-
Notifications
You must be signed in to change notification settings - Fork 76
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
feat(jans-auth-server): introduced `/.well-known/authzen-configuratio…
…n` endpoint (#10321) * feat(jans-auth-server): introduced /.well-known/authzen-configuration Signed-off-by: YuriyZ <[email protected]> * feat(jans-auth-server): added external service for /.well-known/authzen-configuration Signed-off-by: YuriyZ <[email protected]> * feat(jans-auth-server): added custom script definition for /.well-known/authzen-configuration Signed-off-by: YuriyZ <[email protected]> * feat(jans-auth-server): added cache support for /.well-known/authzen-configuration Signed-off-by: YuriyZ <[email protected]> * feat(jans-auth-server): added sample custom script for /.well-known/authzen-configuration Signed-off-by: YuriyZ <[email protected]> * feat(jans-auth-server): added authzen ws classes to initializers Signed-off-by: YuriyZ <[email protected]> * feat(jans-auth-server): added proxypass in apache for /.well-known/authzen-configuration Signed-off-by: YuriyZ <[email protected]> * feat(jans-auth-server): updated swagger with /.well-known/authzen-configuration Signed-off-by: YuriyZ <[email protected]> * feat(jans-auth-server): added documentation for authzen discovery custom script Signed-off-by: YuriyZ <[email protected]> * feat(jans-auth-server): added documentation about authzen discovery Signed-off-by: YuriyZ <[email protected]> --------- Signed-off-by: YuriyZ <[email protected]>
- Loading branch information
Showing
19 changed files
with
501 additions
and
5 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
52 changes: 52 additions & 0 deletions
52
docs/script-catalog/access_evaluation/AccessEvaluationDiscovery.java
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,52 @@ | ||
| /* Copyright (c) 2024, Gluu | ||
| Author: Yuriy Z | ||
| */ | ||
|
|
||
| import io.jans.model.SimpleCustomProperty; | ||
| import io.jans.model.custom.script.model.CustomScript; | ||
| import io.jans.model.custom.script.type.authzen.AccessEvaluationDiscoveryType; | ||
| import io.jans.service.custom.script.CustomScriptManager; | ||
| import org.json.JSONObject; | ||
| import org.slf4j.Logger; | ||
| import org.slf4j.LoggerFactory; | ||
|
|
||
| import java.util.Map; | ||
|
|
||
| public class AccessEvaluationDiscovery implements AccessEvaluationDiscoveryType { | ||
|
|
||
| private static final Logger log = LoggerFactory.getLogger(AccessEvaluationDiscovery.class); | ||
| private static final Logger scriptLogger = LoggerFactory.getLogger(CustomScriptManager.class); | ||
|
|
||
| @Override | ||
| public boolean init(Map<String, SimpleCustomProperty> configurationAttributes) { | ||
| log.info("Init of AccessEvaluationDiscovery Java custom script"); | ||
| return true; | ||
| } | ||
|
|
||
| @Override | ||
| public boolean init(CustomScript customScript, Map<String, SimpleCustomProperty> configurationAttributes) { | ||
| log.info("Init of AccessEvaluationDiscovery Java custom script"); | ||
| return true; | ||
| } | ||
|
|
||
| @Override | ||
| public boolean destroy(Map<String, SimpleCustomProperty> configurationAttributes) { | ||
| log.info("Destroy of AccessEvaluationDiscovery Java custom script"); | ||
| return true; | ||
| } | ||
|
|
||
| @Override | ||
| public int getApiVersion() { | ||
| log.info("getApiVersion AccessEvaluationDiscovery Java custom script: 11"); | ||
| return 11; | ||
| } | ||
|
|
||
| @Override | ||
| public boolean modifyResponse(Object responseAsJsonObject, Object context) { | ||
| scriptLogger.info("write to script logger"); | ||
| JSONObject response = (JSONObject) responseAsJsonObject; | ||
| response.accumulate("key_from_java", "value_from_script_on_java"); | ||
| return true; | ||
| } | ||
| } | ||
|
|
108 changes: 108 additions & 0 deletions
108
docs/script-catalog/access_evaluation/access-evaluation-discovery.md
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,108 @@ | ||
| --- | ||
| tags: | ||
| - administration | ||
| - developer | ||
| - script-catalog | ||
| --- | ||
|
|
||
| # Access Evaluation Discovery Custom Script | ||
|
|
||
| ## Overview | ||
|
|
||
| This script is used to control Access Evaluation Discovery Endpoint (`/.well-known/authzen-configuration`). | ||
|
|
||
| **Sample request** | ||
| ``` | ||
| GET /.well-known/authzen-configuration HTTP/1.1 | ||
| Host: happy-example.gluu.info | ||
| Content-Type: application/json | ||
| {"access_evaluation_v1_endpoint":"https://happy-example.gluu.info/jans-auth/restv1/evaluation"} | ||
| ``` | ||
|
|
||
|
|
||
|
|
||
| ## Interface | ||
| The Access Evaluation Discovery script implements the [AccessEvaluationDiscoveryType](https://github.com/JanssenProject/jans/blob/main/jans-core/script/src/main/java/io/jans/model/custom/script/type/authzen/AccessEvaluationDiscoveryType.java) interface. | ||
| This extends methods from the base script type in addition to adding new methods: | ||
|
|
||
| ### Inherited Methods | ||
| | Method header | Method description | | ||
| |:-----|:------| | ||
| | `def init(self, customScript, configurationAttributes)` | This method is only called once during the script initialization. It can be used for global script initialization, initiate objects etc | | ||
| | `def destroy(self, configurationAttributes)` | This method is called once to destroy events. It can be used to free resource and objects created in the `init()` method | | ||
| | `def getApiVersion(self, configurationAttributes, customScript)` | The getApiVersion method allows API changes in order to do transparent migration from an old script to a new API. Only include the customScript variable if the value for getApiVersion is greater than 10 | | ||
|
|
||
| ### New methods | ||
| | Method header | Method description | | ||
| |:-----|:------| | ||
| | `def modifyResponse(self, responseAsJsonObject, context)` | This method is called after discovery response is ready. This method can modify discovery response.<br/>`responseAsJsonObject` is `org.codehaus.jettison.json.JSONObject`<br/> `context` is `io.jans.as.server.model.common.ExecutionContext` | | ||
|
|
||
|
|
||
| `modifyResponse` method returns `true` to access modification or `false` to revert all changes. | ||
|
|
||
|
|
||
| ### Objects | ||
| | Object name | Object description | | ||
| |:-----|:------| | ||
| |`customScript`| The custom script object. [Reference](https://github.com/JanssenProject/jans/blob/main/jans-core/script/src/main/java/io/jans/model/custom/script/model/CustomScript.java) | | ||
| |`context`| [Reference](https://github.com/JanssenProject/jans/blob/main/jans-auth-server/server/src/main/java/io/jans/as/server/service/external/context/ExternalScriptContext.java) | | ||
|
|
||
|
|
||
| ## Sample Demo Custom Script | ||
|
|
||
| ### Script Type: Java | ||
|
|
||
| ```java | ||
| import io.jans.model.SimpleCustomProperty; | ||
| import io.jans.model.custom.script.model.CustomScript; | ||
| import io.jans.model.custom.script.type.authzen.AccessEvaluationDiscoveryType; | ||
| import io.jans.service.custom.script.CustomScriptManager; | ||
| import org.json.JSONObject; | ||
| import org.slf4j.Logger; | ||
| import org.slf4j.LoggerFactory; | ||
|
|
||
| import java.util.Map; | ||
|
|
||
| public class AccessEvaluationDiscovery implements AccessEvaluationDiscoveryType { | ||
|
|
||
| private static final Logger log = LoggerFactory.getLogger(AccessEvaluationDiscovery.class); | ||
| private static final Logger scriptLogger = LoggerFactory.getLogger(CustomScriptManager.class); | ||
|
|
||
| @Override | ||
| public boolean init(Map<String, SimpleCustomProperty> configurationAttributes) { | ||
| log.info("Init of AccessEvaluationDiscovery Java custom script"); | ||
| return true; | ||
| } | ||
|
|
||
| @Override | ||
| public boolean init(CustomScript customScript, Map<String, SimpleCustomProperty> configurationAttributes) { | ||
| log.info("Init of AccessEvaluationDiscovery Java custom script"); | ||
| return true; | ||
| } | ||
|
|
||
| @Override | ||
| public boolean destroy(Map<String, SimpleCustomProperty> configurationAttributes) { | ||
| log.info("Destroy of AccessEvaluationDiscovery Java custom script"); | ||
| return true; | ||
| } | ||
|
|
||
| @Override | ||
| public int getApiVersion() { | ||
| log.info("getApiVersion AccessEvaluationDiscovery Java custom script: 11"); | ||
| return 11; | ||
| } | ||
|
|
||
| @Override | ||
| public boolean modifyResponse(Object responseAsJsonObject, Object context) { | ||
| scriptLogger.info("write to script logger"); | ||
| JSONObject response = (JSONObject) responseAsJsonObject; | ||
| response.accumulate("key_from_java", "value_from_script_on_java"); | ||
| return true; | ||
| } | ||
| } | ||
| ``` | ||
|
|
||
|
|
||
| ## Sample Scripts | ||
| - [Access Evaluation Discovery](../../../script-catalog/access_evaluation/AccessEvaluationDiscovery.java) |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
65 changes: 65 additions & 0 deletions
65
...erver/src/main/java/io/jans/as/server/authzen/ws/rs/AccessEvaluationDiscoveryService.java
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,65 @@ | ||
| package io.jans.as.server.authzen.ws.rs; | ||
|
|
||
| import io.jans.as.model.common.FeatureFlagType; | ||
| import io.jans.as.model.configuration.AppConfiguration; | ||
| import io.jans.as.model.error.ErrorResponseFactory; | ||
| import io.jans.as.server.model.common.ExecutionContext; | ||
| import io.jans.as.server.service.DiscoveryService; | ||
| import io.jans.as.server.service.LocalResponseCache; | ||
| import io.jans.as.server.service.external.ExternalAccessEvaluationDiscoveryService; | ||
| import jakarta.enterprise.context.ApplicationScoped; | ||
| import jakarta.inject.Inject; | ||
| import org.json.JSONObject; | ||
| import org.slf4j.Logger; | ||
|
|
||
| import static io.jans.as.model.configuration.ConfigurationResponseClaim.ACCESS_EVALUATION_V1_ENDPOINT; | ||
|
|
||
| /** | ||
| * @author Yuriy Z | ||
| */ | ||
| @ApplicationScoped | ||
| public class AccessEvaluationDiscoveryService { | ||
|
|
||
| @Inject | ||
| private Logger log; | ||
|
|
||
| @Inject | ||
| private ErrorResponseFactory errorResponseFactory; | ||
|
|
||
| @Inject | ||
| private AppConfiguration appConfiguration; | ||
|
|
||
| @Inject | ||
| private LocalResponseCache localResponseCache; | ||
|
|
||
| @Inject | ||
| private ExternalAccessEvaluationDiscoveryService externalAccessEvaluationDiscoveryService; | ||
|
|
||
| public JSONObject discovery(ExecutionContext context) { | ||
| errorResponseFactory.validateFeatureEnabled(FeatureFlagType.ACCESS_EVALUATION); | ||
|
|
||
| final JSONObject cachedResponse = localResponseCache.getAccessEvaluationDiscoveryResponse(); | ||
| if (cachedResponse != null) { | ||
| log.trace("Cached access evaluation discovery response returned."); | ||
| return cachedResponse; | ||
| } | ||
|
|
||
| JSONObject jsonObj = createResponse(); | ||
| JSONObject clone = new JSONObject(jsonObj.toString()); | ||
|
|
||
| if (!externalAccessEvaluationDiscoveryService.modifyDiscovery(jsonObj, context)) { | ||
| jsonObj = clone; // revert to original state if object was modified in script | ||
| } | ||
|
|
||
| localResponseCache.putAccessEvaluationDiscoveryResponse(jsonObj); | ||
| return jsonObj; | ||
| } | ||
|
|
||
| private JSONObject createResponse() { | ||
| JSONObject jsonObj = new JSONObject(); | ||
| if (appConfiguration.isFeatureEnabled(FeatureFlagType.ACCESS_EVALUATION)) | ||
| jsonObj.put(ACCESS_EVALUATION_V1_ENDPOINT, DiscoveryService.getAccessEvaluationV1Endpoint(appConfiguration)); | ||
|
|
||
| return jsonObj; | ||
| } | ||
| } |
Oops, something went wrong.