Jetty 12.0.x core security #9405

gregw · 2023-02-22T06:16:38Z

This is a core security mechanism, which will ultimately be the base of each of the EEn security handlers.

Signed-off-by: Lachlan Roberts <lachlan@webtide.com>

…core-security

gregw · 2023-02-22T06:22:05Z

@janbartel @sbordet @lorban I've taken over @lachlan-roberts's core jetty-security work.

This is still draft, but I would really appreciate some early feedback, specially on names and APIs.

The plan is in this PR to get a cleaned up mechanism working with all the common login & identity services, plus the authenticators and authentications. This will be able to be used stand alone.
Only once we are happy with this mechanism as a stand along module, will I then update the eeN modules to actually use it.

Currently it is tested to BASIC auth and data constraints. Best place to start looking is in SecurityHandlerTest

@janbartel yeah I know there is no javadoc. I will write it once the basic API is agreed apon.

...ty-security/src/main/java/org/eclipse/jetty/security/authentication/DigestAuthenticator.java

Signed-off-by: gregw <gregw@webtide.com>

…core-security

Signed-off-by: gregw <gregw@webtide.com>

gregw · 2023-02-24T05:11:20Z

Note I have a parallel branch jetty-12.0.x-core-security-ee9, where I am applying this to ee9, very much more a WIP... but it preserves the git history of the moved files.

sbordet

@gregw perhaps we need to discuss my comments, I'm sure I'm missing important details.

jetty-core/jetty-security/src/main/java/org/eclipse/jetty/security/SecurityHandler.java

jetty-core/jetty-ee/src/main/java/org/eclipse/jetty/ee/security/ConstraintAware.java

jetty-core/jetty-security/src/test/java/org/eclipse/jetty/security/SecurityHandlerTest.java

jetty-core/jetty-security/src/main/java/org/eclipse/jetty/security/Constraint.java

jetty-core/jetty-security/src/main/java/org/eclipse/jetty/security/Authenticator.java

jetty-core/jetty-security/src/main/java/org/eclipse/jetty/security/SecurityHandler.java

jetty-core/jetty-security/src/main/java/module-info.java

jetty-core/jetty-security/src/main/java/org/eclipse/jetty/security/Authentication.java

gregw · 2023-02-27T22:06:15Z

@sbordet your comments are mostly clear.

I agree on most of the renamings, however I might delay some until this is merged with eeX implementations, so the refactor will catch them..... or perhaps I won't and we can keep old names in the ee facades over the new names... except for ee10 which will expose the new names. I'll ponder the timing.

Some of your comments are correctly pointing out complications inherited from the original implementation. I'll work to simplify to just what is needed; move to a common ee; or just remove if they really are legacy.

I think I'll change the Constraint to a true Builder pattern as the fluent-like API almost works, but is surprising with regards to naming.

So thanks for the review, it's pointed out more areas that need to be de-legacied and simplified. Lots to do on the plane trip :)

jetty-core/jetty-ee/src/main/java/org/eclipse/jetty/ee/security/ConstraintAware.java

jetty-core/jetty-security/src/main/java/org/eclipse/jetty/security/Authenticator.java

jetty-core/jetty-security/src/main/java/org/eclipse/jetty/security/SecurityHandler.java

jetty-core/jetty-security/src/main/java/org/eclipse/jetty/security/Authenticator.java

jetty-core/jetty-security/src/main/java/module-info.java

jetty-core/jetty-security/src/main/java/org/eclipse/jetty/security/AbstractLoginService.java

jetty-core/jetty-security/src/main/java/org/eclipse/jetty/security/AuthenticationState.java

jetty-core/jetty-security/src/main/java/org/eclipse/jetty/security/Authenticator.java

jetty-core/jetty-security/src/main/java/org/eclipse/jetty/security/SecurityHandler.java

jetty-core/jetty-session/src/main/java/org/eclipse/jetty/session/SessionManager.java

jetty-core/jetty-util/src/main/java/org/eclipse/jetty/util/IO.java

...jetty-ee10-jaspi/src/main/java/org/eclipse/jetty/ee10/security/jaspi/JaspiAuthenticator.java

sbordet

A few more nits/renaming, almost there.

sbordet · 2023-04-29T12:01:57Z

jetty-core/jetty-security/src/main/java/org/eclipse/jetty/security/Authenticator.java

+     */
+    interface AuthConfiguration
+    {
+        String getAuthMethod();


jetty-core/jetty-security/src/main/java/org/eclipse/jetty/security/Constraint.java

jetty-core/jetty-security/src/main/java/org/eclipse/jetty/security/IdentityService.java

jetty-core/jetty-security/src/main/java/org/eclipse/jetty/security/SecurityHandler.java

sbordet · 2023-04-29T12:23:03Z

jetty-core/jetty-util/src/main/java/org/eclipse/jetty/util/IO.java

+    public static void close(Closeable closeable)
+    {
+        close((AutoCloseable)closeable);
+    }


Cannot be removed?

It should be able to be, but broke CI big time.
Jenkins is a mystery to me, so simplest to just leave it in:)

…rity/IdentityService.java Co-authored-by: Simone Bordet <simone.bordet@gmail.com>

gregw · 2023-04-29T14:18:38Z

@sbordet thanks for all the reviews. I have fixed the last round and gone through and resolved the conversations that I think are fixed. There are still a few left (boms, TODOs, etc.) but I think most of those are problems already in HEAD, so I would like to go for a merge and create new issues to fix the TODOs, boms etc. So have a look at the remaining unresolved conversations and see which ones you'd like fixed before merge.

sbordet

@gregw I need one last rename, and then I'm good: Authorization.Configuration.getAuthMethod() -> getAuthenticationName() or similar, as long as it does not contain abbreviated "auth".

Also, there are now CI failures?

sbordet · 2023-04-30T14:36:33Z

jetty-core/jetty-openid/src/main/config/etc/jetty-openid.xml

        <Arg name="issuer"><Property name="jetty.openid.provider" deprecated="jetty.openid.openIdProvider"/></Arg>
        <Arg name="authorizationEndpoint"><Property name="jetty.openid.provider.authorizationEndpoint"/></Arg>
        <Arg name="tokenEndpoint"><Property name="jetty.openid.provider.tokenEndpoint"/></Arg>
        <Arg name="clientId"><Property name="jetty.openid.clientId"/></Arg>
        <Arg name="clientSecret"><Property name="jetty.openid.clientSecret"/></Arg>
-        <Arg name="authMethod"><Property name="jetty.openid.authMethod" default="client_secret_post"/></Arg>
+        <Arg name="authenticatorName"><Property name="jetty.openid.authenticatorName" deprecated="jetty.openid.authMethod" default="client_secret_post"/></Arg>


I don't think this is right.
Elsewhere the authenticatorName is OPENID, while here is client_secret_post.
This should really be the client-side mechanism to use, so it should have a different name.
Perhaps authenticationMethod or clientAuthentication[Method|Mode]?

@lachlan-roberts HELP!!! what is "client_secret_post" about? Why can the openid authenticator change it's method name?

@sbordet I agree it looks strange.... but it started strange so maybe I open and issue, assign to Lachlan and we move on?

sbordet · 2023-04-30T14:36:54Z

jetty-core/jetty-openid/src/main/config/modules/openid.mod

+## What authenticator to use with the Token Endpoint (client_secret_post, client_secret_basic).
+# jetty.openid.authenticatorName=client_secret_post


@lachlan-roberts ditto

sbordet · 2023-04-30T14:38:01Z

...y-core/jetty-openid/src/main/java/org/eclipse/jetty/security/openid/OpenIdConfiguration.java

@@ -50,7 +50,7 @@ public class OpenIdConfiguration extends ContainerLifeCycle
    private final String clientId;
    private final String clientSecret;
    private final List<String> scopes = new ArrayList<>();
-    private final String authMethod;
+    private final String authenticatorName;


Ditto.
This file has numerous occurrences of this to fix.

@lachlan-roberts ditto ditto ditto ditto

sbordet · 2023-04-30T14:41:46Z

jetty-core/jetty-openid/src/test/java/org/eclipse/jetty/security/openid/OpenIdReamNameTest.java

@@ -11,15 +11,13 @@
 // ========================================================================
 //

-package org.eclipse.jetty.ee9.security.openid;
+package org.eclipse.jetty.security.openid;


Please rename this file to OpenIdRealmNameTest (not the missing l in Ream).

glad you pointed out the missing l. I read it 10 times and thought it was the same :)

sbordet · 2023-04-30T14:53:09Z

...0/jetty-ee10-jaspi/src/main/java/org/eclipse/jetty/ee10/security/jaspi/JaspiMessageInfo.java

-    public boolean isAuthMandatory()
-    {
-        return _map.isAuthMandatory();
+        return _map.getAuthenticatorName();


This method is never used.
_map.getAuthenticatorName() is only ever used here.
I think we can totally remove the field (and the logic) from MIMap, and that should also allow to remove the delegation by removing MIMap entirely, which in turn fixes the TODO present in the MIMap class (and hopefully also fixes the use of generics for the Map?).

I've removed the unused method, but for any other jaspi cleanup, I'd prefer to punt that to a new issue/PR. I think there is a lot that needs careful thought about JASPI, so I'd prefer not to delay this PR whilst I page in what the hell JASPI is again and do a clean up.

sbordet · 2023-05-01T17:03:02Z

@gregw just a reminder:

Authenticator.getName() -> getAuthenticationType()
OpenIdConfiguration.getAuthenticatorName() -> getAuthenticationMethod()

Almost there!

lachlan-roberts and others added 5 commits February 3, 2023 23:55

initial work on core security module

9ec946e

Signed-off-by: Lachlan Roberts <lachlan@webtide.com>

Merge remote-tracking branch 'origin/jetty-12.0.x' into jetty-12.0.x-…

cde90ab

…core-security

Merge branch 'jetty-12.0.x' into jetty-12.0.x-core-security

94eca14

WIP

ab4b3b8

BASIC auth working

dde8780

gregw requested a review from janbartel February 22, 2023 06:22

github-advanced-security bot found potential problems Feb 22, 2023

View reviewed changes

...ty-security/src/main/java/org/eclipse/jetty/security/authentication/DigestAuthenticator.java Dismissed Show resolved Hide resolved

gregw added 11 commits February 22, 2023 23:14

FORM auth working

7ff7d89

FORM auth working

2db4777

FORM auth POST working

5e929d5

Merge branch 'jetty-12.0.x' into jetty-12.0.x-core-security

e1de94e

WIP

63f394c

Signed-off-by: gregw <gregw@webtide.com>

WIP

a926bc1

Signed-off-by: gregw <gregw@webtide.com>

WIP

87fff1a

WIP

724141c

Merge remote-tracking branch 'origin/jetty-12.0.x' into jetty-12.0.x-…

b34ea8f

…core-security

WIP

214a28c

Signed-off-by: gregw <gregw@webtide.com>

WIP

e33d076

gregw added 2 commits February 26, 2023 08:53

WIP auth parameters

70db469

Merge branch 'jetty-12.0.x' into jetty-12.0.x-core-security

13cb316

sbordet requested changes Feb 27, 2023

View reviewed changes

WIP

00c81c4

lorban reviewed Mar 1, 2023

View reviewed changes

gregw added 4 commits March 3, 2023 14:39

Merge branch 'jetty-12.0.x' into jetty-12.0.x-core-security

3b31f48

WIP

6216634

WIP

8044355

WIP

22fe002

gregw added 4 commits April 27, 2023 00:22

Merge branch 'jetty-12.0.x' into jetty-12.0.x-core-security

deffe0b

resovled some TODOs

1bd1808

resolved some TODOs

a250a39

Moved some classes to better locations

81ef12f

sbordet requested changes Apr 27, 2023

View reviewed changes

gregw added 2 commits April 27, 2023 21:29

Renamed Authenticator.Configuration

7f8ca79

updates from a review

e95a478

gregw requested a review from sbordet April 27, 2023 20:15

updates from a review

5b5f3d6

sbordet requested changes Apr 29, 2023

View reviewed changes

gregw and others added 5 commits April 29, 2023 15:56

Update jetty-core/jetty-security/src/main/java/org/eclipse/jetty/secu…

d5b18bf

…rity/IdentityService.java Co-authored-by: Simone Bordet <simone.bordet@gmail.com>

comment usage of MD5

8a35ff5

Merge branch 'jetty-12.0.x' into jetty-12.0.x-core-security

03c8537

removed redundant request field

05f7507

removed redundant response field

37e0d5d

gregw requested a review from sbordet April 29, 2023 14:36

sbordet requested changes Apr 29, 2023

View reviewed changes

gregw added 2 commits April 29, 2023 22:48

updates from a review

4080c22

updates from a review

0fb1545

sbordet requested changes Apr 30, 2023

View reviewed changes

gregw added 2 commits April 30, 2023 18:38

updates from review

e5e7322

Merge branch 'jetty-12.0.x' into jetty-12.0.x-core-security

bc64fc8

gregw added 2 commits May 1, 2023 21:07

updates from review

56e5731

finish renaming

5cbf23b

gregw requested a review from sbordet May 2, 2023 12:39

sbordet approved these changes May 2, 2023

View reviewed changes

gregw merged commit 7275bf1 into jetty-12.0.x May 2, 2023
4 checks passed

joakime deleted the jetty-12.0.x-core-security branch August 7, 2023 20:15

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Jetty 12.0.x core security #9405

Jetty 12.0.x core security #9405

gregw commented Feb 22, 2023

gregw commented Feb 22, 2023

gregw commented Feb 24, 2023

sbordet left a comment

gregw commented Feb 27, 2023

sbordet left a comment

sbordet Apr 29, 2023

sbordet Apr 29, 2023

gregw Apr 29, 2023

gregw commented Apr 29, 2023

sbordet left a comment •

edited

sbordet Apr 30, 2023

gregw Apr 30, 2023

sbordet Apr 30, 2023

gregw Apr 30, 2023

sbordet Apr 30, 2023

gregw Apr 30, 2023

sbordet Apr 30, 2023

gregw Apr 30, 2023

sbordet Apr 30, 2023

gregw Apr 30, 2023

sbordet commented May 1, 2023

		## What authenticator to use with the Token Endpoint (client_secret_post, client_secret_basic).
		# jetty.openid.authenticatorName=client_secret_post

Jetty 12.0.x core security #9405

Jetty 12.0.x core security #9405

Conversation

gregw commented Feb 22, 2023

gregw commented Feb 22, 2023

gregw commented Feb 24, 2023

sbordet left a comment

Choose a reason for hiding this comment

gregw commented Feb 27, 2023

sbordet left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

gregw commented Apr 29, 2023

sbordet left a comment • edited

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

sbordet commented May 1, 2023

sbordet left a comment •

edited