-
Notifications
You must be signed in to change notification settings - Fork 32
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
fixes #213 update the JwtVerifierHandler to use SecurityConfig
- Loading branch information
Showing
6 changed files
with
88 additions
and
26 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,8 +1,8 @@ | ||
| # AccessControlHandler will be the last middleware handler before the proxy on the sidecar or the last | ||
| # one before the business handler to handle the fine-grained authorization in the business domain. | ||
| # Enable Access Control Handler | ||
| enabled: ${accessControl.enabled:true} | ||
| enabled: ${access-control.enabled:true} | ||
| # If there is no access rule defined for the endpoint, default access is denied. Users can overwrite | ||
| # this default action by setting this config value to false. If true, the handle will force users to | ||
| # define the rules for each endpoint when the access control handler is enabled. | ||
| defaultDeny: ${accessControl.defaultDeny:true} | ||
| defaultDeny: ${access-control.defaultDeny:true} |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
52 changes: 52 additions & 0 deletions
52
openapi-security/src/main/resources/config/openapi-security.yml
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,52 @@ | ||
| # Security configuration for openapi-security in light-rest-4j. It is a specific config | ||
| # for OpenAPI framework security. It is introduced to support multiple frameworks in the | ||
| # same server instance. If this file cannot be found, the generic security.yml will be | ||
| # loaded for backward compatibility. | ||
| --- | ||
| # Enable JWT verification flag. | ||
| enableVerifyJwt: ${openapi-security.enableVerifyJwt:true} | ||
|
|
||
| # Extract JWT scope token from the X-Scope-Token header and validate the JWT token | ||
| enableExtractScopeToken: ${openapi-security.enableExtractScopeToken:true} | ||
|
|
||
| # Enable JWT scope verification. Only valid when enableVerifyJwt is true. | ||
| enableVerifyScope: ${openapi-security.enableVerifyScope:true} | ||
|
|
||
| # Enable JWT scope verification. | ||
| # Only valid when (enableVerifyJwt is true) AND (enableVerifyScope is true) | ||
| enableVerifyJwtScopeToken: ${openapi-security.enableVerifyJwtScopeToken:true} | ||
|
|
||
| # If set true, the JWT verifier handler will pass if the JWT token is expired already. Unless | ||
| # you have a strong reason, please use it only on the dev environment if your OAuth 2 provider | ||
| # doesn't support long-lived token for dev environment or test automation. | ||
| ignoreJwtExpiry: ${openapi-security.ignoreJwtExpiry:false} | ||
|
|
||
| # User for test only. should be always be false on official environment. | ||
| enableMockJwt: ${openapi-security.enableMockJwt:false} | ||
|
|
||
| # JWT signature public certificates. kid and certificate path mappings. | ||
| jwt: | ||
| certificate: ${openapi-security.certificate:100=primary.crt&101=secondary.crt} | ||
| # '100': primary.crt | ||
| # '101': secondary.crt | ||
| clockSkewInSeconds: ${openapi-security.clockSkewInSeconds:60} | ||
| # Key distribution server standard: JsonWebKeySet for other OAuth 2.0 provider| X509Certificate for light-oauth2 | ||
| keyResolver: ${openapi-security.keyResolver:X509Certificate} | ||
|
|
||
| # Enable or disable JWT token logging for audit. This is to log the entire token | ||
| # or choose the next option that only logs client_id, user_id and scope. | ||
| logJwtToken: ${openapi-security.logJwtToken:true} | ||
|
|
||
| # Enable or disable client_id, user_id and scope logging if you don't want to log | ||
| # the entire token. Choose this option or the option above. | ||
| logClientUserScope: ${openapi-security.logClientUserScope:false} | ||
|
|
||
| # Enable JWT token cache to speed up verification. This will only verify expired time | ||
| # and skip the signature verification as it takes more CPU power and long time. | ||
| enableJwtCache: ${openapi-security.enableJwtCache:true} | ||
|
|
||
| # If you are using light-oauth2, then you don't need to have oauth subfolder for public | ||
| # key certificate to verify JWT token, the key will be retrieved from key endpoint once | ||
| # the first token is arrived. Default to false for dev environment without oauth2 server | ||
| # or official environment that use other OAuth 2.0 providers. | ||
| bootstrapFromKeyService: ${openapi-security.bootstrapFromKeyService:false} |
16 changes: 16 additions & 0 deletions
16
openapi-security/src/test/java/com/networknt/openapi/SecurityConfigTest.java
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,16 @@ | ||
| package com.networknt.openapi; | ||
|
|
||
| import com.networknt.security.SecurityConfig; | ||
| import org.junit.Assert; | ||
| import org.junit.Test; | ||
|
|
||
| public class SecurityConfigTest { | ||
| @Test | ||
| public void testLoadConfig() { | ||
| SecurityConfig config = SecurityConfig.load("openapi-security"); | ||
| Assert.assertTrue(config.isEnableVerifyJwt()); | ||
| Assert.assertFalse(config.isEnableVerifyJwtScopeToken()); | ||
| Assert.assertEquals(2, config.getCertificate().size()); | ||
|
|
||
| } | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,6 +1,6 @@ | ||
| --- | ||
| # Specification type and file name definition | ||
| # The filename with path of the specification file, and usually it is openapi.yaml | ||
| fileName: ${specification.fileName:config/openapi.yaml} | ||
| fileName: ${specification.fileName:openapi.yaml} | ||
| # The content type of the specification file. In most cases, we are using yaml format. | ||
| contentType: ${specification.contentType:text/yaml} |