Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

JWT Headers security module #7899

Merged
merged 8 commits into from
Dec 11, 2024
Merged

JWT Headers security module #7899

merged 8 commits into from
Dec 11, 2024

Conversation

davidblasby
Copy link
Contributor

WIP - in progress. Added PR for early review. Test coverage is about 90%.

This is a new Security Module - that follows the GeoServer JWT Header security module so they can be used in exactly the same manner.

See the added docs for more details.

This relies on a shared module with GS - I expect this will take a little bit to become available.

org.geoserver.community.jwt-headers jwt-headers-util 2.25-SNAPSHOT

The GeoServer module is broken into two parts - a shared part (jwt-headers-util) and a Geoserver-specific module (jwt-headers-gs).

Checklist

  • I have read the contribution guidelines
  • Pull request provided for main branch, backports managed with label
  • Good housekeeping of code, cleaning up comments, tests, and documentation
  • Clean commit history broken into understandable chucks, avoiding big commits with hundreds of files, cautious of reformatting and whitespace changes
  • Clean commit messages, longer verbose messages are encouraged
  • API Changes are identified in commit messages
  • Testing provided for features or enhancements using automatic tests
  • User documentation provided for new features or enhancements in manual
  • Build documentation provided for development instructions in README.md files
  • Library management using pom.xml dependency management. Update build documentation with intended library use and library tutorials or documentation

@davidblasby
Copy link
Contributor Author

I GS went to v26, I need to update the dependencies and makes sure the GS PR is merged.

josegar74
josegar74 reviewed Mar 26, 2024
View reviewed changes
core/pom.xml Outdated
<dependency>
<groupId>com.jayway.jsonpath</groupId>
<artifactId>json-path</artifactId>
<version>2.4.0</version>
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I see json-path is used in services also. Please move the dependency with the version in both modules to the root pom and remove the version in the modules.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

moved

docs/manual/docs/administrator-guide/managing-users-and-groups/authentication-mode.md Outdated
@@ -818,6 +819,233 @@ sample:RegisteredUser

A similar setup is described for geoserver in the [geoserver documentation](https://docs.geoserver.org/latest/en/user/community/keycloak/index.html).

## Configurating JWT/JSON Headers {#jwt-headers}

The JWT Headers module provides a security module for header based security. It is equivalent to GeoServer's JWT Headers Module (both GeoServer and GeoNetwork share a code library to make them equivelent).
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
The JWT Headers module provides a security module for header based security. It is equivalent to GeoServer's JWT Headers Module (both GeoServer and GeoNetwork share a code library to make them equivelent).
The JWT Headers module provides a security module for header based security. It is equivalent to GeoServer's JWT Headers Module (both GeoServer and GeoNetwork share a code library to make them equivalent).

docs/manual/docs/administrator-guide/managing-users-and-groups/authentication-mode.md Outdated
#### Role Conversion


The JWT Headers module also allows for converting roles (from the external IDP) to the GeoServer internal role names.
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
The JWT Headers module also allows for converting roles (from the external IDP) to the GeoServer internal role names.
The JWT Headers module also allows for converting roles (from the external IDP) to the GeoNetwork internal role names.

docs/manual/docs/administrator-guide/managing-users-and-groups/authentication-mode.md Outdated

| Environment Variable | Meaning |
| ------------- | ------- |
|JWTHEADERS_RoleConverterString| Role Converter Map from External Roles to Geoserver Roles. <br> This is a ";" delimited map in the form of: <br> `ExternalRole1=GeoServerRole1;ExternalRole2=GeoServerRole2`|
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
|JWTHEADERS_RoleConverterString| Role Converter Map from External Roles to Geoserver Roles. <br> This is a ";" delimited map in the form of: <br> `ExternalRole1=GeoServerRole1;ExternalRole2=GeoServerRole2`|
|JWTHEADERS_RoleConverterString| Role Converter Map from External Roles to GeoNetwork Roles. <br> This is a ";" delimited map in the form of: <br> `ExternalRole1=GeoNetworkrRole1;ExternalRole2=GeoNetworkRole2`|

docs/manual/docs/administrator-guide/managing-users-and-groups/authentication-mode.md Outdated

If you are using Apache's `mod_auth_openidc` module, then you do *not* have to do JWT validation - Apache will ensure they are valid when it attaches the headers to the request.

However, if you are using robot access to GeoServer, you can attach an Access Token to the request header for access.
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
However, if you are using robot access to GeoServer, you can attach an Access Token to the request header for access.
However, if you are using robot access to GeoNetwork, you can attach an Access Token to the request header for access.

docs/manual/docs/administrator-guide/managing-users-and-groups/authentication-mode.md Outdated

1. Get the username from an Apache-provided `OIDC_*` header (either as simple-strings or as a component of a JSON object).
2. Get the user's roles from an Apache-provided `OIDC_*` header (as a component of a JSON object).
3. The user's roles can also be from any of the standard GeoServer providers (i.e. User Group Service, Role Service, or Request Header).
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
3. The user's roles can also be from any of the standard GeoServer providers (i.e. User Group Service, Role Service, or Request Header).
3. The user's roles can also be from any of the standard GeoNetwork providers (i.e. User Group Service, Role Service, or Request Header).

docs/manual/docs/administrator-guide/managing-users-and-groups/authentication-mode.md Outdated
* Validate the token against a token verifier URL ("userinfo_endpoint") and check that subjects match
* Validate components of the Access Token (like [aud (audience)](https://auth0.com/docs/secure/tokens/json-web-tokens/json-web-token-claims>))

4. The user's roles can also be from any of the standard GeoServer providers (i.e. User Group Service, Role Service, or Request Header).
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
4. The user's roles can also be from any of the standard GeoServer providers (i.e. User Group Service, Role Service, or Request Header).
4. The user's roles can also be from any of the standard GeoNetwork providers (i.e. User Group Service, Role Service, or Request Header).

@davidblasby
Copy link
Contributor Author

I've made changes based on jose's review.
This will not build until a GS PR is merged (geoserver/geoserver#7512).

@CLAassistant
Copy link

CLA assistant check
Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
You have signed the CLA already but the status is still pending? Let us recheck it.

@fxprunayre
Copy link
Member

Works fine with GeoNetwork 5 geonetwork/geonetwork#77

@fxprunayre fxprunayre mentioned this pull request Dec 10, 2024
Closed
10 tasks
@fxprunayre fxprunayre added this to the 4.4.7 milestone Dec 10, 2024
@davidblasby davidblasby merged commit 4fbdefd into geonetwork:main Dec 11, 2024
7 checks passed
fxprunayre added a commit that referenced this pull request Dec 12, 2024
@fxprunayre
GN5 / Security configuration
5fea3bc 
Security configuration for GeoNetwork 4 deployed behing GeoNetwork 5
prototype using simple mode (ie. GN4 MUST not be exposed to intranet and
internet).

Authentication is managed by version 5 which check user credentials and
create user in the database if needed. Then a JWT token is added to a
header that version 4 checks.

Related to:
* JWT headers support #7899
* GeoNetwork 5 auth geonetwork/geonetwork#77

To enable the configuration, use:

```sh
mvn jetty:run -Dgeonetwork.security.type=gn5
```
@fxprunayre fxprunayre mentioned this pull request Dec 12, 2024
Draft
10 tasks
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@josegar74 josegar74 josegar74 left review comments

Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
4.4.7
Development

Successfully merging this pull request may close these issues.
5 participants
@davidblasby @CLAassistant @fxprunayre @josegar74 @david-blasby