Skip to content

Commit

Permalink
Bruk Azure som default (#1258)
Browse files Browse the repository at this point in the history 
* Bruk Azure som default

* Dropp auditlogg av systembrukerkall
  • Loading branch information
@jolarsen
jolarsen authored Mar 8, 2023
1 parent 476b4c6 commit 893274c
Show file tree
Hide file tree
Showing 6 changed files with 34 additions and 21 deletions.
23 changes: 20 additions & 3 deletions felles/abac/src/main/java/no/nav/vedtak/sikkerhet/abac/BeskyttetRessursInterceptor.java
View file
Original file line number Diff line number Diff line change
Expand Up @@ -3,6 +3,7 @@
import java.lang.reflect.InvocationTargetException;
import java.lang.reflect.Method;
import java.util.Collection;
import java.util.Optional;

import javax.annotation.Priority;
import javax.enterprise.context.Dependent;
Expand All @@ -12,6 +13,8 @@
import javax.interceptor.InvocationContext;

import org.jboss.weld.interceptor.util.proxy.TargetInstanceProxy;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;

import no.nav.foreldrepenger.konfig.Environment;
import no.nav.vedtak.exception.TekniskException;
Expand All @@ -20,16 +23,19 @@
import no.nav.vedtak.sikkerhet.abac.beskyttet.ServiceType;
import no.nav.vedtak.sikkerhet.abac.internal.ActionUthenter;
import no.nav.vedtak.sikkerhet.abac.internal.BeskyttetRessursAttributter;
import no.nav.vedtak.sikkerhet.kontekst.IdentType;

@BeskyttetRessurs(actionType = ActionType.DUMMY, resource = "")
@Interceptor
@Priority(Interceptor.Priority.APPLICATION + 11)
@Dependent
public class BeskyttetRessursInterceptor {

private static final Environment ENV = Environment.current();
private static final Logger LOG = LoggerFactory.getLogger(BeskyttetRessursInterceptor.class);

private final Pep pep;
private final AbacAuditlogger abacAuditlogger;
private static final Environment ENV = Environment.current();
private final TokenProvider tokenProvider;

@Inject
Expand All @@ -53,7 +59,7 @@ public Object wrapTransaction(final InvocationContext invocationContext) throws
private Object proceed(InvocationContext invocationContext, Tilgangsbeslutning beslutning) throws Exception {
Method method = invocationContext.getMethod();
boolean sporingslogges = method.getAnnotation(BeskyttetRessurs.class).sporingslogg();
if (sporingslogges) {
if (!erSystembrukerKall(beslutning.beskyttetRessursAttributter()) && sporingslogges) {
Object resultat = invocationContext.proceed();
abacAuditlogger.loggTilgang(tokenProvider.getUid(), beslutning);
return resultat;
Expand All @@ -62,7 +68,11 @@ private Object proceed(InvocationContext invocationContext, Tilgangsbeslutning b
}

private Object ikkeTilgang(Tilgangsbeslutning beslutning) {
abacAuditlogger.loggDeny(tokenProvider.getUid(), beslutning);
if (!erSystembrukerKall(beslutning.beskyttetRessursAttributter())) {
abacAuditlogger.loggDeny(tokenProvider.getUid(), beslutning);
} else {
LOG.info("ABAC AVSLAG SYSTEMBRUKER {}", beslutning.beskyttetRessursAttributter().getUserId());
}

switch (beslutning.beslutningKode()) {
case AVSLÅTT_KODE_6 -> throw new PepNektetTilgangException("F-709170", "Tilgangskontroll.Avslag.Kode6");
Expand All @@ -72,6 +82,13 @@ private Object ikkeTilgang(Tilgangsbeslutning beslutning) {
}
}

private boolean erSystembrukerKall(BeskyttetRessursAttributter beskyttetRessursAttributter) {
return Optional.ofNullable(beskyttetRessursAttributter)
.map(BeskyttetRessursAttributter::getToken)
.map(Token::getIdentType).orElse(IdentType.InternBruker)
.erSystem();
}

private BeskyttetRessursAttributter hentBeskyttetRessursAttributter(InvocationContext invocationContext,
AbacDataAttributter dataAttributter) {
Class<?> clazz = getOpprinneligKlasse(invocationContext);
Expand Down
6 changes: 1 addition & 5 deletions felles/abac/src/main/java/no/nav/vedtak/sikkerhet/abac/Token.java
View file
Original file line number Diff line number Diff line change
Expand Up @@ -42,16 +42,12 @@ private Token(String token, TokenType tokenType, OpenIDToken openIDToken, String
this.identType = identType;
}

public static Token withOidcToken(OpenIDToken token) {
return new Token(null, utledTokenType(token), token, null, null);
}

public static Token withOidcToken(OpenIDToken token, String brukerId, IdentType identType) {
return new Token(null, utledTokenType(token), token, brukerId, identType);
}

public static Token withSamlToken(String token) {
return new Token(token, TokenType.SAML, null, null, null);
return new Token(token, TokenType.SAML, null, null, IdentType.InternBruker);
}

public TokenType getTokenType() {
Expand Down
4 changes: 2 additions & 2 deletions felles/abac/src/test/java/no/nav/vedtak/sikkerhet/abac/PepImplTest.java
View file
Original file line number Diff line number Diff line change
Expand Up @@ -154,7 +154,7 @@ void skal_kalle_pdp_for_annet_enn_pip_tjenester() {
private BeskyttetRessursAttributter lagBeskyttetRessursAttributter() {
return BeskyttetRessursAttributter.builder()
.medUserId(tokenProvider.getUid())
.medToken(Token.withOidcToken(BeskyttetRessursInterceptorTest.DUMMY_OPENID_TOKEN))
.medToken(Token.withOidcToken(BeskyttetRessursInterceptorTest.DUMMY_OPENID_TOKEN, "TEST", IdentType.InternBruker))
.medResourceType(ForeldrepengerAttributter.RESOURCE_TYPE_FP_FAGSAK)
.medActionType(ActionType.READ)
.medPepId("local-app")
Expand All @@ -167,7 +167,7 @@ private BeskyttetRessursAttributter lagBeskyttetRessursAttributter() {
private BeskyttetRessursAttributter lagBeskyttetRessursAttributterPip() {
return BeskyttetRessursAttributter.builder()
.medUserId(tokenProvider.getUid())
.medToken(Token.withOidcToken(BeskyttetRessursInterceptorTest.DUMMY_OPENID_TOKEN))
.medToken(Token.withOidcToken(BeskyttetRessursInterceptorTest.DUMMY_OPENID_TOKEN, "TEST", IdentType.InternBruker))
.medResourceType(RESOURCE_TYPE_INTERNAL_PIP)
.medActionType(ActionType.READ)
.medPepId("local-app")
Expand Down
18 changes: 9 additions & 9 deletions felles/abac/src/test/java/no/nav/vedtak/sikkerhet/pdp/PdpKlientImplTest.java
View file
Original file line number Diff line number Diff line change
Expand Up @@ -6,7 +6,6 @@
import static org.mockito.Mockito.when;

import java.io.File;
import java.io.FileNotFoundException;
import java.io.IOException;
import java.nio.charset.StandardCharsets;
import java.util.ArrayList;
Expand All @@ -33,6 +32,7 @@
import no.nav.vedtak.sikkerhet.abac.pdp.AppRessursData;
import no.nav.vedtak.sikkerhet.abac.pipdata.PipBehandlingStatus;
import no.nav.vedtak.sikkerhet.abac.policy.ForeldrepengerAttributter;
import no.nav.vedtak.sikkerhet.kontekst.IdentType;
import no.nav.vedtak.sikkerhet.oidc.config.OpenIDProvider;
import no.nav.vedtak.sikkerhet.oidc.token.OpenIDToken;
import no.nav.vedtak.sikkerhet.oidc.token.TokenString;
Expand Down Expand Up @@ -73,7 +73,7 @@ public void setUp() {

@Test
public void kallPdpUtenFnrResourceHvisPersonlisteErTom() {
var idToken = Token.withOidcToken(JWT_TOKEN);
var idToken = Token.withOidcToken(JWT_TOKEN, "TEST", IdentType.InternBruker);
var responseWrapper = createResponse("xacmlresponse.json");
var captor = ArgumentCaptor.forClass(XacmlRequest.class);

Expand All @@ -88,7 +88,7 @@ public void kallPdpUtenFnrResourceHvisPersonlisteErTom() {

@Test
public void kallPdpMedJwtTokenBodyNårIdTokenErJwtToken() {
var idToken = Token.withOidcToken(JWT_TOKEN);
var idToken = Token.withOidcToken(JWT_TOKEN, "TEST", IdentType.InternBruker);
var responseWrapper = createResponse("xacmlresponse.json");
var captor = ArgumentCaptor.forClass(XacmlRequest.class);

Expand All @@ -103,7 +103,7 @@ public void kallPdpUtenFnrResourceHvisPersonlisteErTom() {

@Test
public void kallPdpMedJwtTokenBodyNårIdTokenErTokeXToken() {
var idToken = Token.withOidcToken(JWT_TOKENX_TOKEN);
var idToken = Token.withOidcToken(JWT_TOKENX_TOKEN, "TEST", IdentType.InternBruker);
var responseWrapper = createResponse("xacmlresponse.json");
var captor = ArgumentCaptor.forClass(XacmlRequest.class);

Expand All @@ -118,7 +118,7 @@ public void kallPdpUtenFnrResourceHvisPersonlisteErTom() {

@Test
public void kallPdpMedFlereAttributtSettNårPersonlisteStørreEnn1() {
var idToken = Token.withOidcToken(JWT_TOKEN);
var idToken = Token.withOidcToken(JWT_TOKEN, "TEST", IdentType.InternBruker);
var responseWrapper = createResponse("xacml3response.json");
var captor = ArgumentCaptor.forClass(XacmlRequest.class);

Expand All @@ -141,7 +141,7 @@ public void kallPdpUtenFnrResourceHvisPersonlisteErTom() {

@Test
public void kallPdpMedFlereAttributtSettNårPersonlisteStørreEnn2() {
var idToken = Token.withOidcToken(JWT_TOKEN);
var idToken = Token.withOidcToken(JWT_TOKEN, "TEST", IdentType.InternBruker);
var responseWrapper = createResponse("xacmlresponse-array.json");
var captor = ArgumentCaptor.forClass(XacmlRequest.class);

Expand All @@ -164,7 +164,7 @@ public void kallPdpUtenFnrResourceHvisPersonlisteErTom() {

@Test
public void sporingsloggListeSkalHaSammeRekkefølgePåidenterSomXacmlRequest() {
var idToken = Token.withOidcToken(JWT_TOKEN);
var idToken = Token.withOidcToken(JWT_TOKEN, "TEST", IdentType.InternBruker);
var responseWrapper = createResponse("xacml3response.json");
var captor = ArgumentCaptor.forClass(XacmlRequest.class);

Expand Down Expand Up @@ -265,7 +265,7 @@ public void skalFeileVedUkjentObligation() {
@Test
public void skal_håndtere_blanding_av_fnr_og_aktør_id() {

var idToken = Token.withOidcToken(JWT_TOKEN);
var idToken = Token.withOidcToken(JWT_TOKEN, "TEST", IdentType.InternBruker);
var responseWrapper = createResponse("xacml3response.json");
var captor = ArgumentCaptor.forClass(XacmlRequest.class);

Expand Down Expand Up @@ -319,7 +319,7 @@ public void lese_sammenligne_request() throws IOException {
File file = new File(getClass().getClassLoader().getResource("request.json").getFile());
var target = DefaultJsonMapper.getObjectMapper().readValue(file, XacmlRequest.class);

var felles = lagBeskyttetRessursAttributter(Token.withOidcToken(JWT_TOKEN), AbacDataAttributter.opprett());
var felles = lagBeskyttetRessursAttributter(Token.withOidcToken(JWT_TOKEN, "TEST", IdentType.InternBruker), AbacDataAttributter.opprett());
var ressurs = AppRessursData.builder()
.leggTilAktørId("11111")
.leggTilFødselsnummer("12345678900")
Expand Down
2 changes: 1 addition & 1 deletion felles/oidc/src/main/java/no/nav/vedtak/sikkerhet/oidc/config/impl/OidcProviderConfig.java
View file
Original file line number Diff line number Diff line change
Expand Up @@ -158,7 +158,7 @@ private static OpenIDConfiguration createAzureAppConfiguration(String wellKnownU
!ENV.isLocal(), useProxy,
getAzureProperty(AzureProperty.AZURE_APP_CLIENT_ID),
getAzureProperty(AzureProperty.AZURE_APP_CLIENT_SECRET),
false);
ENV.isLocal());
}

private static String getAzureProperty(AzureProperty property) {
Expand Down
2 changes: 1 addition & 1 deletion felles/oidc/src/main/java/no/nav/vedtak/sikkerhet/oidc/token/TokenProvider.java
View file
Original file line number Diff line number Diff line change
Expand Up @@ -24,7 +24,7 @@ public final class TokenProvider {
private static final KontekstProvider KONTEKST_PROVIDER = new DefaultRequestKontekstProvider();
private static final String ENV_CLIENT_ID = Optional.ofNullable(Environment.current().clientId()).orElseGet(() -> Environment.current().application());
private static final Set<SikkerhetContext> USE_SYSTEM = Set.of(SikkerhetContext.SYSTEM, SikkerhetContext.WSREQUEST);
private static final boolean SYSTEM_USE_AZURE = "true".equalsIgnoreCase(Environment.current().getProperty("token.system.use.azure"));
private static final boolean SYSTEM_USE_AZURE = !"false".equalsIgnoreCase(Environment.current().getProperty("token.system.use.azure"));

private TokenProvider() {
}
Expand Down

0 comments on commit 893274c

Please sign in to comment.