Accesstokens #1

davidblasby · 2022-07-27T19:53:17Z

This PR is improving the support for Bearer Tokens. See the updated GS OpenID documentation for setup and usage.

Summary: attach an Access Token to your HTTP requests - useful for automated (i.e. desktop/remote web) access of the REST api.

There was already some partial support for Bearer tokens. This PR improves it.

There is now better token validation (see GS doc + OIDC specification). This improves security.
Since you cannot use ID Tokens with attached access tokens, I added two new ways to get user groups:
a) from the "userinfo" endpoint (recommended for KeyCloak)
b) from the MS Graph API (only for MS Azure AD)
There is a configuration on the OIDC web page to turn on/off bearer tokens
I added some minor validation to the OIDC web page
Added a few test cases
Updated documentation for Attached Bearer Tokens
Tested with Keycloak and Azure AD
I attach the "userinfo" results to the incomming request (in the same manner as the ID/Access tokens + other spring stuff)
I attach a flag to the incomming request indicating if the authentication is BEARER or USER (in the same manner as the ID/Access tokens + other spring stuff)

Checklist

I have read the contribution guidelines.
I have sent a Contribution Licence Agreement (not required for small changes, e.g., fixing typos in documentation).
First PR targets the main branch (backports managed later; ignore for branch specific issues).
All the build checks are green (see automated QA checks).

For core and extension modules:

New unit tests have been added covering the changes.
Documentation has been updated (if change is visible to end users).
[n/a] The REST API docs have been updated (when changing configuration objects or the REST controllers).
There is an issue in the GeoServer Jira (except for changes that do not affect administrators or end users in any way).
Commit message(s) must be in the form [GEOS-XYZWV] Title of the Jira ticket.
Bug fixes and small new features are presented as a single commit.
Each commit has a single objective (if there are multiple commits, each has a separate JIRA ticket describing its goal).

* [GEOS-10591] XML view params format implementation * Update doc/en/user/source/data/database/sqlview.rst Co-authored-by: Andrea Aime <[email protected]> * Update doc/en/user/source/data/database/sqlview.rst Co-authored-by: Andrea Aime <[email protected]> * Update doc/en/user/source/data/database/sqlview.rst Co-authored-by: Andrea Aime <[email protected]> * [GEOS-10591] review fixes * Fix case insensitive viewParamsFormat handling Co-authored-by: Andrea Aime <[email protected]>

) * [GEOS-10569] Features API support sortby query parameter * [GEOS-10569] Fix format violations * [GEOS-10569] Replace List.of with ImmutableList.copyOf

Documentation on Adding an external WMTS & Configuring external WMTS layers via REST for this reference https://docs.geoserver.org/stable/en/user/data/cascaded/wmts.html

* Update seed.rst * Update seed.rst Corrected the third field by referencing the code: https://github.com/GeoWebCache/geowebcache/blob/main/geowebcache/core/src/main/java/org/geowebcache/seed/TileBreeder.java#L450

… assembly

Bumps [postgresql](https://github.com/pgjdbc/pgjdbc) from 42.3.3 to 42.4.1. - [Release notes](https://github.com/pgjdbc/pgjdbc/releases) - [Changelog](https://github.com/pgjdbc/pgjdbc/blob/master/CHANGELOG.md) - [Commits](pgjdbc/pgjdbc@REL42.3.3...REL42.4.1) --- updated-dependencies: - dependency-name: org.postgresql:postgresql dependency-type: direct:development ... Signed-off-by: dependabot[bot] <[email protected]>

rm python & java section on the REST documentation

removed python & java admonition

Update documentation on WMTS Store & WMTS Layer

… JDBCConfig (geoserver#6091)

…llection

The workspace wide templates are stored in the same 'workspaces' folder as the layer specific templates.

[GEOS-10620] Update oshi to 6.2.2 to support Apple M2 CPU

…nts:httpclient:4.5.13 (geoserver#6104)

* Fixing minor documentation issues Fixing minor grammar, usage, and typos in the documentationl. Also, rephrased a couple of areas for improved clarity. * Update doc/en/user/source/tutorials/GetFeatureInfo/raster.rst Co-authored-by: Brad Hards <[email protected]>

[GEOS-10615] Fix KML placemark template path in documentation

Using "geoserver_dir" to match docker structure.

…ver#6107) * update docker container documentation * minor changes * update to jody's comments * adding extensions Co-authored-by: david.blasby <[email protected]>

…d (broken) plural endpoints to (working) singular

jodygarnett · 2022-09-08T21:05:07Z

...penid-connect-core/src/test/java/org/geoserver/security/oauth2/MSGraphRolesResolverTest.java

@@ -0,0 +1,133 @@
+package org.geoserver.security.oauth2;


header needed

Trivial typo fix in GeoRSS tutorial

…#6134)

…n lead to OOM (geoserver#6124) * Fixed concurrency issue in setLayer that can lead to out of memory issues when iterating trough the available styles * Fixed NPE in clone() * Added unit-test that covers concurrent modification scenario * Fixed class formatting * Code changes to comply with code-style and PMD checks * Added missing copyright header Co-authored-by: Andrea Aime <[email protected]>

….21.1

[GEOS-10636] (proxied) Login is broken after upgrade to 2.22-M0 and 2.21.1

…le (geoserver#6184)

…: test

[GEOS-10654] app-schema GetFeature numberMatched fails with ID filter:…

The method arguments were in the wrong order.

…ole source

Co-authored-by: Jody Garnett <[email protected]>

…nect-core/src/main/java/org/geoserver/security/oauth2/MSGraphRolesResolver.java Co-authored-by: Jody Garnett <[email protected]>

…nect-core/src/main/java/org/geoserver/security/oauth2/OpenIdConnectAuthenticationFilter.java Co-authored-by: Jody Garnett <[email protected]>

…nect-core/src/main/java/org/geoserver/security/oauth2/OpenIdConnectAuthenticationProvider.java Co-authored-by: Jody Garnett <[email protected]>

fernandor777 and others added 30 commits July 29, 2022 10:51

[GEOS-10569] Features API support sortby query parameter (geoserver#6076

ede744f

) * [GEOS-10569] Features API support sortby query parameter * [GEOS-10569] Fix format violations * [GEOS-10569] Replace List.of with ImmutableList.copyOf

Update documentation on WMTS Store & WMTS Layer

5623579

Documentation on Adding an external WMTS & Configuring external WMTS layers via REST for this reference https://docs.geoserver.org/stable/en/user/data/cascaded/wmts.html

Update seed.rst (geoserver#6079)

84454eb

* Update seed.rst * Update seed.rst Corrected the third field by referencing the code: https://github.com/GeoWebCache/geowebcache/blob/main/geowebcache/core/src/main/java/org/geowebcache/seed/TileBreeder.java#L450

[GEOS-10585] Follow up, update start.jar

3742fcb

[GEOS-10585] Download start.sh as maven dependency and include in bin…

49633c0

… assembly

[GEOS-10603] STAC datastore nightly build packaging (geoserver#6082)

568ba2b

typo: a identifier to an identifier (geoserver#6081)

a945fad

[GEOS-10608]:Stop flooding logs with InvalidDate (and similar) at Severe

74d887a

Update stores.rst

3efd989

rm python & java section on the REST documentation

Update stores.rst

62b47e8

removed python & java admonition

Merge pull request geoserver#6080 from sgavathe/patch-1

2b4c45c

Update documentation on WMTS Store & WMTS Layer

[GEOS-10609] Fix Issue retrieving a workspace style without prefix on…

f413c75

… JDBCConfig (geoserver#6091)

[GEOS-10617] STAC module will throw exception on creation of a new co…

364cb74

…llection

[GEOS-10615] Fix KML placemark template path in documentation

b84b3ec

The workspace wide templates are stored in the same 'workspaces' folder as the layer specific templates.

[GEOS-10620] Update oshi to 6.2.2 to support Apple M2 CPU

5055b47

Merge pull request geoserver#6109 from geoserver/GEOS-10620_oshi-6.2.2

f5bf606

[GEOS-10620] Update oshi to 6.2.2 to support Apple M2 CPU

[GEOS-10462] Upgrade commons-httpclient 3.1 to org.apache.httpcompone…

e7808f9

…nts:httpclient:4.5.13 (geoserver#6104)

Merge pull request geoserver#6108 from bgalartza/patch-1

61aaad6

[GEOS-10615] Fix KML placemark template path in documentation

[GEOS-10610] Selective cache reset on stores and resources, via REST API

15bc56c

[GEOS-10606] Geneate html files for assemblies

3eac847

[GEOS-10607] Links disappearing for the Admin user

c637344

[GEOS-10618] Assemble release geoserver_dir for Docker use

119e857

Using "geoserver_dir" to match docker structure.

[GEOS-10583] Align spring-oxm with the other Spring dependencies

41b3f9d

[GEOS-10618] DOCS: Official GeoServer Docker Image (GSIP-192) (geoser…

edf788f

…ver#6107) * update docker container documentation * minor changes * update to jody's comments * adding extensions Co-authored-by: david.blasby <[email protected]>

Add missing swagger docs for associating users with groups. Also fixe…

dc092e1

…d (broken) plural endpoints to (working) singular

Removed 2 endpoints rather than flagging as Not implemented

6735da8

[GEOS-10624] Data directory and documentation update

d6f8335

jodygarnett reviewed Sep 8, 2022

View reviewed changes

bradh and others added 28 commits September 9, 2022 08:44

Trivial typo fix in GeoRSS tutorial

1d6efa4

Merge pull request geoserver#6168 from geoserver/bradh-patch-1

cf4c62b

Trivial typo fix in GeoRSS tutorial

[GEOS-10635] GeoFence: area reprojection tests are failing (geoserver…

581c57a

…#6134)

[GEOS-10625] GeoFence: improve filtering by role (geoserver#6131)

c2a3574

Remove table of now broken links to historical docs

97fe168

[GEOS-10636] (proxied) Login is broken after upgrade to 2.22-M0 and 2…

fa5f6e6

….21.1

Merge pull request geoserver#6175 from aaime/proxy_migrate

151382c

[GEOS-10636] (proxied) Login is broken after upgrade to 2.22-M0 and 2.21.1

Follow up to GEOT-7219

bde9e37

[GEOS-10603] STAC store, adding documentation

01ef263

[GEOS-10642]: Follow up - update zip packaging for cog community modu…

7654918

…le (geoserver#6184)

[GEOS-10654] app-schema GetFeature numberMatched fails with ID filter…

c61a483

…: test

Merge pull request geoserver#6178 from NielsCharlier/GEOT-7214

27ac654

[GEOS-10654] app-schema GetFeature numberMatched fails with ID filter:…

fix copy-paste typo (shapefile --> database) (geoserver#6186)

5f0eb00

[GEOS-10641] OGC API - Features - Failure on feature item CRS

238e661

The method arguments were in the wrong order.

WIP: bearer tokens

267818c

WIP: test cases, changes to web GUI, token validation, ms graph api r…

39dd718

…ole source

update doc for oidc bearer tokens

061ce21

turn off bearer tokens with config

c0d1472

jody feedback + don't use hardcoded paths in json

c630b6d

format changes

5fdcb37

remove double header

a9d06a9

Update doc/en/user/source/community/oauth2/index.rst

55bf0e0

Co-authored-by: Jody Garnett <[email protected]>

Update src/community/security/oauth2-openid-connect/oauth2-openid-con…

d89dfaf

…nect-core/src/main/java/org/geoserver/security/oauth2/MSGraphRolesResolver.java Co-authored-by: Jody Garnett <[email protected]>

Update src/community/security/oauth2-openid-connect/oauth2-openid-con…

c6f452d

…nect-core/src/main/java/org/geoserver/security/oauth2/OpenIdConnectAuthenticationFilter.java Co-authored-by: Jody Garnett <[email protected]>

Update src/community/security/oauth2-openid-connect/oauth2-openid-con…

6947fb8

…nect-core/src/main/java/org/geoserver/security/oauth2/OpenIdConnectAuthenticationProvider.java Co-authored-by: Jody Garnett <[email protected]>

reformat of jody's changes

16151cf

changes from taba90 review

4a6a5be

davidblasby force-pushed the _accesstokens branch from a78467c to 4a6a5be Compare September 20, 2022 16:15

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Accesstokens #1

Accesstokens #1

davidblasby commented Jul 27, 2022 •

edited

Loading

jodygarnett Sep 8, 2022

Accesstokens #1

Are you sure you want to change the base?

Accesstokens #1

Conversation

davidblasby commented Jul 27, 2022 • edited Loading

Checklist

jodygarnett Sep 8, 2022

Choose a reason for hiding this comment

davidblasby commented Jul 27, 2022 •

edited

Loading