Skip to content

Commit 75555f7

Browse files
stevehustevehu
authored
fixes #2306 refactor security config to use only security.yml (#2307)
1 parent 98d6dd0 commit 75555f7

11 files changed

+53
-89
lines changed

‎security-config/src/main/java/com/networknt/security/SecurityConfig.java

+22
Original file line numberDiff line numberDiff line change
@@ -74,6 +74,9 @@ public class SecurityConfig {
7474

7575
private Map<String, String> passThroughClaims;
7676

77+
private SecurityConfig() {
78+
this(CONFIG_NAME);
79+
}
7780

7881
private SecurityConfig(String configName) {
7982
config = Config.getInstance();
@@ -84,10 +87,29 @@ private SecurityConfig(String configName) {
8487
setPassThroughClaims();
8588
}
8689

90+
public static SecurityConfig load() {
91+
return new SecurityConfig();
92+
}
93+
94+
/**
95+
* This method is only used in the test case to load different configuration files. Please use load() instead.
96+
* @param configName String
97+
* @return SecurityConfig
98+
*/
99+
@Deprecated
87100
public static SecurityConfig load(String configName) {
88101
return new SecurityConfig(configName);
89102
}
90103

104+
public void reload() {
105+
mappedConfig = config.getJsonMapConfigNoCache(CONFIG_NAME);
106+
setCertificate();
107+
setConfigData();
108+
setSkipPathPrefixes();
109+
setPassThroughClaims();
110+
}
111+
112+
@Deprecated
91113
public void reload(String configName) {
92114
mappedConfig = config.getJsonMapConfigNoCache(configName);
93115
setCertificate();

‎security-config/src/test/resources/config/openapi-security-no-default-jwtcertificate.yml

+8-8
Original file line numberDiff line numberDiff line change
@@ -4,41 +4,41 @@
44
# loaded for backward compatibility.
55
---
66
# Enable JWT verification flag.
7-
enableVerifyJwt: ${openapi-security.enableVerifyJwt:false}
7+
enableVerifyJwt: ${security.enableVerifyJwt:false}
88

99
# Enable JWT scope verification. Only valid when enableVerifyJwt is true.
10-
enableVerifyScope: ${openapi-security.enableVerifyScope:true}
10+
enableVerifyScope: ${security.enableVerifyScope:true}
1111

1212
# User for test only. should be always be false on official environment.
13-
enableMockJwt: ${openapi-security.enableMockJwt:false}
13+
enableMockJwt: ${security.enableMockJwt:false}
1414

1515
# JWT signature public certificates. kid and certificate path mappings.
1616
jwt:
1717
clockSkewInSeconds: 60
1818

1919
# Enable or disable JWT token logging
20-
logJwtToken: ${openapi-security.logJwtToken:true}
20+
logJwtToken: ${security.logJwtToken:true}
2121

2222
# Enable or disable client_id, user_id and scope logging.
23-
logClientUserScope: ${openapi-security.logClientUserScope:false}
23+
logClientUserScope: ${security.logClientUserScope:false}
2424

2525
# Enable JWT token cache to speed up verification. This will only verify expired time
2626
# and skip the signature verification as it takes more CPU power and a long time. If
2727
# each request has a different jwt token, like authorization code flow, this indicator
2828
# should be turned off. Otherwise, the cached jwt will only be removed after 15 minutes
2929
# and the cache can grow bigger if the number of requests is very high. This will cause
3030
# memory kill in a Kubernetes pod if the memory setting is limited.
31-
enableJwtCache: ${openapi-security.enableJwtCache:true}
31+
enableJwtCache: ${security.enableJwtCache:true}
3232

3333
# If enableJwtCache is true, then an error message will be shown up in the log if the
3434
# cache size is bigger than the jwtCacheFullSize. This helps the developers to detect
3535
# cache problem if many distinct tokens flood the cache in a short period of time. If
3636
# you see JWT cache exceeds the size limit in logs, you need to turn off the enableJwtCache
3737
# or increase the cache full size to a bigger number from the default 100.
38-
jwtCacheFullSize: ${openapi-security.jwtCacheFullSize:100}
38+
jwtCacheFullSize: ${security.jwtCacheFullSize:100}
3939

4040
# If you are using light-oauth2, then you don't need to have oauth subfolder for public
4141
# key certificate to verify JWT token, the key will be retrieved from key endpoint once
4242
# the first token is arrived. Default to false for dev environment without oauth2 server
4343
# or official environment that use other OAuth 2.0 providers.
44-
bootstrapFromKeyService: ${openapi-security.bootstrapFromKeyService:false}
44+
bootstrapFromKeyService: ${security.bootstrapFromKeyService:false}

‎security-config/src/test/resources/config/security-json-claims.yml

+2-2
Original file line numberDiff line numberDiff line change
@@ -112,9 +112,9 @@ skipPathPrefixes: ${security.skipPathPrefixes:}
112112
# claim in the token and a header name that the downstream API is expecting. You can use
113113
# both JSON or YAML format.
114114
# YAML
115-
# openapi-security.passThroughClaims:
115+
# security.passThroughClaims:
116116
# cid: client_id
117117
# uid: user_id
118118
# JSON
119-
# openapi-security.passThroughClaims: {"cid":"client_id","uid":"user_id"}
119+
# security.passThroughClaims: {"cid":"client_id","uid":"user_id"}
120120
passThroughClaims: {"cid":"client_id","uid":"user_id"}

‎security-config/src/test/resources/config/security-yaml-claims.yml

+2-2
Original file line numberDiff line numberDiff line change
@@ -112,11 +112,11 @@ skipPathPrefixes: ${security.skipPathPrefixes:}
112112
# claim in the token and a header name that the downstream API is expecting. You can use
113113
# both JSON or YAML format.
114114
# YAML
115-
# openapi-security.passThroughClaims:
115+
# security.passThroughClaims:
116116
# cid: client_id
117117
# uid: user_id
118118
# JSON
119-
# openapi-security.passThroughClaims: {"cid":"client_id","uid":"user_id"}
119+
# security.passThroughClaims: {"cid":"client_id","uid":"user_id"}
120120
passThroughClaims:
121121
cid: client_id
122122
uid: user_id

‎security/src/test/resources/config/openapi-security-no-default-jwtcertificate.yml

+8-8
Original file line numberDiff line numberDiff line change
@@ -4,41 +4,41 @@
44
# loaded for backward compatibility.
55
---
66
# Enable JWT verification flag.
7-
enableVerifyJwt: ${openapi-security.enableVerifyJwt:false}
7+
enableVerifyJwt: ${security.enableVerifyJwt:false}
88

99
# Enable JWT scope verification. Only valid when enableVerifyJwt is true.
10-
enableVerifyScope: ${openapi-security.enableVerifyScope:true}
10+
enableVerifyScope: ${security.enableVerifyScope:true}
1111

1212
# User for test only. should be always be false on official environment.
13-
enableMockJwt: ${openapi-security.enableMockJwt:false}
13+
enableMockJwt: ${security.enableMockJwt:false}
1414

1515
# JWT signature public certificates. kid and certificate path mappings.
1616
jwt:
1717
clockSkewInSeconds: 60
1818

1919
# Enable or disable JWT token logging
20-
logJwtToken: ${openapi-security.logJwtToken:true}
20+
logJwtToken: ${security.logJwtToken:true}
2121

2222
# Enable or disable client_id, user_id and scope logging.
23-
logClientUserScope: ${openapi-security.logClientUserScope:false}
23+
logClientUserScope: ${security.logClientUserScope:false}
2424

2525
# Enable JWT token cache to speed up verification. This will only verify expired time
2626
# and skip the signature verification as it takes more CPU power and a long time. If
2727
# each request has a different jwt token, like authorization code flow, this indicator
2828
# should be turned off. Otherwise, the cached jwt will only be removed after 15 minutes
2929
# and the cache can grow bigger if the number of requests is very high. This will cause
3030
# memory kill in a Kubernetes pod if the memory setting is limited.
31-
enableJwtCache: ${openapi-security.enableJwtCache:true}
31+
enableJwtCache: ${security.enableJwtCache:true}
3232

3333
# If enableJwtCache is true, then an error message will be shown up in the log if the
3434
# cache size is bigger than the jwtCacheFullSize. This helps the developers to detect
3535
# cache problem if many distinct tokens flood the cache in a short period of time. If
3636
# you see JWT cache exceeds the size limit in logs, you need to turn off the enableJwtCache
3737
# or increase the cache full size to a bigger number from the default 100.
38-
jwtCacheFullSize: ${openapi-security.jwtCacheFullSize:100}
38+
jwtCacheFullSize: ${security.jwtCacheFullSize:100}
3939

4040
# If you are using light-oauth2, then you don't need to have oauth subfolder for public
4141
# key certificate to verify JWT token, the key will be retrieved from key endpoint once
4242
# the first token is arrived. Default to false for dev environment without oauth2 server
4343
# or official environment that use other OAuth 2.0 providers.
44-
bootstrapFromKeyService: ${openapi-security.bootstrapFromKeyService:false}
44+
bootstrapFromKeyService: ${security.bootstrapFromKeyService:false}

‎security/src/test/resources/config/security-json-claims.yml

+2-2
Original file line numberDiff line numberDiff line change
@@ -112,9 +112,9 @@ skipPathPrefixes: ${security.skipPathPrefixes:}
112112
# claim in the token and a header name that the downstream API is expecting. You can use
113113
# both JSON or YAML format.
114114
# YAML
115-
# openapi-security.passThroughClaims:
115+
# security.passThroughClaims:
116116
# cid: client_id
117117
# uid: user_id
118118
# JSON
119-
# openapi-security.passThroughClaims: {"cid":"client_id","uid":"user_id"}
119+
# security.passThroughClaims: {"cid":"client_id","uid":"user_id"}
120120
passThroughClaims: {"cid":"client_id","uid":"user_id"}

‎security/src/test/resources/config/security-yaml-claims.yml

+2-2
Original file line numberDiff line numberDiff line change
@@ -112,11 +112,11 @@ skipPathPrefixes: ${security.skipPathPrefixes:}
112112
# claim in the token and a header name that the downstream API is expecting. You can use
113113
# both JSON or YAML format.
114114
# YAML
115-
# openapi-security.passThroughClaims:
115+
# security.passThroughClaims:
116116
# cid: client_id
117117
# uid: user_id
118118
# JSON
119-
# openapi-security.passThroughClaims: {"cid":"client_id","uid":"user_id"}
119+
# security.passThroughClaims: {"cid":"client_id","uid":"user_id"}
120120
passThroughClaims:
121121
cid: client_id
122122
uid: user_id

‎unified-security/src/main/java/com/networknt/security/AbstractJwtVerifyHandler.java

+2-18
Original file line numberDiff line numberDiff line change
@@ -1,14 +1,11 @@
11
package com.networknt.security;
22

3-
import com.networknt.config.Config;
43
import com.networknt.exception.ExpiredTokenException;
54
import com.networknt.handler.Handler;
65
import com.networknt.handler.MiddlewareHandler;
7-
import com.networknt.handler.config.HandlerConfig;
86
import com.networknt.httpstring.AttachmentConstants;
97
import com.networknt.httpstring.HttpStringConstants;
108
import com.networknt.utility.Constants;
11-
import com.networknt.utility.ModuleRegistry;
129
import io.undertow.Handlers;
1310
import io.undertow.server.HttpHandler;
1411
import io.undertow.server.HttpServerExchange;
@@ -25,7 +22,6 @@
2522

2623
public abstract class AbstractJwtVerifyHandler extends UndertowVerifyHandler implements MiddlewareHandler, IJwtVerifyHandler {
2724
static final Logger logger = LoggerFactory.getLogger(AbstractJwtVerifyHandler.class);
28-
static final String OPENAPI_SECURITY_CONFIG = "openapi-security";
2925
static final String STATUS_INVALID_AUTH_TOKEN = "ERR10000";
3026
static final String STATUS_AUTH_TOKEN_EXPIRED = "ERR10001";
3127
static final String STATUS_MISSING_AUTH_TOKEN = "ERR10002";
@@ -36,24 +32,12 @@ public abstract class AbstractJwtVerifyHandler extends UndertowVerifyHandler imp
3632
static final String STATUS_INVALID_REQUEST_PATH = "ERR10007";
3733
static final String STATUS_METHOD_NOT_ALLOWED = "ERR10008";
3834

39-
static SecurityConfig config;
35+
public static SecurityConfig config;
4036

4137
// make this static variable public so that it can be accessed from the server-info module
4238
public static JwtVerifier jwtVerifier;
4339

44-
String basePath;
45-
46-
private volatile HttpHandler next;
47-
48-
public AbstractJwtVerifyHandler() {
49-
// at this moment, we assume that the OpenApiHandler is fully loaded with a single spec or multiple specs.
50-
// And the basePath is the correct one from the OpenApiHandler helper or helperMap if multiple is used.
51-
config = SecurityConfig.load(OPENAPI_SECURITY_CONFIG);
52-
jwtVerifier = new JwtVerifier(config);
53-
// in case that the specification doesn't exist, get the basePath from the handler.yml for endpoint lookup.
54-
HandlerConfig handlerConfig = HandlerConfig.load();
55-
this.basePath = handlerConfig == null ? "/" : handlerConfig.getBasePath();
56-
}
40+
public volatile HttpHandler next;
5741

5842
@Override
5943
@SuppressWarnings("unchecked")

‎unified-security/src/main/java/com/networknt/security/AbstractSimpleJwtVerifyHandler.java

+2-30
Original file line numberDiff line numberDiff line change
@@ -1,14 +1,11 @@
11
package com.networknt.security;
22

3-
import com.networknt.config.Config;
43
import com.networknt.exception.ExpiredTokenException;
54
import com.networknt.handler.Handler;
65
import com.networknt.handler.MiddlewareHandler;
7-
import com.networknt.handler.config.HandlerConfig;
86
import com.networknt.httpstring.AttachmentConstants;
97
import com.networknt.httpstring.HttpStringConstants;
108
import com.networknt.utility.Constants;
11-
import com.networknt.utility.ModuleRegistry;
129
import io.undertow.Handlers;
1310
import io.undertow.server.HttpHandler;
1411
import io.undertow.server.HttpServerExchange;
@@ -26,30 +23,17 @@
2623

2724
public abstract class AbstractSimpleJwtVerifyHandler extends UndertowVerifyHandler implements MiddlewareHandler, IJwtVerifyHandler {
2825
static final Logger logger = LoggerFactory.getLogger(AbstractSimpleJwtVerifyHandler.class);
29-
static final String SECURITY_CONFIG = "security";
3026
static final String STATUS_INVALID_AUTH_TOKEN = "ERR10000";
3127
static final String STATUS_AUTH_TOKEN_EXPIRED = "ERR10001";
3228
static final String STATUS_MISSING_AUTH_TOKEN = "ERR10002";
3329
static final String STATUS_METHOD_NOT_ALLOWED = "ERR10008";
3430

35-
static SecurityConfig config;
31+
public static SecurityConfig config;
3632

3733
// make this static variable public so that it can be accessed from the server-info module
3834
public static JwtVerifier jwtVerifier;
3935

40-
String basePath;
41-
42-
private volatile HttpHandler next;
43-
44-
public AbstractSimpleJwtVerifyHandler() {
45-
// at this moment, we assume that the OpenApiHandler is fully loaded with a single spec or multiple specs.
46-
// And the basePath is the correct one from the OpenApiHandler helper or helperMap if multiple is used.
47-
config = SecurityConfig.load(SECURITY_CONFIG);
48-
jwtVerifier = new JwtVerifier(config);
49-
// in case that the specification doesn't exist, get the basePath from the handler.yml for endpoint lookup.
50-
HandlerConfig handlerConfig = HandlerConfig.load();
51-
this.basePath = handlerConfig == null ? "/" : handlerConfig.getBasePath();
52-
}
36+
public volatile HttpHandler next;
5337

5438
@Override
5539
@SuppressWarnings("unchecked")
@@ -238,18 +222,6 @@ public boolean isEnabled() {
238222
return config.isEnableVerifyJwt();
239223
}
240224

241-
@Override
242-
public void register() {
243-
ModuleRegistry.registerModule(SECURITY_CONFIG, AbstractSimpleJwtVerifyHandler.class.getName(), Config.getNoneDecryptedInstance().getJsonMapConfigNoCache(SECURITY_CONFIG), null);
244-
}
245-
246-
@Override
247-
public void reload() {
248-
config.reload(SECURITY_CONFIG);
249-
jwtVerifier = new JwtVerifier(config);
250-
ModuleRegistry.registerModule(SECURITY_CONFIG, AbstractSimpleJwtVerifyHandler.class.getName(), Config.getNoneDecryptedInstance().getJsonMapConfigNoCache(SECURITY_CONFIG), null);
251-
}
252-
253225
@Override
254226
public JwtVerifier getJwtVerifier() {
255227
return jwtVerifier;

‎unified-security/src/main/java/com/networknt/security/AbstractSwtVerifyHandler.java

+2-15
Original file line numberDiff line numberDiff line change
@@ -23,7 +23,6 @@
2323

2424
public abstract class AbstractSwtVerifyHandler extends UndertowVerifyHandler implements MiddlewareHandler {
2525
static final Logger logger = LoggerFactory.getLogger(AbstractSwtVerifyHandler.class);
26-
static final String OPENAPI_SECURITY_CONFIG = "openapi-security";
2726
static final String STATUS_INVALID_AUTH_TOKEN = "ERR10000";
2827
static final String STATUS_AUTH_TOKEN_EXPIRED = "ERR10001";
2928
static final String STATUS_MISSING_AUTH_TOKEN = "ERR10002";
@@ -38,10 +37,8 @@ public abstract class AbstractSwtVerifyHandler extends UndertowVerifyHandler imp
3837

3938
public static SwtVerifier swtVerifier;
4039

41-
static SecurityConfig config;
42-
private volatile HttpHandler next;
43-
44-
String basePath;
40+
public static SecurityConfig config;
41+
public volatile HttpHandler next;
4542

4643
@Override
4744
public HttpHandler getNext() {
@@ -318,14 +315,4 @@ protected String getScopeToken(String authorization, HeaderMap headerMap) {
318315
return returnToken;
319316
}
320317

321-
public AbstractSwtVerifyHandler() {
322-
// at this moment, we assume that the OpenApiHandler is fully loaded with a single spec or multiple specs.
323-
// And the basePath is the correct one from the OpenApiHandler helper or helperMap if multiple is used.
324-
config = SecurityConfig.load(OPENAPI_SECURITY_CONFIG);
325-
swtVerifier = new SwtVerifier(config);
326-
// in case that the specification doesn't exist, get the basePath from the handler.yml for endpoint lookup.
327-
HandlerConfig handlerConfig = HandlerConfig.load();
328-
this.basePath = handlerConfig == null ? "/" : handlerConfig.getBasePath();
329-
}
330-
331318
}

‎unified-security/src/main/java/com/networknt/security/UnifiedSecurityHandler.java

+1-2
Original file line numberDiff line numberDiff line change
@@ -27,7 +27,6 @@
2727
*/
2828
public class UnifiedSecurityHandler implements MiddlewareHandler {
2929
static final Logger logger = LoggerFactory.getLogger(UnifiedSecurityHandler.class);
30-
static final String OPENAPI_SECURITY_CONFIG = "openapi-security";
3130
static final String BEARER_PREFIX = "BEARER";
3231
static final String BASIC_PREFIX = "BASIC";
3332
static final String API_KEY = "apikey";
@@ -46,7 +45,7 @@ public class UnifiedSecurityHandler implements MiddlewareHandler {
4645
public UnifiedSecurityHandler() {
4746
logger.info("UnifiedSecurityHandler starts");
4847
config = UnifiedSecurityConfig.load();
49-
jwtVerifier = new JwtVerifier(SecurityConfig.load(OPENAPI_SECURITY_CONFIG));
48+
jwtVerifier = new JwtVerifier(SecurityConfig.load());
5049
}
5150

5251
@Override

0 commit comments

Comments
 (0)