Api application registration & token generation restructuring #536
Open
rajitha
wants to merge 2 commits from rajitha/device-mgt-core:auth-restructure
into master
Loading…
Reference in new issue
There is no content yet.
Delete Branch 'rajitha/device-mgt-core:auth-restructure'
Deleting a branch is permanent. It CANNOT be undone. Continue?
Purpose
51777d6714
to1eb2d23adf
3 weeks ago1eb2d23adf
to40a5b00f80
3 weeks agoWIP: DCR and Token generation process restructuringto Api application registration & token generation restructuring 3 weeks agoString msg = "Invalid tenant domain : " + tenantDomain;
return Response.status(Response.Status.NOT_ACCEPTABLE).entity(msg).build();
}
How this endpoint secured? if not properly secured it is possible to obtain client credentials for given tenant using this API.
ApiApplicationConstants.DEFAULT_TOKEN_TYPE, username, false,
ApiApplicationConstants.DEFAULT_VALIDITY_PERIOD, PrivilegedCarbonContext.getThreadLocalCarbonContext().getUserRealm()
.getRealmConfiguration().getAdminPassword(), null, null, null, false);
ApiApplicationKey apiApplicationKey =
Can't we cache the apiApplicationKey for future use?
if ((registrationProfile.getTags() != null && registrationProfile.getTags().length != 0)) {
if (!APIUtil.getAllowedApisTags().containsAll(Arrays.asList(registrationProfile.getTags()))) {
return Response.status(Response.Status.NOT_ACCEPTABLE).entity("APIs(Tags) are not allowed to this user."
if (!new HashSet<>(APIUtil.getAllowedApisTags()).containsAll(Arrays.asList(registrationProfile.getTags()))) {
How this endpoint secured? if not properly secured it is possible to obtain client credentials for given registration profile using this API.
ApiApplicationKey apiApplicationKey =
apiManagementProviderService.registerApiApplication(idnAuthenticationProfile,
apiApplicationProfile);
return Response.status(Response.Status.CREATED).entity(apiApplicationKey).build();
Can't we cache the apiApplicationKey for future use?
@Provider
@Produces(APPLICATION_JSON)
@Consumes(APPLICATION_JSON)
public class GsonMessageBodyHandler implements MessageBodyWriter<Object>, MessageBodyReader<Object> {
I've seen this GsonMessageBodyHandler code duplicate over all the WARs. Can't we just have a common library with similar stuffs?
public class GsonMessageBodyHandler implements MessageBodyWriter<Object>, MessageBodyReader<Object> {
private Gson gson;
private static final String UTF_8 = "UTF-8";
Do not define constants for existing constants. Use constant provided by framework.
<context-param>
<param-name>doAuthentication</param-name>
<param-value>true</param-value>
<param-value>false</param-value>
This makes a serious security issue.
https://repository.entgra.net/community/device-mgt-core/pulls/536/files#issuecomment-20531
https://repository.entgra.net/community/device-mgt-core/pulls/536/files#issuecomment-20529
<context-param>
<param-name>basicAuth</param-name>
<param-value>true</param-value>
<param-value>false</param-value>
This makes a serious security issue.
https://repository.entgra.net/community/device-mgt-core/pulls/536/files#issuecomment-20531
https://repository.entgra.net/community/device-mgt-core/pulls/536/files#issuecomment-20529
Previous dcr endpoints were unsecure, thought there are uses of that, however added authentication here.
<Bundle-Description>API Management Application Bundle</Bundle-Description>
<Private-Package>io.entgra.device.mgt.core.apimgt.application.extension.internal</Private-Package>
<Import-Packages>
com.google.gson.*;version="${google.gson.version}",
Do not use wildcard imports here. Use exact package name.
return username;
}
public void setUsername(String username) {
Add method comment specifying this method require FQUN and will extracts the tenant domain from FQUN. According to logic, if user name provided without a tenant domain, it will assign to super tenant. So developer has to be aware.
private static final OkHttpClient client = new OkHttpClient(HttpsTrustManagerUtils.getSSLClient().newBuilder());
private static final MediaType JSON = MediaType.parse("application/json; charset=utf-8");
private static final Gson gson = new Gson();
private static final String host = System.getProperty(Constants.IOT_CORE_HOST);
Shouldn't this call APIG MGT host? In a clustered environment with a seperate APIG profile, the request will be sent to IoT Core according to this.
import java.util.Map;
import java.util.concurrent.ConcurrentHashMap;
public class OAuthClient implements IOAuthClientService {
Use synchronized blocks and appropriate singletons to safeguard critical paths of the flow. Make sure there will be no parallel executions of critical paths such as api application creations, update, token generation, renewal etc.
Reviewers