Skip to content

Commit e255142

Browse files
wolf4oodwolf4ood
authored
feat: secure FC query API with token based auth (#1471)
* feat: secure FC query API with token based auth * chore: deps file * feat: secure FC api in tests
1 parent a959851 commit e255142

File tree

13 files changed

+30
-3
lines changed

13 files changed

+30
-3
lines changed

‎DEPENDENCIES

+1
Original file line numberDiff line numberDiff line change
@@ -356,6 +356,7 @@ maven/mavencentral/org.eclipse.edc/asset-api/0.8.1, Apache-2.0, approved, techno
356356
maven/mavencentral/org.eclipse.edc/asset-index-sql/0.8.1, Apache-2.0, approved, technology.edc
357357
maven/mavencentral/org.eclipse.edc/asset-spi/0.8.1, Apache-2.0, approved, technology.edc
358358
maven/mavencentral/org.eclipse.edc/asset-spi/0.8.1-SNAPSHOT, Apache-2.0, approved, technology.edc
359+
maven/mavencentral/org.eclipse.edc/auth-configuration/0.8.1, Apache-2.0, approved, technology.edc
359360
maven/mavencentral/org.eclipse.edc/auth-spi/0.8.1, Apache-2.0, approved, technology.edc
360361
maven/mavencentral/org.eclipse.edc/auth-tokenbased/0.8.1, Apache-2.0, approved, technology.edc
361362
maven/mavencentral/org.eclipse.edc/autodoc-processor/0.8.1, Apache-2.0, approved, technology.edc

‎charts/tractusx-connector-azure-vault/README.md

+2-1
Original file line numberDiff line numberDiff line change
@@ -83,7 +83,8 @@ helm install my-release tractusx-edc/tractusx-connector-azure-vault --version 0.
8383
| controlplane.debug.enabled | bool | `false` | Enables java debugging mode. |
8484
| controlplane.debug.port | int | `1044` | Port where the debuggee can connect to. |
8585
| controlplane.debug.suspendOnStart | bool | `false` | Defines if the JVM should wait with starting the application until someone connected to the debugging port. |
86-
| controlplane.endpoints | object | `{"catalog":{"path":"/catalog","port":8085},"control":{"path":"/control","port":8083},"default":{"path":"/api","port":8080},"management":{"authKey":"password","path":"/management","port":8081},"metrics":{"path":"/metrics","port":9090},"protocol":{"path":"/api/v1/dsp","port":8084}}` | endpoints of the control plane |
86+
| controlplane.endpoints | object | `{"catalog":{"authKey":"password","path":"/catalog","port":8085},"control":{"path":"/control","port":8083},"default":{"path":"/api","port":8080},"management":{"authKey":"password","path":"/management","port":8081},"metrics":{"path":"/metrics","port":9090},"protocol":{"path":"/api/v1/dsp","port":8084}}` | endpoints of the control plane |
87+
| controlplane.endpoints.catalog.authKey | string | `"password"` | authentication key, must be attached to each request as `X-Api-Key` header |
8788
| controlplane.endpoints.catalog.path | string | `"/catalog"` | path for incoming catalog cache query requests |
8889
| controlplane.endpoints.catalog.port | int | `8085` | port for incoming catalog cache query requests |
8990
| controlplane.endpoints.control | object | `{"path":"/control","port":8083}` | control api, used for internal control calls. can be added to the internal ingress, but should probably not |

‎charts/tractusx-connector-azure-vault/templates/deployment-controlplane.yaml

+4
Original file line numberDiff line numberDiff line change
@@ -176,6 +176,10 @@ spec:
176176
value: {{ .Values.controlplane.endpoints.catalog.port | quote }}
177177
- name: "WEB_HTTP_CATALOG_PATH"
178178
value: {{ .Values.controlplane.endpoints.catalog.path | quote }}
179+
- name: "WEB_HTTP_CATALOG_AUTH_TYPE"
180+
value: "tokenbased"
181+
- name: "WEB_HTTP_CATALOG_AUTH_KEY"
182+
value: {{ .Values.controlplane.endpoints.catalog.authKey | required ".Values.controlplane.endpoints.catalog.authKey is required" | quote }}
179183

180184

181185
#########

‎charts/tractusx-connector-azure-vault/values.yaml

+2
Original file line numberDiff line numberDiff line change
@@ -146,6 +146,8 @@ controlplane:
146146
port: 8085
147147
# -- path for incoming catalog cache query requests
148148
path: /catalog
149+
# -- authentication key, must be attached to each request as `X-Api-Key` header
150+
authKey: "password"
149151

150152
bdrs:
151153
# -- Time that a cached BPN/DID resolution map is valid in seconds, default is 600 seconds (10 min)

‎charts/tractusx-connector-memory/README.md

+2-1
Original file line numberDiff line numberDiff line change
@@ -83,7 +83,8 @@ helm install my-release tractusx-edc/tractusx-connector-memory --version 0.8.0-r
8383
| runtime.debug.enabled | bool | `false` | Enables java debugging mode. |
8484
| runtime.debug.port | int | `1044` | Port where the debuggee can connect to. |
8585
| runtime.debug.suspendOnStart | bool | `false` | Defines if the JVM should wait with starting the application until someone connected to the debugging port. |
86-
| runtime.endpoints | object | `{"catalog":{"path":"/catalog","port":8085},"control":{"path":"/control","port":8083},"default":{"path":"/api","port":8080},"management":{"authKey":"password","path":"/management","port":8081},"protocol":{"path":"/api/v1/dsp","port":8084},"proxy":{"authKey":"password","path":"/proxy","port":8186},"public":{"path":"/api/public","port":8086}}` | endpoints of the controlplane |
86+
| runtime.endpoints | object | `{"catalog":{"authKey":"password","path":"/catalog","port":8085},"control":{"path":"/control","port":8083},"default":{"path":"/api","port":8080},"management":{"authKey":"password","path":"/management","port":8081},"protocol":{"path":"/api/v1/dsp","port":8084},"proxy":{"authKey":"password","path":"/proxy","port":8186},"public":{"path":"/api/public","port":8086}}` | endpoints of the controlplane |
87+
| runtime.endpoints.catalog.authKey | string | `"password"` | authentication key, must be attached to each request as `X-Api-Key` header |
8788
| runtime.endpoints.catalog.path | string | `"/catalog"` | path for incoming catalog cache query requests |
8889
| runtime.endpoints.catalog.port | int | `8085` | port for incoming catalog cache query requests |
8990
| runtime.endpoints.control | object | `{"path":"/control","port":8083}` | control api, used for internal control calls. can be added to the internal ingress, but should probably not |

‎charts/tractusx-connector-memory/templates/deployment-runtime.yaml

+4
Original file line numberDiff line numberDiff line change
@@ -191,6 +191,10 @@ spec:
191191
value: {{ .Values.runtime.endpoints.catalog.port | quote }}
192192
- name: "WEB_HTTP_CATALOG_PATH"
193193
value: {{ .Values.runtime.endpoints.catalog.path | quote }}
194+
- name: "WEB_HTTP_CATALOG_AUTH_TYPE"
195+
value: "tokenbased"
196+
- name: "WEB_HTTP_CATALOG_AUTH_KEY"
197+
value: {{ .Values.runtime.endpoints.catalog.authKey | required ".Values.runtime.endpoints.catalog.authKey is required" | quote }}
194198

195199
#########
196200
## DSP ##

‎charts/tractusx-connector-memory/values.yaml

+2
Original file line numberDiff line numberDiff line change
@@ -149,6 +149,8 @@ runtime:
149149
port: 8085
150150
# -- path for incoming catalog cache query requests
151151
path: /catalog
152+
# -- authentication key, must be attached to each request as `X-Api-Key` header
153+
authKey: "password"
152154

153155
token:
154156
refresh:

‎charts/tractusx-connector/README.md

+2-1
Original file line numberDiff line numberDiff line change
@@ -80,7 +80,8 @@ helm install my-release tractusx-edc/tractusx-connector --version 0.8.0-rc1 \
8080
| controlplane.debug.enabled | bool | `false` | Enables java debugging mode. |
8181
| controlplane.debug.port | int | `1044` | Port where the debuggee can connect to. |
8282
| controlplane.debug.suspendOnStart | bool | `false` | Defines if the JVM should wait with starting the application until someone connected to the debugging port. |
83-
| controlplane.endpoints | object | `{"catalog":{"path":"/catalog","port":8085},"control":{"path":"/control","port":8083},"default":{"path":"/api","port":8080},"management":{"authKey":"password","path":"/management","port":8081},"metrics":{"path":"/metrics","port":9090},"protocol":{"path":"/api/v1/dsp","port":8084}}` | endpoints of the control plane |
83+
| controlplane.endpoints | object | `{"catalog":{"authKey":"password","path":"/catalog","port":8085},"control":{"path":"/control","port":8083},"default":{"path":"/api","port":8080},"management":{"authKey":"password","path":"/management","port":8081},"metrics":{"path":"/metrics","port":9090},"protocol":{"path":"/api/v1/dsp","port":8084}}` | endpoints of the control plane |
84+
| controlplane.endpoints.catalog.authKey | string | `"password"` | authentication key, must be attached to each request as `X-Api-Key` header |
8485
| controlplane.endpoints.catalog.path | string | `"/catalog"` | path for incoming catalog cache query requests |
8586
| controlplane.endpoints.catalog.port | int | `8085` | port for incoming catalog cache query requests |
8687
| controlplane.endpoints.control | object | `{"path":"/control","port":8083}` | control api, used for internal control calls. can be added to the internal ingress, but should probably not |

‎charts/tractusx-connector/templates/deployment-controlplane.yaml

+5
Original file line numberDiff line numberDiff line change
@@ -176,6 +176,11 @@ spec:
176176
value: {{ .Values.controlplane.endpoints.catalog.port | quote }}
177177
- name: "WEB_HTTP_CATALOG_PATH"
178178
value: {{ .Values.controlplane.endpoints.catalog.path | quote }}
179+
- name: "WEB_HTTP_CATALOG_AUTH_TYPE"
180+
value: "tokenbased"
181+
- name: "WEB_HTTP_CATALOG_AUTH_KEY"
182+
value: {{ .Values.controlplane.endpoints.catalog.authKey | required ".Values.controlplane.endpoints.catalog.authKey is required" | quote }}
183+
179184

180185
#########
181186
## DSP ##

‎charts/tractusx-connector/values.yaml

+2
Original file line numberDiff line numberDiff line change
@@ -147,6 +147,8 @@ controlplane:
147147
port: 8085
148148
# -- path for incoming catalog cache query requests
149149
path: /catalog
150+
# -- authentication key, must be attached to each request as `X-Api-Key` header
151+
authKey: "password"
150152

151153
bdrs:
152154
# -- Time that a cached BPN/DID resolution map is valid in seconds, default is 600 seconds (10 min)

‎edc-controlplane/edc-controlplane-base/build.gradle.kts

+1
Original file line numberDiff line numberDiff line change
@@ -57,6 +57,7 @@ dependencies {
5757
runtimeOnly(libs.edc.core.policy.monitor)
5858
runtimeOnly(libs.edc.config.filesystem)
5959
runtimeOnly(libs.edc.auth.tokenbased)
60+
runtimeOnly(libs.edc.auth.configuration)
6061
runtimeOnly(libs.edc.validator.data.address.http.data)
6162
runtimeOnly(libs.edc.aws.validator.data.address.s3)
6263
runtimeOnly(libs.edc.data.plane.selector.control.api)

‎edc-tests/edc-controlplane/fixtures/src/testFixtures/java/org/eclipse/tractusx/edc/tests/participant/TractusxParticipantBase.java

+2
Original file line numberDiff line numberDiff line change
@@ -95,6 +95,8 @@ public Map<String, String> getConfiguration() {
9595
put("web.http.control.path", controlPlaneControl.getPath());
9696
put("web.http.catalog.port", String.valueOf(federatedCatalog.getUrl().getPort()));
9797
put("web.http.catalog.path", federatedCatalog.getUrl().getPath());
98+
put("web.http.catalog.auth.type", "tokenbased");
99+
put("web.http.catalog.auth.key", MANAGEMENT_API_KEY);
98100
put("edc.dsp.callback.address", protocolEndpoint.getUrl().toString());
99101
put("edc.api.auth.key", MANAGEMENT_API_KEY);
100102
put("web.http.public.path", "/api/public");

‎gradle/libs.versions.toml

+1
Original file line numberDiff line numberDiff line change
@@ -83,6 +83,7 @@ edc-dsp = { module = "org.eclipse.edc:dsp", version.ref = "edc" }
8383
edc-iam-mock = { module = "org.eclipse.edc:iam-mock", version.ref = "edc" }
8484
edc-auth-tokenbased = { module = "org.eclipse.edc:auth-tokenbased", version.ref = "edc" }
8585
edc-auth-oauth2-client = { module = "org.eclipse.edc:oauth2-client", version.ref = "edc" }
86+
edc-auth-configuration = { module = "org.eclipse.edc:auth-configuration", version.ref = "edc" }
8687
edc-transaction-local = { module = "org.eclipse.edc:transaction-local", version.ref = "edc" }
8788
edc-ext-http = { module = "org.eclipse.edc:http", version.ref = "edc" }
8889
edc-ext-azure-cosmos-core = { module = "org.eclipse.edc:azure-cosmos-core", version.ref = "edc" }

0 commit comments

Comments
 (0)