Changeset 7267

Timestamp:

01/05/22 22:27:38 (2 years ago)

Author:

Oliver Schonefeld

Message:

• experimental basic support for FCS authentication

Location:

FCSSimpleEndpoint/trunk

Files:

• pom.xml (modified) (2 diffs)
• src/main/java/eu/clarin/sru/server/fcs/SimpleEndpointSearchEngineBase.java (modified) (6 diffs)
• src/main/java/eu/clarin/sru/server/fcs/utils/AuthenticationProvider.java (added)

FCSSimpleEndpoint/trunk/pom.xml

@@ -30 +30 @@
 
         <dependency>
+          <groupId>org.bouncycastle</groupId>
+          <artifactId>bcprov-ext-jdk15on</artifactId>
+          <version>1.70</version>
+        </dependency>
+
+        <dependency>
+            <groupId>com.auth0</groupId>
+            <artifactId>java-jwt</artifactId>
+            <version>3.18.2</version>
+        </dependency>
+
+        <dependency>
             <groupId>javax.servlet</groupId>
             <artifactId>servlet-api</artifactId>
@@ -40 +52 @@
             <groupId>eu.clarin.sru</groupId>
             <artifactId>sru-server</artifactId>
-            <version>1.8.0</version>
+            <version>1.10.0-SNAPSHOT</version>
         </dependency>
 

FCSSimpleEndpoint/trunk/src/main/java/eu/clarin/sru/server/fcs/SimpleEndpointSearchEngineBase.java

@@ -17 +17 @@
 package eu.clarin.sru.server.fcs;
 
+import java.io.File;
+import java.io.InputStream;
 import java.net.URI;
 import java.util.List;
 import java.util.Map;
+import java.util.Map.Entry;
 
 import javax.servlet.ServletContext;
@@ -30 +33 @@
 import org.z3950.zing.cql.CQLNode;
 import org.z3950.zing.cql.CQLTermNode;
+
+import eu.clarin.sru.server.SRUAuthenticationInfoProvider;
 import eu.clarin.sru.server.SRUConfigException;
 import eu.clarin.sru.server.SRUConstants;
@@ -41 +46 @@
 import eu.clarin.sru.server.SRUServer;
 import eu.clarin.sru.server.SRUServerConfig;
+import eu.clarin.sru.server.fcs.utils.AuthenticationProvider;
+import eu.clarin.sru.server.utils.SRUAuthenticationInfoProviderFactory;
 import eu.clarin.sru.server.utils.SRUSearchEngineBase;
 
@@ -50 +57 @@
  */
 public abstract class SimpleEndpointSearchEngineBase extends
-        SRUSearchEngineBase {
+        SRUSearchEngineBase implements SRUAuthenticationInfoProviderFactory {
+    public static final String FCS_AUTHENTICATION_ENABLE_PARAM =
+            "eu.clarin.sru.server.fcs.authentication.enable";
+    public static final String FCS_AUTHENTICATION_AUDIENCE_PARAM =
+            "eu.clarin.sru.server.fcs.authentication.audience";
+    public static final String FCS_AUTHENTICATION_IGNORE_ISSUEDAT_PARAM =
+            "eu.clarin.sru.server.fcs.authentication.ignoreIssuedAt";
+    public static final String FCS_AUTHENTICATION_ACCEPT_ISSUEDAT_PARAM =
+            "eu.clarin.sru.server.fcs.authentication.acceptIssuedAt";
+    public static final String FCS_AUTHENTICATION_ACCEPT_EXPIRESAT_PARAM =
+            "eu.clarin.sru.server.fcs.authentication.acceptExpiresAt";
+    public static final String FCS_AUTHENTICATION_ACCEPT_NOTBEFORE_PARAM =
+            "eu.clarin.sru.server.fcs.authentication.acceptNotBefore";
+    public static final String FCS_AUTHENTICATION_PUBLIC_KEY_PARAM_PREFIX =
+            "eu.clarin.sru.server.fcs.authentication.key.";
+    private static final String RESOURCE_URI_PREFIX = "resource:";
     private static final String X_FCS_ENDPOINT_DESCRIPTION =
             "x-fcs-endpoint-description";
@@ -108 +130 @@
         doDestroy();
         super.destroy();
+    }
+
+
+    @Override
+    public SRUAuthenticationInfoProvider createAuthenticationInfoProvider(
+            ServletContext context, Map<String, String> params)
+            throws SRUConfigException {
+        String enableAuthentication = params.get(FCS_AUTHENTICATION_ENABLE_PARAM);
+        if (enableAuthentication != null) {
+            if (parseBoolean(enableAuthentication)) {
+                logger.debug("enabling authentication");                
+                AuthenticationProvider.Builder builder =
+                        AuthenticationProvider.Builder.create();
+                
+                String audience = params.get(FCS_AUTHENTICATION_AUDIENCE_PARAM);
+                if (audience != null) {
+                    String[] values = audience.split("\\s*,\\s*");
+                    if (values != null) {
+                        for (String value : values) {
+                            logger.debug("adding audience: {}", value);
+                            builder.withAudience(value);
+                        }
+                    } else {
+                        logger.debug("adding audience: {}", audience);
+                        builder.withAudience(audience);
+                    }
+                }
+                
+                boolean ignoreIssuedAt = parseBoolean(
+                        params.get(FCS_AUTHENTICATION_IGNORE_ISSUEDAT_PARAM));
+                if (ignoreIssuedAt) {
+                    logger.debug("will not verify 'iat' claim");
+                    builder.withIgnoreIssuedAt();
+                } else {
+                    long issuedAtLeeway = parseLong(
+                            params.get(FCS_AUTHENTICATION_ACCEPT_ISSUEDAT_PARAM), -1);
+                    if (issuedAtLeeway > 0) {
+                        logger.debug("allowing {} seconds leeway for 'iat' claim", issuedAtLeeway);
+                        builder.withIssuedAt(issuedAtLeeway);
+                    }
+                }
+                long expiresAtLeeway = parseLong(
+                        params.get(FCS_AUTHENTICATION_ACCEPT_EXPIRESAT_PARAM), -1);
+                if (expiresAtLeeway > 0) {
+                    logger.debug("allowing {} seconds leeway for 'exp' claim", expiresAtLeeway);
+                    builder.withExpiresAt(expiresAtLeeway);
+                }
+                
+                long notBeforeLeeway = parseLong(
+                        params.get(FCS_AUTHENTICATION_ACCEPT_NOTBEFORE_PARAM), -1);
+                if (notBeforeLeeway > 0) {
+                    logger.debug("allowing {} seconds leeway for 'nbf' claim", expiresAtLeeway);
+                    builder.withNotBefore(notBeforeLeeway);
+                }
+
+                // load keys
+                for (Entry<String, String> entry : params.entrySet()) {
+                    if (entry.getKey().startsWith(FCS_AUTHENTICATION_PUBLIC_KEY_PARAM_PREFIX)) {
+                        String keyId = entry.getKey().substring(FCS_AUTHENTICATION_PUBLIC_KEY_PARAM_PREFIX.length()).trim();
+                        if (keyId.isEmpty()) {
+                            throw new SRUConfigException("init-parameter: '" + entry.getKey() + "' is invalid: keyId is empty!");
+                        }
+                        String keyFileName = entry.getValue();
+                        logger.debug("keyId = {}, keyFile = {}", keyId, keyFileName);
+                        if (keyFileName.regionMatches(0, RESOURCE_URI_PREFIX, 0, RESOURCE_URI_PREFIX.length())) {
+                            String path = keyFileName.substring(RESOURCE_URI_PREFIX.length());
+                            logger.debug("loading key '{}' from resource '{}'", keyId, keyFileName);
+                            InputStream in = context.getResourceAsStream(path);
+                            builder.withPublicKey(keyId, in);
+                        } else {
+                            logger.debug("loading key '{}' from file '{}'", keyId, keyFileName);
+                            builder.withPublicKey(keyId, new File(keyFileName));
+                        }
+                    }
+                }
+                AuthenticationProvider authenticationProvider = builder.build();
+                if (authenticationProvider.getKeyCount() == 0) {
+                    logger.warn("No keys configured, all well-formed tokens will be accepted. Make sure, youn know what you are doing!");
+                }
+                return authenticationProvider;
+            } else {
+                logger.debug("explictly disable authentication");
+            }
+        }
+        return null;
     }
 
@@ -251 +358 @@
 
 
+    private long parseLong(String value, long defaultValue) throws SRUConfigException {
+        if (value != null) {
+            try {
+                return Long.parseLong(value);
+            } catch (NumberFormatException e) {
+                throw new SRUConfigException("invalid long value");
+            }
+        }
+        return defaultValue;
+    }
+    
+    
     private void writeEndpointDescription(XMLStreamWriter writer)
             throws XMLStreamException {