Add Backend Auth Handler Implementation #7

isuruh15 · 2024-11-21T06:15:51Z

Purpose

Add pkjwt handler to connect external auth servers and get access token to be used as backend auth token.

Goals

To support EPIC Auth Server for APIs that are connecting to EPIC FHIR Backends

Approach

Add pkjwt mediator to connect external auth servers and get access token to be used as backend auth token.
Add Operation_Policy definitions to be used in APIs for which the PKJWT auth token flow is required

isuruh15 · 2024-12-02T06:39:29Z

distribution/apim-accelerator/resources/repository/conf/deployment.toml

+enable = true
+token_endpoint = "https://localhost:9443/oauth2/token"
+client_id = "client_id"
+keystore_password = "wso2carbon"


take from CarbonUtils

sameeragunarathne · 2024-12-04T00:50:53Z

distribution/apim-accelerator/bin/merge.sh

+        echo -e "[WARN] healthcare.backend.auth configuration already exist"
+    else
+        # code if not found
+        echo -e "\n[healthcare.backend.auth]\ntoken_endpoint = \"https://localhost:9443/oauth2/token\"\nclient_id = \"client_id\"\nclient_secret = \"client_secret\"\nprivate_key_alias = \"wso2carbon\"\nis_ssl_enabled = true"  | tee -a "${WSO2_OH_APIM_HOME}"/repository/conf/deployment.toml >/dev/null


cannot use default key alias (wso2carbon) right>?

what's the use of is_ssl_enabled?

default alias changed in daa4bf5.

The external token request can be made with or without ssl_context, the config is to toggle that

sameeragunarathne · 2024-12-04T00:52:28Z

distribution/apim-accelerator/bin/merge.sh

+        echo -e "[WARN] healthcare.backend.auth configuration already exist"
+    else
+        # code if not found
+        echo -e "\n[healthcare.backend.auth]\ntoken_endpoint = \"https://localhost:9443/oauth2/token\"\nclient_id = \"client_id\"\nclient_secret = \"client_secret\"\nprivate_key_alias = \"wso2carbon\"\nis_ssl_enabled = true"  | tee -a "${WSO2_OH_APIM_HOME}"/repository/conf/deployment.toml >/dev/null


Add comments for these deployment toml entries

added in daa4bf5

sameeragunarathne · 2024-12-04T01:04:52Z

distribution/apim-accelerator/resources/repository/conf/deployment.toml

@@ -418,6 +418,13 @@ policy.limit.time_unit = "min"
 patient_id_uri = "http://wso2.org/claims/patientId"
 patient_id_key = "patientId"

+[healthcare.backend.auth]


this should be a toml array right? in order to support multiple backends

fixed in b8da50d

sameeragunarathne · 2024-12-04T01:07:03Z

...pim.backendauth/src/main/java/org/wso2/healthcare/apim/backendauth/BackendAuthenticator.java

+            }
+            PrivateKeyJWTBackendAuthenticator privateKeyJWTBackendAuthenticator;
+            try {
+                privateKeyJWTBackendAuthenticator = new PrivateKeyJWTBackendAuthenticator();


This should be initialized at the deployment time and use, you can implement managedlifecycle in the mediator class.

Also since there can be multiple backend authenticator registrations, all should be initialized and the correct one should be picked up by the policy?

Moved the initialization to the constructor in b8da50d

sameeragunarathne · 2024-12-04T01:08:36Z

...pim.backendauth/src/main/java/org/wso2/healthcare/apim/backendauth/BackendAuthenticator.java

+public class BackendAuthenticator extends AbstractMediator {
+
+    private static final Log log = LogFactory.getLog(BackendAuthenticator.class);
+    private String authType;


Can't we define the authType in the deployment toml config?

updated in b8da50d

sameeragunarathne · 2024-12-04T01:10:22Z

...th/src/main/java/org/wso2/healthcare/apim/backendauth/PrivateKeyJWTBackendAuthenticator.java

+        String tokenEndpoint = backendAuthConfig.getAuthEndpoint();
+        String keyAlias = backendAuthConfig.getPrivateKeyAlias();
+        char[] keyStorePass = CarbonUtils.getServerConfiguration().getFirstProperty(
+                "Security.KeyStore.Password").toCharArray();


Use constants

fixed in b8da50d

sameeragunarathne · 2024-12-04T01:13:15Z

...th/src/main/java/org/wso2/healthcare/apim/backendauth/PrivateKeyJWTBackendAuthenticator.java

+        }
+        accessToken = token.getAccessToken();
+
+        messageContext.setProperty(Constants.PROPERTY_ACCESS_TOKEN, accessToken);


Why setting as a property?

removed in b8da50d

sameeragunarathne · 2024-12-04T01:13:24Z

...th/src/main/java/org/wso2/healthcare/apim/backendauth/PrivateKeyJWTBackendAuthenticator.java

+                }
+                headersMap.put(Constants.HEADER_NAME_AUTHORIZATION, Constants.HEADER_VALUE_BEARER + accessToken);
+                axisMsgCtx.setProperty(org.apache.axis2.context.MessageContext.TRANSPORT_HEADERS, headersMap);
+            }else {


Formatting issues

fixed in b8da50d

sameeragunarathne · 2024-12-05T04:22:48Z

distribution/apim-accelerator/bin/merge.sh

+        echo -e "[WARN] healthcare.backend.auth configuration already exist"
+    else
+        # code if not found
+        echo -e "\n[[healthcare.backend.auth]]\n# Name of the authentication method. This name must be matched with the Config Name policy attribute in the -\n#  - Replace Backend Auth Token policy.\nname = \"epic_pkjwt\"\n# Authentication type. Only pkjwt is supported atm.\n\nauth_type = \"pkjwt\"\n# External Auth server's Token endpoint URL.\ntoken_endpoint = \"https://localhost:9443/oauth2/token\"\nclient_id = \"client_id\"\nprivate_key_alias = \"key_alias\"\nis_ssl_enabled = true


We can support client credentials as well easily right? let's add that capability too with this effort.

added in 2baf7e5

sameeragunarathne · 2024-12-05T04:23:59Z

distribution/apim-accelerator/resources/repository/conf/deployment.toml

@@ -418,6 +418,26 @@ policy.limit.time_unit = "min"
 patient_id_uri = "http://wso2.org/claims/patientId"
 patient_id_key = "patientId"

+[[healthcare.backend.auth]]


Shall we comment these by default as well, since it should be configured to the actual values by the customer

done 2baf7e5

sameeragunarathne · 2024-12-05T04:24:47Z

distribution/apim-accelerator/resources/repository/conf/deployment.toml

+token_endpoint = "https://localhost:9443/oauth2/token"
+client_id = "client_id"
+private_key_alias = "key_alias"
+is_ssl_enabled = true


what's the use of this "is_ssl_enabled" ?

removed in 2baf7e5

sameeragunarathne · 2024-12-05T04:29:37Z

...urces/repository/resources/operation_policies/specifications/replaceBackendAuthToken_v1.json

+  "policyAttributes": [
+    {
+      "name": "configName",
+      "displayName": "Config Name",


Something like -> "Backend Auth Config" ?

done 2baf7e5

sameeragunarathne · 2024-12-05T04:30:31Z

...urces/repository/resources/operation_policies/specifications/replaceBackendAuthToken_v1.json

+  ],
+  "policyAttributes": [
+    {
+      "name": "configName",


Something like -> "backendAuthConfig" ?

done 2baf7e5

sameeragunarathne · 2024-12-05T04:31:20Z

product-accelerators/apim/components/org.wso2.healthcare.apim.backendauth/pom.xml

+        <dependency>
+            <groupId>commons-logging</groupId>
+            <artifactId>commons-logging</artifactId>
+            <version>1.3.3</version>


versions should be handled at the root pom

there was a build error in the tests of org.wso2.healthcare.apim.clientauth.jwt module once we specify the version of commons-logging in the root level.
Hence used the latest version

sameeragunarathne · 2024-12-05T04:31:40Z

product-accelerators/apim/components/org.wso2.healthcare.apim.backendauth/pom.xml

+                <groupId>org.apache.felix</groupId>
+                <artifactId>maven-bundle-plugin</artifactId>
+                <extensions>true</extensions>
+                <version>5.1.1</version>


let's use the versions from the root pom

changed
2baf7e5

sameeragunarathne · 2024-12-05T04:32:23Z

product-accelerators/apim/components/org.wso2.healthcare.apim.backendauth/readme.md

+## Configuration Model
+
+```toml
+[healthcare.backend.auth]


Readme should have a table to describe the config

added in
2baf7e5

sameeragunarathne · 2024-12-05T04:32:45Z

....apim.backendauth/src/main/java/org/wso2/healthcare/apim/backendauth/BackendAuthHandler.java

+ */
+public interface BackendAuthHandler {
+
+    String fetchValidAccessToken(MessageContext messageContext, BackendAuthConfig config);


Add java docs to interface methode

added
2baf7e5

sameeragunarathne · 2024-12-05T04:34:45Z

...pim.backendauth/src/main/java/org/wso2/healthcare/apim/backendauth/BackendAuthenticator.java

+            log.error("Auth type is not defined in the message context.");
+            return false;
+        }
+        if (config.getAuthType().equals(Constants.POLICY_ATTR_AUTH_TYPE_PKJWT)) {


let's use switch cases

changed in
2baf7e5

sameeragunarathne · 2024-12-05T04:40:31Z

...pim.backendauth/src/main/java/org/wso2/healthcare/apim/backendauth/BackendAuthenticator.java

+                if (headersMap.get(Constants.HEADER_NAME_AUTHORIZATION) != null) {
+                    headersMap.remove(Constants.HEADER_NAME_AUTHORIZATION);
+                }
+                headersMap.put(Constants.HEADER_NAME_AUTHORIZATION, Constants.HEADER_VALUE_BEARER + accessToken);


Let's get the authentication scheme(i.e 'Basic', 'Bearer') from the authenticator itself. This way someone can write a backend basic authenticator or any other scheme as well.

changed in
2baf7e5

sameeragunarathne · 2024-12-05T04:42:28Z

...care.apim.backendauth/src/main/java/org/wso2/healthcare/apim/backendauth/tokenmgt/Token.java

+
+package org.wso2.healthcare.apim.backendauth.tokenmgt;
+
+public class Token {


Let's add class comments

added in
2baf7e5

sameeragunarathne · 2024-12-05T04:42:39Z

...im.backendauth/src/main/java/org/wso2/healthcare/apim/backendauth/tokenmgt/TokenManager.java

+import org.apache.commons.logging.LogFactory;
+import org.wso2.healthcare.apim.backendauth.Constants;
+
+public class TokenManager {


Let's add class comments

added in
2baf7e5

sameeragunarathne · 2024-12-05T04:43:02Z

...hcare.apim.core/src/main/java/org/wso2/healthcare/apim/core/config/OpenHealthcareConfig.java

@@ -572,6 +579,58 @@ private ScopeMgtConfig buildScopeMgtConfig() {

    }

+    private Map<String, BackendAuthConfig> buildBackendAuthConfig() throws OpenHealthcareException {
+//        BackendAuthConfig backendAuthConfig = new BackendAuthConfig();


Let's remove commented codes

fixed in
2baf7e5

sameeragunarathne · 2024-12-05T09:14:21Z

product-accelerators/apim/components/org.wso2.healthcare.apim.backendauth/readme.md

+```toml
+[[healthcare.backend.auth]]
+name = "backend-auth"
+auth_type = "pkjwt" or "client-credentials"


Add the possible values in the comment.

added in
60cde3c

sameeragunarathne · 2024-12-05T09:15:19Z

...kendauth/src/main/java/org/wso2/healthcare/apim/backendauth/tokenmgt/InMemoryTokenStore.java

+
+        TOKEN_MAP.clear();
+    }
+}


Missing EoF

added in
60cde3c

sameeragunarathne · 2024-12-05T09:16:31Z

....backendauth/src/main/java/org/wso2/healthcare/apim/backendauth/impl/BackendAuthHandler.java

+    /**
+     * Get the auth header scheme. i.e. Bearer, Basic etc.
+     */
+    String getAuthHeaderScheme();


Let's have default method maybe? with value "Bearer"

sameeragunarathne · 2024-12-05T10:03:08Z

...in/java/org/wso2/healthcare/apim/backendauth/impl/ClientCredentialsBackendAuthenticator.java

@@ -0,0 +1,102 @@
+package org.wso2.healthcare.apim.backendauth.impl;


Missing licence

initial commit

d50ab23

isuruh15 marked this pull request as draft November 21, 2024 06:16

add configs and installation steps

e018c15

isuruh15 changed the title ~~initial commit~~ Add PKJWT Backend Auth Handler Implementation Nov 29, 2024

isuruh15 marked this pull request as ready for review November 29, 2024 05:27

isuruh15 commented Dec 2, 2024

View reviewed changes

isuruh15 added 2 commits December 3, 2024 21:18

address review comments

89d0fb3

update readme

fc5b878

isuruh15 force-pushed the pkjwt-be-auth branch from 9ea5cae to fc5b878 Compare December 3, 2024 16:27

isuruh15 changed the title ~~Add PKJWT Backend Auth Handler Implementation~~ Add Backend Auth Handler Implementation Dec 3, 2024

sameeragunarathne reviewed Dec 4, 2024

View reviewed changes

isuruh15 added 2 commits December 4, 2024 15:54

fix review comments

b8da50d

add comments to configs

daa4bf5

sameeragunarathne reviewed Dec 5, 2024

View reviewed changes

address review comments

2baf7e5

sameeragunarathne reviewed Dec 5, 2024

View reviewed changes

minor fixes

60cde3c

isuruh15 force-pushed the pkjwt-be-auth branch from 0551197 to 60cde3c Compare December 5, 2024 09:41

sameeragunarathne reviewed Dec 5, 2024

View reviewed changes

formatting fixes

a78bbae

sameeragunarathne approved these changes Dec 5, 2024

View reviewed changes

isuruh15 merged commit 59e4608 into wso2:main Dec 5, 2024
2 checks passed


		package org.wso2.healthcare.apim.backendauth.tokenmgt;

		public class Token {

		@@ -0,0 +1,102 @@
		package org.wso2.healthcare.apim.backendauth.impl;

Add Backend Auth Handler Implementation #7

Add Backend Auth Handler Implementation #7

Conversation

isuruh15 commented Nov 21, 2024 • edited Loading

Purpose

Goals

Approach

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

sameeragunarathne Dec 5, 2024 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

sameeragunarathne Dec 5, 2024 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

sameeragunarathne Dec 5, 2024 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

sameeragunarathne Dec 5, 2024 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

isuruh15 commented Nov 21, 2024 •

edited

Loading

sameeragunarathne Dec 5, 2024 •

edited

Loading

sameeragunarathne Dec 5, 2024 •

edited

Loading

sameeragunarathne Dec 5, 2024 •

edited

Loading

sameeragunarathne Dec 5, 2024 •

edited

Loading