Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

feat(jans-auth-server): Token Status List support #8620

Merged
merged 67 commits into from
Jun 28, 2024
Merged

feat(jans-auth-server): Token Status List support #8620

merged 67 commits into from
Jun 28, 2024

Conversation

yuriyz
Copy link
Contributor

@yuriyz yuriyz commented May 31, 2024

Description

feat(jans-auth-server): Token Status List support

https://datatracker.ietf.org/doc/html/draft-ietf-oauth-status-list-02#name-status-list

Target issue

closes #8562

Test and Document the changes

  • Static code analysis has been run locally and issues have been fixed
  • Relevant unit and integration tests have been added/updated
  • Relevant documentation has been updated if any (i.e. user guides, installation and configuration guides, technical design docs etc)

@yuriyz yuriyz requested review from yurem and yuriyzz as code owners May 31, 2024 14:09
@yuriyz yuriyz marked this pull request as draft May 31, 2024 14:09
@yuriyz yuriyz self-assigned this May 31, 2024
@mo-auto mo-auto added comp-jans-auth-server Component affected by issue or PR comp-jans-core Component affected by issue or PR kind-feature Issue or PR is a new feature request labels May 31, 2024
@dryrunsecurity DryRunSecurity
Copy link

dryrunsecurity bot commented Jun 6, 2024 •
edited
Loading

Hi there 👋, @DryRunSecurity here, below is a summary of our analysis and findings.

DryRun Security Status Findings
Server-Side Request Forgery Analyzer ✅ 0 findings
Configured Codepaths Analyzer ✅ 0 findings
Secrets Analyzer ✅ 0 findings
Authn/Authz Analyzer ❕ 23 findings
SQL Injection Analyzer ✅ 0 findings
Sensitive Files Analyzer ✅ 0 findings
IDOR Analyzer ✅ 0 findings

Note

🟢 Risk threshold not exceeded.

Change Summary (click to expand)

The following is a summary of changes in this pull request made by me, your security buddy 🤖. Note that this summary is auto-generated and not meant to be a definitive list of security issues but rather a helpful summary from a security perspective.

Summary:

The code changes in this pull request focus on enhancing the token management and status tracking functionality in the Janssen Project's authentication server. The key changes include:

  1. Token Status List: The introduction of a "Status List" feature that allows the server to maintain a list of token status indices. This feature is implemented through the addition of new classes and properties to track the status of various token entities, such as access tokens, refresh tokens, and authorization codes.

  2. Token Status Tracking: The addition of a statusListIndex property to various token entities, which is used to associate a status index with each token. This allows the server to efficiently track the status of issued tokens.

  3. Token Status Handling: Updates to the token-related methods, such as createAccessTokenAsJwt() and asTokenEntity(), to incorporate the new status list index information when generating and storing tokens.

  4. Feature Flag Management: The introduction of a new feature flag called "STATUS_LIST" to control the availability of the status list functionality. This allows the server to enable or disable the status list feature based on the application configuration.

From an application security perspective, these changes do not introduce any obvious security vulnerabilities. The focus on improving token management and status tracking is a positive step, as it can help the application better detect and respond to potential token-related security issues, such as unauthorized access or token revocation.

However, it is important to ensure that the implementation of the status list feature is secure and does not introduce any unintended security risks. This includes reviewing the handling of status list-related data, the security of the status list service and index service, and the overall impact on the application's performance and scalability.

Files Changed:

  1. jans-auth-server/client/src/main/java/io/jans/as/client/OpenIdConfigurationResponse.java: Adds a new statusListEndpoint property to the OpenIdConfigurationResponse class.
  2. jans-auth-server/client/src/main/java/io/jans/as/client/StatusListClient.java: Introduces a new StatusListClient class to handle interactions with the status list endpoint.
  3. jans-auth-server/client/src/main/java/io/jans/as/client/OpenIdConfigurationClient.java: Adds a new setStatusListEndpoint method to the parse function.
  4. jans-auth-server/client/src/test/java/io/jans/as/client/ws/rs/GrantTypesRestrictionHttpTest.java: Adds a new test suite for verifying grant type and response type restrictions.
  5. jans-auth-server/client/src/test/java/io/jans/as/client/ws/rs/RegistrationRestWebServiceHttpTest.java: Updates the test suite to use the correct grant type name.
  6. jans-auth-server/client/src/test/java/io/jans/as/client/ws/rs/StatusListHttpTest.java: Adds a new test suite for the status list functionality.
  7. jans-auth-server/client/src/test/java/io/jans/as/client/ws/rs/uma/UmaSpontaneousScopeHttpTest.java: Updates the test suite to use the correct grant type name.
  8. jans-auth-server/client/src/test/java/io/jans/as/client/ws/rs/uma/ClientAuthenticationByAccessTokenHttpTest.java: Updates the test suite to use the correct grant type name.
  9. jans-auth-server/model/src/main/java/io/jans/as/model/common/GrantType.java: Renames the OXAUTH_UMA_TICKET grant type to UMA_TICKET.
  10. jans-auth-server/model/src/main/java/io/jans/as/model/common/FeatureFlagType.java: Adds a new "STATUS_LIST" feature flag.
  11. jans-auth-server/model/src/main/java/io/jans/as/model/config/BaseDnConfiguration.java: Adds two new properties, "node" and "statusIndexPool", to the BaseDnConfiguration class.
  12. `jans-auth-server/model/src/main/java/io/jans/

Powered by DryRun Security

@yuriyz yuriyz mentioned this pull request Jun 7, 2024
Closed
5 tasks
yurem and others added 14 commits June 7, 2024 11:52
@yurem
feat(jans-auth): move beans to core model
a1acf85 
Signed-off-by: Yuriy Movchan <[email protected]>
@yurem
feat(jans-auth): add index range to TokenPool
ff7a3f9 
Signed-off-by: Yuriy Movchan <[email protected]>
@yuriyz
Merge branch 'main' into jans-auth-server-8562
f66c254
@yuriyz
feat(jans-auth-server): added application/statuslist+json support
e8c6962 
#8562
Signed-off-by: YuriyZ <[email protected]>
@yurem
feat(jans-auth): add methods to allocate/release TokenPool
9fc9e89 
Signed-off-by: Yuriy Movchan <[email protected]>
@yurem
feat(jans-auth): add methods to allocate/release TokenPool
2bb825c 
Signed-off-by: Yuriy Movchan <[email protected]>
@yurem
feat(jans-auth): fix TokenPool sort
83f36ce 
Signed-off-by: Yuriy Movchan <[email protected]>
@yurem
feat(jans-auth): implement method to get nextIndex for token
723ce03 
Signed-off-by: Yuriy Movchan <[email protected]>
@yurem
feat(jans-auth): implement method to get nextIndex for token
607cb03 
Signed-off-by: Yuriy Movchan <[email protected]>
@yurem
feat(jans-auth): instead of using token list status use expiration date
78bcd84 
Signed-off-by: Yuriy Movchan <[email protected]>
@yuriyz
fix(jans-auth-server): fixed index during list joins and npe on nextI…
63ab6b6 
…ndex.

#8562
Signed-off-by: YuriyZ <[email protected]>
@yuriyz
Merge remote-tracking branch 'origin/jans-auth-server-8562' into jans…
80d0efd 
…-auth-server-8562
@yuriyz
feat(jans-auth-server): populate statusListIndex in access and id tokens
47b5f9b 
#8562
Signed-off-by: YuriyZ <[email protected]>
@yurem
feat(jans-auth): add ClusterNode services
5a48866 
Signed-off-by: Yuriy Movchan <[email protected]>
@yuriyz
code re-format
e2d73a8 
Signed-off-by: YuriyZ <[email protected]>
@sonarqubecloud SonarQubeCloud
Copy link

Quality Gate Passed Quality Gate passed for 'jans-cli'

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarCloud

@yuriyz yuriyz enabled auto-merge (squash) June 28, 2024 10:07
yuriyzz
yuriyzz previously approved these changes Jun 28, 2024
View reviewed changes
@sonarqubecloud SonarQubeCloud
Copy link

Quality Gate Passed Quality Gate passed for 'agama parent'

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarCloud

@sonarqubecloud SonarQubeCloud
Copy link

Quality Gate Passed Quality Gate passed for 'Jans-Keycloak-Link'

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarCloud

@sonarqubecloud SonarQubeCloud
Copy link

Quality Gate Passed Quality Gate passed for 'jans-core'

Issues
7 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarCloud

yurem
yurem previously approved these changes Jun 28, 2024
View reviewed changes
@sonarqubecloud SonarQubeCloud
Copy link

Quality Gate Passed Quality Gate passed for 'Fido2 API'

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarCloud

@sonarqubecloud SonarQubeCloud
Copy link

Quality Gate Passed Quality Gate passed for 'SCIM API'

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarCloud

@sonarqubecloud SonarQubeCloud
Copy link

Quality Gate Passed Quality Gate passed for 'jans-linux-setup'

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarCloud

jgomer2001
jgomer2001 previously approved these changes Jun 28, 2024
View reviewed changes
@pujavs pujavs dismissed stale reviews from jgomer2001, yurem, and yuriyzz via 14d5dec June 28, 2024 12:42
@pujavs pujavs requested review from jgomer2001 and yuriyzz June 28, 2024 12:48
@sonarqubecloud SonarQubeCloud
Copy link

Quality Gate Passed Quality Gate passed for 'jans-config-api-parent'

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarCloud

@sonarqubecloud SonarQubeCloud
Copy link

Quality Gate Passed Quality Gate passed for 'keycloak-integration-parent'

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarCloud

@moabu moabu disabled auto-merge June 28, 2024 14:47
@moabu moabu merged commit 51101e4 into main Jun 28, 2024
8 of 9 checks passed
@moabu moabu deleted the jans-auth-server-8562 branch June 28, 2024 14:49
yuriyz added a commit that referenced this pull request Nov 7, 2024
@yuriyz @yurem
@pujavs @moabu
feat(jans-auth-server): Token Status List support (#8620)
d0eea9c 
* chore(jans-auth-server): renamed OXAUTH_UMA_TICKET -> UMA_TICKET

Signed-off-by: YuriyZ <[email protected]>

* feat(jans-auth-server): Token Status List support

#8562
Signed-off-by: YuriyZ <[email protected]>

* fix(jans-auth-server): corrected requestContext and azd decoding

#8562
Signed-off-by: YuriyZ <[email protected]>

* feat(jans-auth-server): added token status list endpoint and status claim with index.

#8562
Signed-off-by: YuriyZ <[email protected]>

* feat(jans-auth): new cluster beans and services

Signed-off-by: Yuriy Movchan <[email protected]>

* feat(jans-auth-server): added head index to list

#8562
Signed-off-by: YuriyZ <[email protected]>

* feat(jans-auth): move beans to core model

Signed-off-by: Yuriy Movchan <[email protected]>

* feat(jans-auth): add index range to TokenPool

Signed-off-by: Yuriy Movchan <[email protected]>

* feat(jans-auth-server): added application/statuslist+json support

#8562
Signed-off-by: YuriyZ <[email protected]>

* feat(jans-auth): add methods to allocate/release TokenPool

Signed-off-by: Yuriy Movchan <[email protected]>

* feat(jans-auth): fix TokenPool sort

Signed-off-by: Yuriy Movchan <[email protected]>

* feat(jans-auth): implement method to get nextIndex for token

Signed-off-by: Yuriy Movchan <[email protected]>

* feat(jans-auth): implement method to get nextIndex for token

Signed-off-by: Yuriy Movchan <[email protected]>

* feat(jans-auth): instead of using token list status use expiration date

Signed-off-by: Yuriy Movchan <[email protected]>

* fix(jans-auth-server): fixed index during list joins and npe on nextIndex.

#8562
Signed-off-by: YuriyZ <[email protected]>

* feat(jans-auth-server): populate statusListIndex in access and id tokens

#8562
Signed-off-by: YuriyZ <[email protected]>

* feat(jans-auth): add ClusterNode services

Signed-off-by: Yuriy Movchan <[email protected]>

* feat(jans-auth): add node base dn

Signed-off-by: Yuriy Movchan <[email protected]>

* feat(jans-auth-server): added status list update on revoke

#8562
Signed-off-by: YuriyZ <[email protected]>

* fix after merge

Signed-off-by: YuriyZ <[email protected]>

* feat(jans-auth): add schema for new entries

Signed-off-by: Yuriy Movchan <[email protected]>

* feat(jans-auth): fix allocate

Signed-off-by: Yuriy Movchan <[email protected]>

* feat(jans-auth): fix cluster nodes expiration

Signed-off-by: Yuriy Movchan <[email protected]>

* feat(jans-auth-server): added status list as jwt support

#8562
Signed-off-by: YuriyZ <[email protected]>

* feat(jans-auth): Deprecate TokenPoolStatus

Signed-off-by: Yuriy Movchan <[email protected]>

* feat(jans-auth): implement updateWithLock for concurent lock on revoke

Signed-off-by: Yuriy Movchan <[email protected]>

* feat(jans-auth-server): use updateWithLock during status update index

#8562
Signed-off-by: YuriyZ <[email protected]>

* feat(jans-auth-server): update status list on token revoke in separate thread

#8562
Signed-off-by: YuriyZ <[email protected]>

* feat(jans-auth-server): renamed TokenPool -> StatusTokenPool, TokenPoolService -> StatusTokenPoolService

#8562
Signed-off-by: YuriyZ <[email protected]>

* feat(jans-auth-server): removed token head index (we are using status token pools instead)

#8562
Signed-off-by: YuriyZ <[email protected]>

* feat(jans-auth-server): added status list to swagger

#8562
Signed-off-by: YuriyZ <[email protected]>

* feat(jans-auth-server): added ou=node,o=jans to config

#8562
Signed-off-by: YuriyZ <[email protected]>

* feat(jans-auth-server): throw configuration exception if node baseDn is missed

#8562
Signed-off-by: YuriyZ <[email protected]>

* feat(jans-auth-server): set status_list feature flag enabled by default

#8562
Signed-off-by: YuriyZ <[email protected]>

* fix(jans-auth-server): fixed node allocation

#8562
Signed-off-by: YuriyZ <[email protected]>

* fix(jans-auth-server): corrected bug in getClusterNodeLast

#8562
Signed-off-by: YuriyZ <[email protected]>

* feat(jans-auth-server): keep lockKey static and save in jansNode after locking

#8562
Signed-off-by: YuriyZ <[email protected]>

* fix(jans-auth-server): different fixes for cluster node management

#8562
Signed-off-by: YuriyZ <[email protected]>

* fix(jans-auth-server): fixed allocation of status index pools

#8562
Signed-off-by: YuriyZ <[email protected]>

* chore(jans-auth-server): added more logs for status index pool allocation

#8562
Signed-off-by: YuriyZ <[email protected]>

* feat(jans-auth): igore timezone when DB is PostgresSQL

Signed-off-by: Yuriy Movchan <[email protected]>

* feat(jans-auth): fetch all node entries if DB is LDAP

Signed-off-by: Yuriy Movchan <[email protected]>

* feat(jans-auth-server): added status list client

#8562
Signed-off-by: YuriyZ <[email protected]>

* fix(jans-auth-server): fixed pool allocation

#8562
Signed-off-by: YuriyZ <[email protected]>

* chore(jans-auth-server): renamed endpoint /token_status_list -> /status_list

#8562
Signed-off-by: YuriyZ <[email protected]>

* feat(jans-orm): resovle bean property name with AttributeName #8773

* chore(jans-auth-server): renamed token_status_list -> status_list

#8562
Signed-off-by: YuriyZ <[email protected]>

* chore(jans-auth-server): token statuses VALID - 0, INVALID - 1

#8562
Signed-off-by: YuriyZ <[email protected]>

* chore(jans-auth-server): moved status list to model for re-using

#8562
Signed-off-by: YuriyZ <[email protected]>

* feat(jans-auth-server): added batch index update and fixed concurrent update issue

#8562
Signed-off-by: YuriyZ <[email protected]>

* feat(jans-auth-server): use new index update method in existing revoke code

#8562
Signed-off-by: YuriyZ <[email protected]>

* fix(jans-auth-server): fixed status pool index joining

#8562
Signed-off-by: YuriyZ <[email protected]>

* chore(jans-auth-server): code improvements

#8562
Signed-off-by: YuriyZ <[email protected]>

* test(jans-auth-server): added full integration test for status list

#8562
Signed-off-by: YuriyZ <[email protected]>

* test(jans-auth-server): added test for CN case

#8562
Signed-off-by: YuriyZ <[email protected]>

* feat(jans-auth-server): mark indexes which we are about to re-use as VALID

#8562
Signed-off-by: YuriyZ <[email protected]>

* code re-format

Signed-off-by: YuriyZ <[email protected]>

* docs(config-api): regenerating config swagger api

Signed-off-by: pujavs <[email protected]>

---------

Signed-off-by: YuriyZ <[email protected]>
Signed-off-by: Yuriy Movchan <[email protected]>
Signed-off-by: pujavs <[email protected]>
Co-authored-by: Yuriy Movchan <[email protected]>
Co-authored-by: pujavs <[email protected]>
Co-authored-by: Mohammad Abudayyeh <[email protected]>
Former-commit-id: 51101e4
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@jgomer2001 jgomer2001 jgomer2001 approved these changes

@pujavs pujavs pujavs approved these changes

@moabu moabu moabu approved these changes

@yuriyzz yuriyzz yuriyzz approved these changes

@yurem yurem yurem left review comments

@devrimyatar devrimyatar Awaiting requested review from devrimyatar devrimyatar is a code owner

Assignees

@yuriyz yuriyz

Labels
comp-jans-auth-server Component affected by issue or PR comp-jans-core Component affected by issue or PR kind-feature Issue or PR is a new feature request
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

feat(jans-auth-server): add Token Status List support to AS
7 participants
@yuriyz @jgomer2001 @yurem @pujavs @moabu @yuriyzz @mo-auto