Skip to content

Commit c428576

Browse files
thjaecklethjaeckle
committed
#1946 fix devops oauth subjects not being configured correctly with environment variable
Signed-off-by: Thomas Jäckle <[email protected]>
1 parent 8636401 commit c428576

File tree

8 files changed

+65
-37
lines changed

8 files changed

+65
-37
lines changed

‎deployment/helm/ditto/Chart.yaml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -16,7 +16,7 @@ description: |
1616
A digital twin is a virtual, cloud based, representation of his real world counterpart
1717
(real world “Things”, e.g. devices like sensors, smart heating, connected cars, smart grids, EV charging stations etc).
1818
type: application
19-
version: 3.5.6 # chart version is effectively set by release-job
19+
version: 3.5.7-0 # chart version is effectively set by release-job
2020
appVersion: 3.5.6
2121
keywords:
2222
- iot-chart

‎deployment/helm/ditto/templates/gateway-deployment.yaml

Lines changed: 6 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -149,6 +149,12 @@ spec:
149149
"{{ printf "%s%s%s%d=%s" "-Dditto.gateway.authentication.devops.oauth.openid-connect-issuers." $key ".auth-subjects." $index $subject }}"
150150
{{- end }}
151151
{{- end }}
152+
{{- range $index, $oauthSubject := .Values.gateway.config.authentication.devops.oauthSubjects }}
153+
"{{ printf "%s%d=%s" "-Dditto.gateway.authentication.devops.devops-oauth2-subjects." $index $oauthSubject }}"
154+
{{- end }}
155+
{{- range $index, $oauthSubject := .Values.gateway.config.authentication.devops.statusOauthSubjects }}
156+
"{{ printf "%s%d=%s" "-Dditto.gateway.authentication.devops.status-oauth2-subjects." $index $oauthSubject }}"
157+
{{- end }}
152158
{{ join " " .Values.gateway.systemProps }}
153159
- name: CLUSTER_BS_REQUIRED_CONTACTS
154160
value: "{{ .Values.global.cluster.requiredContactPoints }}"
@@ -191,10 +197,6 @@ spec:
191197
secretKeyRef:
192198
name: {{ .Values.gateway.config.authentication.devops.existingSecret | default ( printf "%s-gateway-secret" ( include "ditto.fullname" . )) }}
193199
key: devops-password
194-
{{- range $index, $oauthSubject := .Values.gateway.config.authentication.devops.oauthSubjects }}
195-
- name: DEVOPS_OAUTH2_SUBJECTS.{{ $index }}
196-
value: "{{ $oauthSubject }}"
197-
{{- end }}
198200
- name: DEVOPS_STATUS_SECURED
199201
value: "{{ .Values.gateway.config.authentication.devops.statusSecured }}"
200202
- name: STATUS_AUTHENTICATION_METHOD
@@ -204,10 +206,6 @@ spec:
204206
secretKeyRef:
205207
name: {{ .Values.gateway.config.authentication.devops.existingSecret | default ( printf "%s-gateway-secret" ( include "ditto.fullname" . )) }}
206208
key: status-password
207-
{{- range $index, $oauthSubject := .Values.gateway.config.authentication.devops.statusOauthSubjects }}
208-
- name: STATUS_OAUTH2_SUBJECTS.{{ $index }}
209-
value: "{{ $oauthSubject }}"
210-
{{- end }}
211209
- name: WS_SUBSCRIBER_BACKPRESSURE
212210
value: "{{ .Values.gateway.config.websocket.subscriber.backpressureQueueSize }}"
213211
- name: WS_PUBLISHER_BACKPRESSURE

‎gateway/service/src/test/java/org/eclipse/ditto/gateway/service/endpoints/EndpointTestBase.java

Lines changed: 6 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -72,6 +72,7 @@
7272
import org.eclipse.ditto.internal.utils.cache.config.CacheConfig;
7373
import org.eclipse.ditto.internal.utils.cache.config.DefaultCacheConfig;
7474
import org.eclipse.ditto.internal.utils.config.DefaultScopedConfig;
75+
import org.eclipse.ditto.internal.utils.config.ScopedConfig;
7576
import org.eclipse.ditto.internal.utils.health.StatusInfo;
7677
import org.eclipse.ditto.internal.utils.health.cluster.ClusterStatus;
7778
import org.eclipse.ditto.internal.utils.http.DefaultHttpClientFacade;
@@ -127,9 +128,10 @@ public abstract class EndpointTestBase extends JUnitRouteTest {
127128

128129
@BeforeClass
129130
public static void initTestFixture() {
130-
final var dittoScopedConfig = DefaultScopedConfig.dittoScoped(createTestConfig());
131+
final Config testConfig = createTestConfig();
132+
final var dittoScopedConfig = DefaultScopedConfig.dittoScoped(testConfig);
131133
final var gatewayScopedConfig = DefaultScopedConfig.newInstance(dittoScopedConfig, "gateway");
132-
final var actorSystem = ActorSystem.create(EndpointTestBase.class.getSimpleName(), createTestConfig());
134+
final var actorSystem = ActorSystem.create(EndpointTestBase.class.getSimpleName(), testConfig);
133135
httpConfig = GatewayHttpConfig.of(gatewayScopedConfig);
134136
healthCheckConfig = DefaultHealthCheckConfig.of(gatewayScopedConfig);
135137
commandConfig = DefaultCommandConfig.of(gatewayScopedConfig);
@@ -144,7 +146,8 @@ public static void initTestFixture() {
144146
httpClientFacade =
145147
DefaultHttpClientFacade.getInstance(actorSystem,
146148
DefaultHttpProxyConfig.ofProxy(DefaultScopedConfig.empty("/")));
147-
authorizationSubjectsProvider = JwtAuthorizationSubjectsProvider.get(actorSystem, ConfigFactory.empty());
149+
authorizationSubjectsProvider = JwtAuthorizationSubjectsProvider.get(actorSystem,
150+
ScopedConfig.dittoExtension(testConfig));
148151
jwtAuthenticationFactory = JwtAuthenticationFactory.newInstance(authConfig.getOAuthConfig(),
149152
cacheConfig,
150153
httpClientFacade,

‎gateway/service/src/test/java/org/eclipse/ditto/gateway/service/endpoints/routes/RootRouteTest.java

Lines changed: 11 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -24,6 +24,14 @@
2424
import java.util.stream.Collectors;
2525
import java.util.stream.IntStream;
2626

27+
import org.apache.pekko.actor.ActorSystem;
28+
import org.apache.pekko.http.javadsl.model.HttpRequest;
29+
import org.apache.pekko.http.javadsl.model.StatusCodes;
30+
import org.apache.pekko.http.javadsl.model.headers.Location;
31+
import org.apache.pekko.http.javadsl.model.headers.RawHeader;
32+
import org.apache.pekko.http.javadsl.testkit.TestRoute;
33+
import org.apache.pekko.http.javadsl.testkit.TestRouteResult;
34+
import org.apache.pekko.stream.SystemMaterializer;
2735
import org.eclipse.ditto.base.model.headers.DittoHeaderDefinition;
2836
import org.eclipse.ditto.base.model.headers.DittoHeaders;
2937
import org.eclipse.ditto.base.model.json.JsonSchemaVersion;
@@ -70,15 +78,6 @@
7078

7179
import com.typesafe.config.ConfigFactory;
7280

73-
import org.apache.pekko.actor.ActorSystem;
74-
import org.apache.pekko.http.javadsl.model.HttpRequest;
75-
import org.apache.pekko.http.javadsl.model.StatusCodes;
76-
import org.apache.pekko.http.javadsl.model.headers.Location;
77-
import org.apache.pekko.http.javadsl.model.headers.RawHeader;
78-
import org.apache.pekko.http.javadsl.testkit.TestRoute;
79-
import org.apache.pekko.http.javadsl.testkit.TestRouteResult;
80-
import org.apache.pekko.stream.SystemMaterializer;
81-
8281
/**
8382
* Tests {@link RootRoute}.
8483
*/
@@ -137,12 +136,12 @@ public void setUp() {
137136
final var statusAndHealthProvider = DittoStatusAndHealthProviderFactory.of(routeBaseProperties.getActorSystem(),
138137
clusterStatusSupplier,
139138
healthCheckConfig);
139+
final var dittoExtensionConfig =
140+
ScopedConfig.dittoExtension(routeBaseProperties.getActorSystem().settings().config());
140141
final var devopsAuthenticationDirectiveFactory =
141142
DevopsAuthenticationDirectiveFactory.newInstance(jwtAuthenticationFactory,
142-
authConfig.getDevOpsConfig());
143+
authConfig.getDevOpsConfig(), dittoExtensionConfig);
143144
final var devOpsAuthenticationDirective = devopsAuthenticationDirectiveFactory.devops();
144-
final var dittoExtensionConfig =
145-
ScopedConfig.dittoExtension(routeBaseProperties.getActorSystem().settings().config());
146145
final var rootRoute = RootRoute.getBuilder(httpConfig)
147146
.statsRoute(new StatsRoute(routeBaseProperties, devOpsAuthenticationDirective))
148147
.statusRoute(new StatusRoute(clusterStatusSupplier,

‎gateway/service/src/test/java/org/eclipse/ditto/gateway/service/endpoints/routes/devops/DevOpsRouteTest.java

Lines changed: 14 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -14,28 +14,29 @@
1414
package org.eclipse.ditto.gateway.service.endpoints.routes.devops;
1515

1616
import java.util.Collections;
17+
import java.util.UUID;
1718

19+
import org.apache.pekko.http.javadsl.model.ContentTypes;
20+
import org.apache.pekko.http.javadsl.model.HttpEntities;
21+
import org.apache.pekko.http.javadsl.model.HttpRequest;
22+
import org.apache.pekko.http.javadsl.model.RequestEntity;
23+
import org.apache.pekko.http.javadsl.model.StatusCodes;
24+
import org.apache.pekko.http.javadsl.server.Route;
25+
import org.apache.pekko.http.javadsl.testkit.TestRoute;
1826
import org.eclipse.ditto.base.api.devops.signals.commands.ExecutePiggybackCommand;
1927
import org.eclipse.ditto.base.model.headers.DittoHeaders;
2028
import org.eclipse.ditto.gateway.service.endpoints.EndpointTestBase;
2129
import org.eclipse.ditto.gateway.service.endpoints.directives.auth.DevopsAuthenticationDirectiveFactory;
2230
import org.eclipse.ditto.gateway.service.util.config.security.DefaultDevOpsConfig;
2331
import org.eclipse.ditto.gateway.service.util.config.security.DevOpsConfig;
32+
import org.eclipse.ditto.internal.utils.config.ScopedConfig;
2433
import org.eclipse.ditto.things.model.ThingId;
2534
import org.eclipse.ditto.things.model.signals.commands.query.RetrieveThing;
2635
import org.junit.Before;
2736
import org.junit.Test;
2837

2938
import com.typesafe.config.ConfigFactory;
3039

31-
import org.apache.pekko.http.javadsl.model.ContentTypes;
32-
import org.apache.pekko.http.javadsl.model.HttpEntities;
33-
import org.apache.pekko.http.javadsl.model.HttpRequest;
34-
import org.apache.pekko.http.javadsl.model.RequestEntity;
35-
import org.apache.pekko.http.javadsl.model.StatusCodes;
36-
import org.apache.pekko.http.javadsl.server.Route;
37-
import org.apache.pekko.http.javadsl.testkit.TestRoute;
38-
3940
/**
4041
* Unit test for {@link DevOpsRoute}.
4142
*/
@@ -47,11 +48,14 @@ public final class DevOpsRouteTest extends EndpointTestBase {
4748

4849
@Before
4950
public void setUp() {
51+
final var dittoExtensionConfig =
52+
ScopedConfig.dittoExtension(routeBaseProperties.getActorSystem().settings().config());
5053
final var devopsAuthenticationDirectiveFactory =
51-
DevopsAuthenticationDirectiveFactory.newInstance(jwtAuthenticationFactory, getInsecureDevopsConfig());
54+
DevopsAuthenticationDirectiveFactory.newInstance(jwtAuthenticationFactory, getInsecureDevopsConfig(),
55+
dittoExtensionConfig);
5256
final var authenticationDirective = devopsAuthenticationDirectiveFactory.devops();
5357
devOpsRoute = new DevOpsRoute(routeBaseProperties, authenticationDirective);
54-
final Route route = extractRequestContext(ctx -> devOpsRoute.buildDevOpsRoute(ctx, Collections.emptyMap()));
58+
final Route route = extractRequestContext(ctx -> devOpsRoute.buildDevOpsRoute(ctx, UUID.randomUUID().toString(), Collections.emptyMap()));
5559
underTest = testRoute(route);
5660
}
5761

‎gateway/service/src/test/java/org/eclipse/ditto/gateway/service/endpoints/routes/status/OverallStatusRouteTest.java

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -28,6 +28,7 @@
2828
import org.eclipse.ditto.gateway.service.health.DittoStatusAndHealthProviderFactory;
2929
import org.eclipse.ditto.gateway.service.health.StatusAndHealthProvider;
3030
import org.eclipse.ditto.gateway.service.util.config.security.DevOpsConfig;
31+
import org.eclipse.ditto.internal.utils.config.ScopedConfig;
3132
import org.eclipse.ditto.internal.utils.health.cluster.ClusterStatus;
3233
import org.junit.Before;
3334
import org.junit.Test;
@@ -49,16 +50,19 @@ public final class OverallStatusRouteTest extends EndpointTestBase {
4950

5051
@Before
5152
public void setUp() {
53+
final var dittoExtensionConfig =
54+
ScopedConfig.dittoExtension(routeBaseProperties.getActorSystem().settings().config());
5255
final Supplier<ClusterStatus> clusterStateSupplier = createClusterStatusSupplierMock();
5356
final StatusAndHealthProvider statusHealthProvider =
5457
DittoStatusAndHealthProviderFactory.of(system(), clusterStateSupplier, healthCheckConfig);
5558
final DevOpsConfig devOpsConfig = authConfig.getDevOpsConfig();
5659
final DevopsAuthenticationDirectiveFactory devopsAuthenticationDirectiveFactory =
57-
DevopsAuthenticationDirectiveFactory.newInstance(jwtAuthenticationFactory, devOpsConfig);
60+
DevopsAuthenticationDirectiveFactory.newInstance(jwtAuthenticationFactory, devOpsConfig,
61+
dittoExtensionConfig);
5862
final DevopsAuthenticationDirective authenticationDirective = devopsAuthenticationDirectiveFactory.status();
5963
final OverallStatusRoute statusRoute =
6064
new OverallStatusRoute(clusterStateSupplier, statusHealthProvider, authenticationDirective);
61-
statusTestRoute = testRoute(statusRoute.buildOverallStatusRoute(correlationId));
65+
statusTestRoute = testRoute(statusRoute.buildOverallStatusRoute("correlationId"));
6266
}
6367

6468
@Test

‎gateway/service/src/test/java/org/eclipse/ditto/gateway/service/security/authentication/jwt/DefaultJwtAuthenticationResultProviderTest.java

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -50,7 +50,7 @@ public void assertImmutability() {
5050
@Test
5151
public void getAuthorizationContext() {
5252
final JwtAuthenticationResultProvider underTest =
53-
JwtAuthenticationResultProvider.get(ACTOR_SYSTEM, ConfigFactory.empty(), "regular");
53+
JwtAuthenticationResultProvider.get(ACTOR_SYSTEM, ConfigFactory.empty(), null);
5454
final JsonWebToken jsonWebToken = ImmutableJsonWebToken.fromToken(JwtTestConstants.VALID_JWT_TOKEN);
5555
final AuthorizationSubject myTestSubj = AuthorizationSubject.newInstance("example:myTestSubj");
5656

‎gateway/service/src/test/resources/test.conf

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -133,14 +133,34 @@ ditto {
133133
extensions {
134134
jwt-authorization-subjects-provider = {
135135
extension-class = org.eclipse.ditto.gateway.service.security.authentication.jwt.DittoJwtAuthorizationSubjectsProvider
136+
extension-config = {
137+
role = regular
138+
}
136139
}
137140
# The provider for JSON Web Token authentication results
138141
jwt-authentication-result-provider = {
139142
extension-class = org.eclipse.ditto.gateway.service.security.authentication.jwt.DefaultJwtAuthenticationResultProvider
140143
# The provider for JSON Web Token authorization subjects
141144
extension-config = {
145+
role = regular
146+
jwt-authorization-subjects-provider = {
147+
extension-class = org.eclipse.ditto.gateway.service.security.authentication.jwt.DittoJwtAuthorizationSubjectsProvider
148+
extension-config = {
149+
role = regular
150+
}
151+
}
152+
}
153+
}
154+
jwt-authentication-result-provider-devops = {
155+
extension-class = org.eclipse.ditto.gateway.service.security.authentication.jwt.DefaultJwtAuthenticationResultProvider
156+
# The provider for JSON Web Token authorization subjects
157+
extension-config = {
158+
role = devops
142159
jwt-authorization-subjects-provider = {
143160
extension-class = org.eclipse.ditto.gateway.service.security.authentication.jwt.DittoJwtAuthorizationSubjectsProvider
161+
extension-config = {
162+
role = devops
163+
}
144164
}
145165
}
146166
}

0 commit comments

Comments
 (0)