-
Notifications
You must be signed in to change notification settings - Fork 572
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
[incubator-kie-issues-994] kafka auth feature with message header rec…
…ords (#3037) * integration java-jwt for kafka and inmemory thing * add security and integration check with RSA * keystore helpers
- Loading branch information
1 parent
a686d1d
commit 16a50c2
Showing
16 changed files
with
478 additions
and
25 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
39 changes: 39 additions & 0 deletions
39
...mmon/src/main/java/org/kie/server/services/impl/security/adapters/JwtSecurityAdaptor.java
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,39 @@ | ||
| package org.kie.server.services.impl.security.adapters; | ||
|
|
||
| import java.util.List; | ||
|
|
||
| import org.kie.server.api.security.SecurityAdapter; | ||
| import org.kie.server.services.impl.util.JwtUserDetails; | ||
|
|
||
| public class JwtSecurityAdaptor implements SecurityAdapter { | ||
|
|
||
| private static ThreadLocal<JwtUserDetails> threadLocal = new ThreadLocal<JwtUserDetails>() { | ||
| @Override | ||
| public JwtUserDetails initialValue() { | ||
| return new JwtUserDetails(); | ||
| } | ||
| }; | ||
|
|
||
| public static void login(JwtUserDetails userDetails) { | ||
| threadLocal.set(userDetails); | ||
| } | ||
|
|
||
| @Override | ||
| public String getUser(Object... params) { | ||
| JwtUserDetails userDetails = threadLocal.get(); | ||
| if (!userDetails.isLogged()) { | ||
| return null; | ||
| } | ||
| return userDetails.getUser(); | ||
| } | ||
|
|
||
| @Override | ||
| public List<String> getRoles(Object... params) { | ||
| return threadLocal.get().getRoles(); | ||
| } | ||
|
|
||
| public static void logout() { | ||
| threadLocal.set(null); | ||
| } | ||
|
|
||
| } |
106 changes: 106 additions & 0 deletions
106
...ie-server-services-common/src/main/java/org/kie/server/services/impl/util/JwtService.java
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,106 @@ | ||
| /* | ||
| * Copyright 2024 Red Hat, Inc. and/or its affiliates. | ||
| * | ||
| * Licensed under the Apache License, Version 2.0 (the "License"); | ||
| * you may not use this file except in compliance with the License. | ||
| * | ||
| * http://www.apache.org/licenses/LICENSE-2.0 | ||
| * | ||
| * Unless required by applicable law or agreed to in writing, software | ||
| * distributed under the License is distributed on an "AS IS" BASIS, | ||
| * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. | ||
| * See the License for the specific language governing permissions and | ||
| * limitations under the License. | ||
| */ | ||
|
|
||
| package org.kie.server.services.impl.util; | ||
|
|
||
| import java.security.KeyPair; | ||
| import java.security.interfaces.RSAPrivateKey; | ||
| import java.security.interfaces.RSAPublicKey; | ||
| import java.util.ArrayList; | ||
| import java.util.Arrays; | ||
| import java.util.List; | ||
|
|
||
| import com.auth0.jwt.JWT; | ||
| import com.auth0.jwt.algorithms.Algorithm; | ||
| import com.auth0.jwt.exceptions.JWTVerificationException; | ||
| import com.auth0.jwt.interfaces.Claim; | ||
| import com.auth0.jwt.interfaces.DecodedJWT; | ||
| import com.auth0.jwt.interfaces.JWTVerifier; | ||
|
|
||
| public class JwtService { | ||
|
|
||
| private JWTVerifier verifier; | ||
|
|
||
| private Algorithm algorithm; | ||
| private String issuer; | ||
|
|
||
| private JwtService() { | ||
| this(Algorithm.none()); | ||
| } | ||
|
|
||
| private JwtService(Algorithm algorithm) { | ||
| this(algorithm, "jBPM"); | ||
| } | ||
|
|
||
| private JwtService(Algorithm algorithm, String issuer) { | ||
| this.issuer = issuer; | ||
| this.algorithm = algorithm; | ||
| this.verifier = JWT.require(algorithm) | ||
| .withIssuer(issuer) | ||
| .build(); | ||
| } | ||
|
|
||
| public String getIssuer() { | ||
| return issuer; | ||
| } | ||
|
|
||
| public String token(String user, String... roles) { | ||
| return JWT.create().withIssuer(this.issuer).withSubject(user).withClaim("roles", Arrays.asList(roles)).sign(algorithm); | ||
| } | ||
|
|
||
| public static JwtServiceBuilder newJwtServiceBuilder() { | ||
| return new JwtServiceBuilder(); | ||
| } | ||
|
|
||
| public static class JwtServiceBuilder { | ||
| Algorithm algorithm; | ||
| String issuer; | ||
|
|
||
| public JwtServiceBuilder keys(RSAPublicKey publicKey, RSAPrivateKey privateKey) { | ||
| this.algorithm = Algorithm.RSA256(publicKey, privateKey); | ||
| return this; | ||
| } | ||
|
|
||
| public JwtServiceBuilder issuer(String issuer) { | ||
| this.issuer = issuer; | ||
| return this; | ||
| } | ||
|
|
||
| public JwtService build() { | ||
| return new JwtService(algorithm != null ? algorithm : Algorithm.none(), issuer != null ? issuer : "jBPM"); | ||
| } | ||
|
|
||
| public JwtServiceBuilder keyPair(KeyPair keyPair) { | ||
| if (keyPair != null) { | ||
| this.algorithm = Algorithm.RSA256((RSAPublicKey) keyPair.getPublic(), (RSAPrivateKey) keyPair.getPrivate()); | ||
| } | ||
| return this; | ||
| } | ||
|
|
||
| } | ||
|
|
||
| public JwtUserDetails decodeUserDetails(String token) { | ||
| try { | ||
| DecodedJWT decodedJWT = verifier.verify(token); | ||
| String user = decodedJWT.getSubject(); | ||
| Claim rolesClaim = decodedJWT.getClaim("roles"); | ||
| List<String> roles = rolesClaim.asList(String.class); | ||
| return new JwtUserDetails(user, roles != null ? roles : new ArrayList<>()); | ||
| } catch (JWTVerificationException exception) { | ||
| throw new IllegalArgumentException(exception); | ||
| } | ||
| } | ||
|
|
||
| } |
Oops, something went wrong.