Skip to content

Commit 3f755ad

Browse files
jolarsenjolarsen
authored
Sanere openambruk før nyttår (#1224)
1 parent 7b176f8 commit 3f755ad

35 files changed

+130
-1130
lines changed

‎felles/abac/src/main/java/no/nav/vedtak/sikkerhet/abac/Token.java

+1-2
Original file line numberDiff line numberDiff line change
@@ -66,9 +66,8 @@ public SluttBruker getSluttBruker() {
6666

6767
private static TokenType utledTokenType(OpenIDToken token) {
6868
return switch (token.provider()) {
69-
case ISSO, STS, AZUREAD -> TokenType.OIDC;
69+
case STS, AZUREAD -> TokenType.OIDC;
7070
case TOKENX -> TokenType.TOKENX;
71-
case IDPORTEN -> throw new IllegalStateException("IdPorten token støttes ikke.");
7271
};
7372
}
7473

‎felles/abac/src/main/java/no/nav/vedtak/sikkerhet/abac/TokenProvider.java

+1-1
Original file line numberDiff line numberDiff line change
@@ -20,7 +20,7 @@ public interface TokenProvider {
2020
SluttBruker getSluttBruker();
2121

2222
/**
23-
* OIDC tokenet til brukeren. Helst fra følgende providere: Tokendings, AzureAD, STS, OpenAM.
23+
* OIDC tokenet til brukeren. Helst fra følgende providere: TokenX, AzureAD, STS.
2424
* Sendes til PDP (Policy Decision Point) og gir informasjon til ABAC om subject og auth level.
2525
* @return bruker OIDC token.
2626
*/

‎felles/abac/src/test/resources/application.properties

-1
This file was deleted.

‎felles/log/src/main/java/no/nav/vedtak/log/audit/Auditlogger.java

-2
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,5 @@
11
package no.nav.vedtak.log.audit;
22

3-
import java.util.Objects;
4-
53
import javax.enterprise.context.Dependent;
64
import javax.inject.Inject;
75

‎felles/oidc/src/main/java/no/nav/vedtak/sikkerhet/oidc/config/OpenIDConfiguration.java

+9-10
Original file line numberDiff line numberDiff line change
@@ -2,16 +2,15 @@
22

33
import java.net.URI;
44

5-
public final record OpenIDConfiguration(OpenIDProvider type,
6-
URI issuer,
7-
URI jwksUri,
8-
URI tokenEndpoint,
9-
URI authorizationEndpoint,
10-
boolean useProxyForJwks,
11-
URI proxy,
12-
String clientId,
13-
String clientSecret, // Settes nå kun for openam. Vurder økt bruk. Noen providers buker jws.
14-
boolean skipAudienceValidation) {
5+
public record OpenIDConfiguration(OpenIDProvider type,
6+
URI issuer,
7+
URI jwksUri,
8+
URI tokenEndpoint,
9+
boolean useProxyForJwks,
10+
URI proxy,
11+
String clientId,
12+
String clientSecret,
13+
boolean skipAudienceValidation) {
1514
@Override
1615
public String toString() {
1716
return "OpenIDConfiguration{" +

‎felles/oidc/src/main/java/no/nav/vedtak/sikkerhet/oidc/config/OpenIDProvider.java

+1-3
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,7 @@
11
package no.nav.vedtak.sikkerhet.oidc.config;
22

33
public enum OpenIDProvider {
4-
ISSO,
54
STS,
65
AZUREAD,
7-
TOKENX,
8-
IDPORTEN
6+
TOKENX
97
}

‎felles/oidc/src/main/java/no/nav/vedtak/sikkerhet/oidc/config/impl/OidcProviderConfig.java

+10-60
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,5 @@
11
package no.nav.vedtak.sikkerhet.oidc.config.impl;
22

3-
import static no.nav.vedtak.sikkerhet.oidc.config.impl.WellKnownConfigurationHelper.getAuthorizationEndpointFra;
43
import static no.nav.vedtak.sikkerhet.oidc.config.impl.WellKnownConfigurationHelper.getIssuerFra;
54
import static no.nav.vedtak.sikkerhet.oidc.config.impl.WellKnownConfigurationHelper.getJwksFra;
65
import static no.nav.vedtak.sikkerhet.oidc.config.impl.WellKnownConfigurationHelper.getTokenEndpointFra;
@@ -26,24 +25,16 @@ public final class OidcProviderConfig {
2625
private static final Environment ENV = Environment.current();
2726
private static final Logger LOG = LoggerFactory.getLogger(OidcProviderConfig.class);
2827

29-
public static final String OPEN_AM_WELL_KNOWN_URL = "oidc.open.am.well.known.url";
30-
private static final String OPEN_AM_CONFIG_ISSUER = "oidc.open.am.openid.config.issuer";
31-
private static final String OPEN_AM_CONFIG_JWKS_URI = "oidc.open.am.openid.config.jwks.uri";
32-
private static final String OPEN_AM_CONFIG_TOKEN_ENDPOINT = "oidc.open.am.openid.config.token.endpoint";
33-
private static final String OPEN_AM_CONFIG_AUTH_ENDPOINT = "oidc.open.am.openid.config.authorization.endpoint";
34-
public static final String OPEN_AM_CLIENT_ID = "oidc.open.am.client.id";
35-
public static final String OPEN_AM_CLIENT_SECRET = "oidc.open.am.client.secret";
36-
3728
private static final String STS_WELL_KNOWN_URL = "oidc.sts.well.known.url";
3829
private static final String STS_CONFIG_ISSUER = "oidc.sts.openid.config.issuer";
3930
private static final String STS_CONFIG_JWKS_URI = "oidc.sts.openid.config.jwks.uri";
4031
private static final String STS_CONFIG_TOKEN_ENDPOINT = "oidc.sts.openid.config.token.endpoint";
4132

42-
private static final String AZURE_WELL_KNOWN_URL = "azure.app.well.known.url"; // naiserator
43-
private static final String AZURE_CONFIG_ISSUER = "azure.openid.config.issuer"; // naiserator
44-
private static final String AZURE_CONFIG_JWKS_URI = "azure.openid.config.jwks.uri"; // naiserator
33+
public static final String AZURE_WELL_KNOWN_URL = "azure.app.well.known.url"; // naiserator
34+
public static final String AZURE_CONFIG_ISSUER = "azure.openid.config.issuer"; // naiserator
35+
public static final String AZURE_CONFIG_JWKS_URI = "azure.openid.config.jwks.uri"; // naiserator
4536
private static final String AZURE_CONFIG_TOKEN_ENDPOINT = "azure.openid.config.token.endpoint"; // naiserator
46-
private static final String AZURE_CLIENT_ID = "azure.app.client.id"; // naiserator
37+
public static final String AZURE_CLIENT_ID = "azure.app.client.id"; // naiserator
4738
private static final String AZURE_CLIENT_SECRET = "azure.app.client.secret"; // naiserator
4839
private static final String AZURE_HTTP_PROXY = "azure.http.proxy"; // settes ikke av naiserator
4940

@@ -97,15 +88,12 @@ private static synchronized Set<OpenIDConfiguration> init() {
9788
private static Set<OpenIDConfiguration> hentConfig() {
9889
Set<OpenIDConfiguration> idProviderConfigs = new HashSet<>();
9990

100-
// OpenAM
101-
idProviderConfigs.add(createOpenAmConfiguration(ENV.getProperty(OPEN_AM_WELL_KNOWN_URL)));
102-
10391
// OIDC STS
104-
if (ENV.getProperty(STS_WELL_KNOWN_URL) != null || ENV.getProperty("oidc.sts.issuer.url") != null || ENV.getProperty(STS_CONFIG_ISSUER) != null) { // Det er kanskje noen apper som ikke bruker STS token validering??
92+
if (ENV.getProperty(STS_WELL_KNOWN_URL) != null || ENV.getProperty(STS_CONFIG_ISSUER) != null) { // Det er kanskje noen apper som ikke bruker STS token validering??
10593
idProviderConfigs.add(createStsConfiguration(ENV.getProperty(STS_WELL_KNOWN_URL)));
10694
}
10795

108-
// Azure
96+
// Azure - ikke alle apps trenger denne (tokenx-apps)
10997
var azureKonfigUrl = ENV.getProperty(AZURE_WELL_KNOWN_URL);
11098
if (azureKonfigUrl != null) {
11199
LOG.debug("Oppretter AzureAD konfig fra '{}'", azureKonfigUrl);
@@ -127,52 +115,20 @@ private static Set<OpenIDConfiguration> hentConfig() {
127115
return idProviderConfigs;
128116
}
129117

130-
private static OpenIDConfiguration createOpenAmConfiguration(String wellKnownUrl) {
131-
return createConfiguration(OpenIDProvider.ISSO,
132-
Optional.ofNullable(ENV.getProperty(OPEN_AM_CONFIG_ISSUER))
133-
.or(() -> getIssuerFra(wellKnownUrl))
134-
.orElseGet(OpenAmProperties::getIssoIssuerUrl),
135-
Optional.ofNullable(ENV.getProperty(OPEN_AM_CONFIG_JWKS_URI))
136-
.or(() -> getJwksFra(wellKnownUrl))
137-
.orElseGet(OpenAmProperties::getIssoJwksUrl),
138-
Optional.ofNullable(ENV.getProperty(OPEN_AM_CONFIG_TOKEN_ENDPOINT))
139-
.or(() -> getTokenEndpointFra(wellKnownUrl))
140-
.orElseGet(OpenAmProperties::getIssoTokenUrl),
141-
Optional.ofNullable(ENV.getProperty(OPEN_AM_CONFIG_AUTH_ENDPOINT))
142-
.or(() -> getAuthorizationEndpointFra(wellKnownUrl))
143-
.orElseGet(OpenAmProperties::getIssoAuthUrl),
144-
false, null,
145-
Optional.ofNullable(ENV.getProperty(OPEN_AM_CLIENT_ID))
146-
.orElseGet(OpenAmProperties::getIssoUserName),
147-
Optional.ofNullable(ENV.getProperty(OPEN_AM_CLIENT_SECRET))
148-
.orElseGet(OpenAmProperties::getIssoPassword),
149-
true);
150-
}
151-
152118
private static OpenIDConfiguration createStsConfiguration(String wellKnownUrl) {
153119
return createConfiguration(OpenIDProvider.STS,
154120
Optional.ofNullable(ENV.getProperty(STS_CONFIG_ISSUER))
155-
.or(() -> getIssuerFra(wellKnownUrl))
156-
.orElseGet(() -> ENV.getProperty("oidc.sts.issuer.url")),
121+
.or(() -> getIssuerFra(wellKnownUrl)).orElse(null),
157122
Optional.ofNullable(ENV.getProperty(STS_CONFIG_JWKS_URI))
158-
.or(() -> getJwksFra(wellKnownUrl))
159-
.orElseGet(() -> ENV.getProperty("oidc.sts.jwks.url")),
123+
.or(() -> getJwksFra(wellKnownUrl)).orElse(null),
160124
Optional.ofNullable(ENV.getProperty(STS_CONFIG_TOKEN_ENDPOINT))
161-
.or(() -> getTokenEndpointFra(wellKnownUrl))
162-
.orElseGet(OidcProviderConfig::tokenEndpointFromLegacySTS),
163-
null,
125+
.or(() -> getTokenEndpointFra(wellKnownUrl)).orElse(null),
164126
false, null,
165127
ENV.getProperty("systembruker.username"),
166-
null,
128+
ENV.getProperty("systembruker.password"),
167129
true);
168130
}
169131

170-
private static String tokenEndpointFromLegacySTS() {
171-
var issuer = ENV.getProperty("oidc.sts.issuer.url");
172-
var endpointpath = Optional.ofNullable(ENV.getProperty("oidc.sts.token.path")).orElse("/rest/v1/sts/token");
173-
return issuer != null ? issuer + endpointpath : null;
174-
}
175-
176132
@SuppressWarnings("unused")
177133
private static OpenIDConfiguration createAzureAppConfiguration(String wellKnownUrl) {
178134
var useProxy = ENV.isLocal() ? null : URI.create(ENV.getProperty(AZURE_HTTP_PROXY, getDefaultProxy()));
@@ -183,9 +139,6 @@ private static OpenIDConfiguration createAzureAppConfiguration(String wellKnownU
183139
.orElseGet(() -> getJwksFra(wellKnownUrl, useProxy).orElse(null)),
184140
Optional.ofNullable(ENV.getProperty(AZURE_CONFIG_TOKEN_ENDPOINT))
185141
.orElseGet(() -> getTokenEndpointFra(wellKnownUrl, useProxy).orElse(null)),
186-
Optional.ofNullable(ENV.getProperty(AZURE_CONFIG_TOKEN_ENDPOINT))
187-
.map(s -> s.replace("/token", "/authorize"))
188-
.orElseGet(() -> getAuthorizationEndpointFra(wellKnownUrl, useProxy).orElse(null)),
189142
!ENV.isLocal(), useProxy,
190143
ENV.getRequiredProperty(AZURE_CLIENT_ID),
191144
ENV.getProperty(AZURE_CLIENT_SECRET),
@@ -197,7 +150,6 @@ private static OpenIDConfiguration createTokenXConfiguration(String wellKnownUrl
197150
getIssuerFra(wellKnownUrl).orElseThrow(),
198151
getJwksFra(wellKnownUrl).orElseThrow(),
199152
getTokenEndpointFra(wellKnownUrl).orElse(null),
200-
getAuthorizationEndpointFra(wellKnownUrl).orElse(null),
201153
false, null,
202154
ENV.getRequiredProperty(TOKEN_X_CLIENT_ID),
203155
null, // Signerer requests med jws
@@ -208,7 +160,6 @@ private static OpenIDConfiguration createConfiguration(OpenIDProvider type,
208160
String issuer,
209161
String jwks,
210162
String tokenEndpoint,
211-
String authorizationEndpoint,
212163
boolean useProxyForJwks,
213164
URI proxy,
214165
String clientName,
@@ -218,7 +169,6 @@ private static OpenIDConfiguration createConfiguration(OpenIDProvider type,
218169
tilURI(issuer, "issuer", type),
219170
tilURI(jwks, "jwksUri", type),
220171
tokenEndpoint != null ? tilURI(tokenEndpoint, "tokenEndpoint", type) : null,
221-
authorizationEndpoint != null ? tilURI(authorizationEndpoint, "authorizationEndpoint", type) : null,
222172
useProxyForJwks,
223173
proxy,
224174
Objects.requireNonNull(clientName),

‎felles/oidc/src/main/java/no/nav/vedtak/sikkerhet/oidc/config/impl/OpenAmProperties.java

-69
This file was deleted.

‎felles/oidc/src/main/java/no/nav/vedtak/sikkerhet/oidc/config/impl/WellKnownConfigurationHelper.java

+2-9
Original file line numberDiff line numberDiff line change
@@ -28,7 +28,8 @@ public class WellKnownConfigurationHelper {
2828
private static final Logger LOG = LoggerFactory.getLogger(WellKnownConfigurationHelper.class);
2929
private static final Environment ENV = Environment.current();
3030
private static final ObjectReader READER = DefaultJsonMapper.getObjectMapper().readerFor(WellKnownOpenIdConfiguration.class);
31-
private static final String STANDARD_WELL_KNOWN_PATH = ".well-known/openid-configuration";
31+
32+
public static final String STANDARD_WELL_KNOWN_PATH = ".well-known/openid-configuration";
3233

3334
private static Map<String, WellKnownOpenIdConfiguration> wellKnownConfigMap = Collections.synchronizedMap(new LinkedHashMap<>());
3435

@@ -67,14 +68,6 @@ static Optional<String> getTokenEndpointFra(String wellKnownURL, URI proxyUrl) {
6768
return Optional.ofNullable(wellKnownURL).map(u -> getWellKnownConfig(u, proxyUrl).token_endpoint());
6869
}
6970

70-
static Optional<String> getAuthorizationEndpointFra(String wellKnownURL) {
71-
return Optional.ofNullable(wellKnownURL).map(u -> getWellKnownConfig(u, null).authorization_endpoint());
72-
}
73-
74-
static Optional<String> getAuthorizationEndpointFra(String wellKnownURL, URI proxyUrl) {
75-
return Optional.ofNullable(wellKnownURL).map(u -> getWellKnownConfig(u, proxyUrl).authorization_endpoint());
76-
}
77-
7871
private static WellKnownOpenIdConfiguration hentWellKnownConfig(String wellKnownURL, URI proxy) {
7972
try {
8073
if (wellKnownURL == null) return null;

‎felles/oidc/src/main/java/no/nav/vedtak/sikkerhet/oidc/config/impl/WellKnownOpenIdConfiguration.java

+1-2
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,6 @@
66
*/
77
public record WellKnownOpenIdConfiguration(String issuer,
88
String jwks_uri,
9-
String token_endpoint,
10-
String authorization_endpoint) {
9+
String token_endpoint) {
1110

1211
}

‎felles/oidc/src/main/java/no/nav/vedtak/sikkerhet/oidc/token/OpenIDToken.java

+3-17
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,6 @@ public record OpenIDToken(OpenIDProvider provider,
1111
String tokenType,
1212
TokenString primary,
1313
String scope,
14-
TokenString refresh,
1514
long expiresAtMillis) {
1615

1716
public static final String OIDC_DEFAULT_TOKEN_TYPE = "Bearer ";
@@ -21,24 +20,15 @@ public record OpenIDToken(OpenIDProvider provider,
2120
private static final int BUFFER = 120;
2221

2322
public OpenIDToken(OpenIDProvider provider, TokenString token) {
24-
this(provider, OIDC_DEFAULT_TOKEN_TYPE, token, null, null,System.currentTimeMillis() + (150 * MILLIS));
23+
this(provider, OIDC_DEFAULT_TOKEN_TYPE, token, null, System.currentTimeMillis() + (150 * MILLIS));
2524
}
2625

2726
public OpenIDToken(OpenIDProvider provider,
2827
String tokenType,
2928
TokenString primary,
3029
String scope,
3130
Integer expireIn) {
32-
this(provider, tokenType, primary, scope, null, expireIn);
33-
}
34-
35-
public OpenIDToken(OpenIDProvider provider,
36-
String tokenType,
37-
TokenString primary,
38-
String scope,
39-
TokenString refresh,
40-
Integer expireIn) {
41-
this(provider, tokenType, primary, scope, refresh, expireAtFromExpireIn(expireIn));
31+
this(provider, tokenType, primary, scope, expireAtFromExpireIn(expireIn));
4232
}
4333

4434
public boolean isNotExpired() {
@@ -50,17 +40,13 @@ public LocalDateTime expiresAt() {
5040
}
5141

5242
public OpenIDToken copy() {
53-
return new OpenIDToken(provider(), tokenType(), primary(), scope(), this.refresh(), expiresAtMillis());
43+
return new OpenIDToken(provider(), tokenType(), primary(), scope(), expiresAtMillis());
5444
}
5545

5646
public String token() {
5747
return primary().token();
5848
}
5949

60-
public Optional<String> refreshToken() {
61-
return Optional.ofNullable(this.refresh()).map(TokenString::token);
62-
}
63-
6450
@Override
6551
public String toString() {
6652
return "OpenIDToken{" +

‎felles/oidc/src/main/java/no/nav/vedtak/sikkerhet/oidc/token/impl/AzureSystemTokenKlient.java

+4-1
Original file line numberDiff line numberDiff line change
@@ -82,7 +82,10 @@ private static OidcTokenResponse hentAccessToken(String clientId, String clientS
8282

8383
private static HttpRequest.BodyPublisher ofFormData(String clientId, String clientSecret, String scope) {
8484
var encodedScope = URLEncoder.encode(scope, UTF_8);
85-
var formdata = "grant_type=client_credentials&client_id=" + clientId + "&client_secret=" + clientSecret + "&scope=" + encodedScope;
85+
var formdata = "grant_type=client_credentials"
86+
+ "&client_id=" + clientId
87+
+ "&client_secret=" + clientSecret
88+
+ "&scope=" + encodedScope;
8689
return HttpRequest.BodyPublishers.ofString(formdata, UTF_8);
8790
}
8891

0 commit comments

Comments
 (0)