Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

pac4j: fix incompatible dependencies + authorization regression #15753

Merged
merged 7 commits into from
Feb 1, 2024
Merged

pac4j: fix incompatible dependencies + authorization regression #15753

Show file tree
Hide file tree
Changes from 3 commits
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
a47970c
FIX Pac4j issue
Pankaj260100 Jan 24, 2024
4f55b09
Fix default Authorization
Pankaj260100 Jan 25, 2024
dfbab89
Addressing review comment
Pankaj260100 Jan 25, 2024
9e91369
Fix build
Pankaj260100 Jan 29, 2024
41f65ec
adding test cases
Pankaj260100 Jan 30, 2024
597922f
addressing review comments
Pankaj260100 Jan 31, 2024
5173f8b
Correct indentation
Pankaj260100 Jan 31, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions extensions-core/druid-pac4j/pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -38,8 +38,8 @@

<!-- Following must be updated along with any updates to pac4j version -->
<nimbus.lang.tag.version>1.7</nimbus.lang.tag.version>
<nimbus.jose.jwt.version>7.9</nimbus.jose.jwt.version>
<oauth2.oidc.sdk.version>6.5</oauth2.oidc.sdk.version>
<nimbus.jose.jwt.version>8.22.1</nimbus.jose.jwt.version>
<oauth2.oidc.sdk.version>8.22</oauth2.oidc.sdk.version>
Pankaj260100 marked this conversation as resolved.
Show resolved Hide resolved
</properties>

<dependencies>
Expand Down
19 changes: 10 additions & 9 deletions extensions-core/druid-pac4j/src/main/java/org/apache/druid/security/pac4j/Pac4jFilter.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -29,8 +29,8 @@
import org.pac4j.core.engine.DefaultCallbackLogic;
import org.pac4j.core.engine.DefaultSecurityLogic;
import org.pac4j.core.engine.SecurityLogic;
import org.pac4j.core.exception.http.HttpAction;
import org.pac4j.core.http.adapter.HttpActionAdapter;
import org.pac4j.core.http.adapter.JEEHttpActionAdapter;
import org.pac4j.core.profile.UserProfile;

import javax.servlet.Filter;
Expand All @@ -48,11 +48,12 @@ public class Pac4jFilter implements Filter
{
private static final Logger LOGGER = new Logger(Pac4jFilter.class);

private static final HttpActionAdapter<String, JEEContext> NOOP_HTTP_ACTION_ADAPTER = (HttpAction code, JEEContext ctx) -> null;
// JEE_HTTP_ACTION_ADAPTER updates the response in the context according to the HTTPAction.
private static final HttpActionAdapter<Object, JEEContext> JEE_HTTP_ACTION_ADAPTER = new JEEHttpActionAdapter();
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Earlier NOOP_HTTP_ACTION_ADAPTER was working fine because the response in the context was getting updated when generating HTTPAction. But now in 4.5.7 pac4j, it just simply returns the HTTPAction, and we need HTTPActionAdapter to update the context.

Pankaj260100 marked this conversation as resolved.
Show resolved Hide resolved

private final Config pac4jConfig;
private final SecurityLogic<String, JEEContext> securityLogic;
private final CallbackLogic<String, JEEContext> callbackLogic;
private final SecurityLogic<Object, JEEContext> securityLogic;
private final CallbackLogic<Object, JEEContext> callbackLogic;
private final SessionStore<JEEContext> sessionStore;

private final String name;
Expand Down Expand Up @@ -95,11 +96,11 @@ public void doFilter(ServletRequest servletRequest, ServletResponse servletRespo
callbackLogic.perform(
context,
pac4jConfig,
NOOP_HTTP_ACTION_ADAPTER,
JEE_HTTP_ACTION_ADAPTER,
Pankaj260100 marked this conversation as resolved.
Show resolved Hide resolved
"/",
true, false, false, null);
} else {
String uid = securityLogic.perform(
Object uid = securityLogic.perform(
context,
pac4jConfig,
(JEEContext ctx, Collection<UserProfile> profiles, Object... parameters) -> {
Expand All @@ -110,11 +111,11 @@ public void doFilter(ServletRequest servletRequest, ServletResponse servletRespo
return profiles.iterator().next().getId();
}
},
NOOP_HTTP_ACTION_ADAPTER,
null, null, null, null);
Copy link
Contributor Author

@Pankaj260100 Pankaj260100 Jan 25, 2024 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Changed the Authorizer from null to "none". In the older version, if it is null, it simply returns authenticated and authorized -> grant access. But in the 4.5.7 pac4j version, it uses CsrfAuthorizer as default, And because of this, I was getting 403 in API calls. So, I have set it to "none".

JEE_HTTP_ACTION_ADAPTER,
Pankaj260100 marked this conversation as resolved.
Show resolved Hide resolved
null, "none", null, null);
Pankaj260100 marked this conversation as resolved.
Show resolved Hide resolved

if (uid != null) {
AuthenticationResult authenticationResult = new AuthenticationResult(uid, authorizerName, name, null);
AuthenticationResult authenticationResult = new AuthenticationResult(uid.toString(), authorizerName, name, null);
servletRequest.setAttribute(AuthConfig.DRUID_AUTHENTICATION_RESULT, authenticationResult);
filterChain.doFilter(servletRequest, servletResponse);
}
Expand Down
4 changes: 2 additions & 2 deletions licenses.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -809,7 +809,7 @@ name: com.nimbusds nimbus-jose-jwt
license_category: binary
module: extensions/druid-pac4j
license_name: Apache License version 2.0
version: 7.9
version: 8.22.1
libraries:
- com.nimbusds: nimbus-jose-jwt

Expand All @@ -819,7 +819,7 @@ name: com.nimbusds oauth2-oidc-sdk
license_category: binary
module: extensions/druid-pac4j
license_name: Apache License version 2.0
version: 6.5
version: 8.22
libraries:
- com.nimbusds: oauth2-oidc-sdk

Expand Down
Loading