Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

CORE-18168: Add Kafka payload and config to support changing user password #1356

Merged
merged 4 commits into from
Nov 23, 2023
Merged

CORE-18168: Add Kafka payload and config to support changing user password #1356

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
2390682
add kafka payload types to support password changes
Tom-Fitzpatrick Nov 21, 2023
85e8040
add password expiry warning config
Tom-Fitzpatrick Nov 21, 2023
48a13b5
add salt to password change kafka messages
Tom-Fitzpatrick Nov 22, 2023
bf53639
remove maximum values for password expiry configs, allowing disabling…
Tom-Fitzpatrick Nov 22, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions ...ain/resources/avro/net/corda/data/permissions/management/PermissionManagementRequest.avsc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,6 +20,8 @@
"name": "request",
"type": [
"net.corda.data.permissions.management.user.CreateUserRequest",
"net.corda.data.permissions.management.user.ChangeUserPasswordSelfRequest",
"net.corda.data.permissions.management.user.ChangeUserPasswordOtherRequest",
"net.corda.data.permissions.management.user.AddRoleToUserRequest",
"net.corda.data.permissions.management.user.RemoveRoleFromUserRequest",
"net.corda.data.permissions.management.role.CreateRoleRequest",
Expand Down
34 changes: 34 additions & 0 deletions ...urces/avro/net/corda/data/permissions/management/user/ChangeUserPasswordOtherRequest.avsc
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,34 @@
{
"type": "record",
"name": "ChangeUserPasswordOtherRequest",
"namespace": "net.corda.data.permissions.management.user",
"fields": [
{
"name": "requestedBy",
"type": "string"
},
{
"name": "username",
"type": "string"
},
{
"name": "saltValue",
"type": [ "null", "string" ]
},
{
"name": "hashedNewPassword",
"type": "string"
},
{
"name": "passwordExpiry",
"type": [
"null",
{
"type": "long",
"logicalType": "timestamp-millis"
}
],
"doc": "Time ([Instant]) in milliseconds when the user's password expires."
}
]
}
30 changes: 30 additions & 0 deletions ...ources/avro/net/corda/data/permissions/management/user/ChangeUserPasswordSelfRequest.avsc
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,30 @@
{
"type": "record",
"name": "ChangeUserPasswordSelfRequest",
"namespace": "net.corda.data.permissions.management.user",
"fields": [
{
"name": "requestedBy",
"type": "string"
},
{
"name": "saltValue",
"type": [ "null", "string" ]
},
{
"name": "hashedNewPassword",
"type": "string"
},
{
"name": "passwordExpiry",
"type": [
"null",
{
"type": "long",
"logicalType": "timestamp-millis"
}
],
"doc": "Time ([Instant]) in milliseconds when the user's password expires."
}
]
}
5 changes: 5 additions & 0 deletions data/config-schema/src/main/java/net/corda/schema/configuration/ConfigKeys.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -37,6 +37,11 @@ private ConfigKeys() {
public static final String REST_AZUREAD_TENANT_ID = "sso.azureAd.tenantId";
public static final String REST_WEBSOCKET_CONNECTION_IDLE_TIMEOUT_MS = "websocket.idleTimeoutMs";

// RBAC
public static final String RBAC_USER_PASSWORD_CHANGE_EXPIRY = "password.userPasswordChangeExpiry";
public static final String RBAC_ADMIN_PASSWORD_CHANGE_EXPIRY = "password.adminPasswordChangeExpiry";
public static final String RBAC_PASSWORD_EXPIRY_WARNING_WINDOW = "password.passwordExpiryWarningWindow";

// Secrets Service
//
// SECRETS_TYPE control which secrets service implementation will be selected.
Expand Down
32 changes: 32 additions & 0 deletions .../config-schema/src/main/resources/net/corda/schema/configuration/rbac.1.0/corda.rbac.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,32 @@
{
"$schema": "https://json-schema.org/draft/2019-09/schema",
"$id": "https://corda.r3.com/net/corda/schema/configuration/rbac/1.0/corda.rbac.json",
"title": "Corda RBAC Configuration Schema",
"description": "Configuration schema for the Roll Based Access section.",
"type": "object",
"default": {},
"properties": {
"password": {
"description": "Settings for passwords.",
"type": "object",
"default": {},
"userPasswordChangeExpiry": {
"description": "The amount of time (days) before the password must be updated again after user password change.",
"type": "integer",
"minimum": 30,
"default": 90
},
"adminPasswordChangeExpiry": {
"description": "The amount of time (days) before the password must be updated again after admin password change",
"type": "integer",
"minimum": 1,
"default": 7
},
"passwordExpiryWarningWindow": {
"description": "The time (days) before a password expires in which we begin to offer warnings about upcoming expiry.",
"type": "integer",
"default": 30
}
}
}
}