGGER.info("DevOps Oauth authentication was successful.");
134+
logger.info("DevOps Oauth authentication was successful, user subjects {} were " +
135+
"part of expected subjects: {}", authorizationSubjectIds, expectedSubjects);
135136
return inner;
136137
} else {
137138
final String message = String.format(
138139
"Unauthorized subject(s): <%s>. Expected: <%s>",
139140
authorizationSubjectIds, expectedSubjects
140141
);
141142
final GatewayAuthenticationFailedException reasonOfFailure =
142-
GatewayAuthenticationFailedException.fromMessage(message, DittoHeaders.empty());
143-
LOGGER.warn("DevOps Oauth authentication failed.", reasonOfFailure);
143+
GatewayAuthenticationFailedException.fromMessage(message, dittoHeaders);
144+
logger.warn("DevOps Oauth authentication failed.", reasonOfFailure);
144145
return Directives.failWith(reasonOfFailure);
145146
}
146147
}

‎gateway/service/src/main/java/org/eclipse/ditto/gateway/service/endpoints/directives/auth/DevopsAuthenticationDirective.java

+10-1
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,7 @@
1313
package org.eclipse.ditto.gateway.service.endpoints.directives.auth;
1414

1515
import org.apache.pekko.http.javadsl.server.Route;
16+
import org.eclipse.ditto.base.model.headers.DittoHeaders;
1617

1718

1819
/**
@@ -21,6 +22,14 @@
2122
@FunctionalInterface
2223
public interface DevopsAuthenticationDirective {
2324

24-
Route authenticateDevOps(final String realm, final Route inner);
25+
/**
26+
* Authenticates the devops resources with the chosen authentication method.
27+
*
28+
* @param realm the realm to apply.
29+
* @param dittoHeaders the DittoHeaders to use for logging.
30+
* @param inner the inner route, which will be performed on successful authentication.
31+
* @return the inner route wrapped with authentication.
32+
*/
33+
Route authenticateDevOps(String realm, DittoHeaders dittoHeaders, Route inner);
2534

2635
}

‎gateway/service/src/main/java/org/eclipse/ditto/gateway/service/endpoints/directives/auth/DevopsAuthenticationDirectiveFactory.java

+15-21
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,8 @@
1616
import org.eclipse.ditto.gateway.service.security.authentication.jwt.JwtAuthenticationProvider;
1717
import org.eclipse.ditto.gateway.service.util.config.security.DevOpsConfig;
1818

19+
import com.typesafe.config.Config;
20+
1921
public final class DevopsAuthenticationDirectiveFactory {
2022

2123
private final JwtAuthenticationProvider jwtAuthenticationProvider;
@@ -29,44 +31,36 @@ private DevopsAuthenticationDirectiveFactory(final JwtAuthenticationProvider jwt
2931
}
3032

3133
public static DevopsAuthenticationDirectiveFactory newInstance(
32-
final JwtAuthenticationFactory jwtAuthenticationFactory, final DevOpsConfig devOpsConfig) {
34+
final JwtAuthenticationFactory jwtAuthenticationFactory, final DevOpsConfig devOpsConfig,
35+
final Config dittoExtensionConfig) {
3336

3437
final JwtAuthenticationProvider jwtAuthenticationProvider = JwtAuthenticationProvider.newInstance(
3538
jwtAuthenticationFactory.newJwtAuthenticationResultProvider(
36-
"ditto.gateway.authentication.devops.oauth"
39+
dittoExtensionConfig, "devops"
3740
),
38-
jwtAuthenticationFactory.getJwtValidator());
41+
jwtAuthenticationFactory.getJwtValidator()
42+
);
3943
return new DevopsAuthenticationDirectiveFactory(jwtAuthenticationProvider, devOpsConfig);
4044
}
4145

4246
public DevopsAuthenticationDirective status() {
4347
if (!devOpsConfig.isSecured() || !devOpsConfig.isStatusSecured()) {
4448
return DevOpsInsecureAuthenticationDirective.getInstance();
4549
}
46-
switch (devOpsConfig.getStatusAuthenticationMethod()) {
47-
case BASIC:
48-
return DevOpsBasicAuthenticationDirective.status(devOpsConfig);
49-
case OAUTH2:
50-
return DevOpsOAuth2AuthenticationDirective.status(devOpsConfig, jwtAuthenticationProvider);
51-
default:
52-
throw new IllegalStateException(
53-
"Unknown devops authentication method: " + devOpsConfig.getStatusAuthenticationMethod());
54-
}
50+
return switch (devOpsConfig.getStatusAuthenticationMethod()) {
51+
case BASIC -> DevOpsBasicAuthenticationDirective.status(devOpsConfig);
52+
case OAUTH2 -> DevOpsOAuth2AuthenticationDirective.status(devOpsConfig, jwtAuthenticationProvider);
53+
};
5554

5655
}
5756

5857
public DevopsAuthenticationDirective devops() {
5958
if (!devOpsConfig.isSecured()) {
6059
return DevOpsInsecureAuthenticationDirective.getInstance();
6160
}
62-
switch (devOpsConfig.getDevopsAuthenticationMethod()) {
63-
case BASIC:
64-
return DevOpsBasicAuthenticationDirective.devops(devOpsConfig);
65-
case OAUTH2:
66-
return DevOpsOAuth2AuthenticationDirective.devops(devOpsConfig, jwtAuthenticationProvider);
67-
default:
68-
throw new IllegalStateException(
69-
"Unknown devops authentication method: " + devOpsConfig.getStatusAuthenticationMethod());
70-
}
61+
return switch (devOpsConfig.getDevopsAuthenticationMethod()) {
62+
case BASIC -> DevOpsBasicAuthenticationDirective.devops(devOpsConfig);
63+
case OAUTH2 -> DevOpsOAuth2AuthenticationDirective.devops(devOpsConfig, jwtAuthenticationProvider);
64+
};
7165
}
7266
}

0 commit comments

Comments
 (0)