Merge pull request #3275 from fnxpt/3255

Webhook alert token and new user alerts

docs/_docs/integrations/notifications.md

@@ -44,6 +44,8 @@ multiple levels, while others can only ever have a single level.
 | SYSTEM    | INDEXING_SERVICE          | (Any)         | Notifications generated as a result of performing maintenance on Dependency-Tracks internal index used for global searching       |
 | SYSTEM    | FILE_SYSTEM               | (Any)         | Notifications generated as a result of a file system operation. These are typically only generated on error conditions            |
 | SYSTEM    | REPOSITORY                | (Any)         | Notifications generated as a result of interacting with one of the supported repositories such as Maven Central, RubyGems, or NPM |
+| SYSTEM    | USER_CREATED                | INFORMATIONAL         | Notifications generated as a result of a user creation |
+| SYSTEM    | USER_DELETED                | INFORMATIONAL         | Notifications generated as a result of a user deletion |
 | PORTFOLIO | NEW_VULNERABILITY         | INFORMATIONAL | Notifications generated whenever a new vulnerability is identified                                                                |
 | PORTFOLIO | NEW_VULNERABLE_DEPENDENCY | INFORMATIONAL | Notifications generated as a result of a vulnerable component becoming a dependency of a project                                  |
 | PORTFOLIO | GLOBAL_AUDIT_CHANGE       | INFORMATIONAL | Notifications generated whenever an analysis or suppression state has changed on a finding from a component (global)              |
@@ -365,6 +367,46 @@ This type of notification will always contain:
 }
 ```
 
+#### USER_CREATED
+
+```json
+{
+  "notification": {
+    "level": "INFORMATIONAL",
+    "scope": "SYSTEM",
+    "group": "USER_CREATED",
+    "timestamp": "2022-05-12T23:07:59.611303",
+    "title": "User Created",
+    "content": "LDAP user created",
+    "subject": {
+      "id": "user",
+      "username": "user",
+      "name": "User 1",
+      "email": "[email protected]",
+      }
+  }
+}
+```
+
+#### USER_DELETED
+
+```json
+{
+  "notification": {
+    "level": "INFORMATIONAL",
+    "scope": "SYSTEM",
+    "group": "USER_CREATED",
+    "timestamp": "2022-05-12T23:07:59.611303",
+    "title": "User Deleted",
+    "content": "LDAP user deleted",
+    "subject": {
+      "username": "user",
+    }
+  }
+}
+```
+
+
 ### Override of default templates
 Default publishers are installed in the database at startup using templates retrieved in Dependency-Track classpath. Those publishers are **read-only** by default.
 Dependency-Track can be configured from the administrative page to allow an override of the default templates. This requires SYSTEM_CONFIGURATION permission.
@@ -376,7 +418,7 @@ Switch on enable default template override flag and provide a filesystem base di
 
 ![notification publisher general configuration](/images/screenshots/notifications-publisher-override-template.png)
 
-> The default template override flag is switched off by default and can set at initial startup with environment variable `DEFAULT_TEMPLATES_OVERRIDE_ENABLED`. 
+> The default template override flag is switched off by default and can set at initial startup with environment variable `DEFAULT_TEMPLATES_OVERRIDE_ENABLED`.
 > The default templates base directory is set to ${user.home} by default and can be set at initial startup with environment variable `DEFAULT_TEMPLATES_OVERRIDE_BASE_DIRECTORY`.
 
 To override all default templates, you must have the following [Pebble Templates](https://pebbletemplates.io/) template files inside the configured base directory.

src/main/java/org/dependencytrack/notification/NotificationConstants.java

@@ -61,6 +61,8 @@ public static class Title {
         public static final String VEX_CONSUMED = "Vulnerability Exploitability Exchange (VEX) Consumed";
         public static final String VEX_PROCESSED = "Vulnerability Exploitability Exchange (VEX) Processed";
         public static final String PROJECT_CREATED = "Project Added";
+        public static final String USER_CREATED = "User Created";
+        public static final String USER_DELETED = "User Deleted";
     }
 
 }

src/main/java/org/dependencytrack/notification/NotificationGroup.java

@@ -43,5 +43,7 @@ public enum NotificationGroup {
     VEX_CONSUMED,
     VEX_PROCESSED,
     POLICY_VIOLATION,
-    PROJECT_CREATED
+    PROJECT_CREATED,
+    USER_CREATED,
+    USER_DELETED
 }

src/main/java/org/dependencytrack/notification/publisher/AbstractWebhookPublisher.java

@@ -76,6 +76,8 @@ public void publish(final PublishContext ctx, final PebbleTemplate template, fin
             } else {
                 request.addHeader("Authorization", "Bearer " + credentials.password);
             }
+        } else if (getToken(config) != null) {
+            request.addHeader(getTokenHeader(config), getToken(config));
         }
 
         try {
@@ -107,6 +109,14 @@ protected AuthCredentials getAuthCredentials() {
         return null;
     }
 
+    protected String getToken(final JsonObject config) {
+        return config.getString(CONFIG_TOKEN, null);
+    }
+
+    protected String getTokenHeader(final JsonObject config) {
+        return config.getString(CONFIG_TOKEN_HEADER, "X-Api-Key");
+    }
+
     protected record AuthCredentials(String user, String password) {
     }
 

src/main/java/org/dependencytrack/notification/publisher/Publisher.java

@@ -20,6 +20,7 @@
 
 import alpine.common.util.UrlUtil;
 import alpine.model.ConfigProperty;
+import alpine.model.UserPrincipal;
 import alpine.notification.Notification;
 import io.pebbletemplates.pebble.PebbleEngine;
 import io.pebbletemplates.pebble.template.PebbleTemplate;
@@ -52,6 +53,8 @@ public interface Publisher {
     String CONFIG_TEMPLATE_MIME_TYPE_KEY = "mimeType";
 
     String CONFIG_DESTINATION = "destination";
+    String CONFIG_TOKEN = "token";
+    String CONFIG_TOKEN_HEADER = "tokenHeader";
 
     void inform(final PublishContext ctx, final Notification notification, final JsonObject config);
 
@@ -124,6 +127,11 @@ default String prepareTemplate(final Notification notification, final PebbleTemp
                     context.put("subject", subject);
                     context.put("subjectJson", NotificationUtil.toJson(subject));
                 }
+            } else if  (NotificationScope.SYSTEM.name().equals(notification.getScope())) {
+                if (notification.getSubject() instanceof final UserPrincipal subject) {
+                    context.put("subject", subject);
+                    context.put("subjectJson", NotificationUtil.toJson(subject));
+                }
             }
             enrichTemplateContext(context);
 

src/main/java/org/dependencytrack/resources/v1/UserResource.java

@@ -26,6 +26,8 @@
 import alpine.model.Permission;
 import alpine.model.Team;
 import alpine.model.UserPrincipal;
+import alpine.notification.Notification;
+import alpine.notification.NotificationLevel;
 import alpine.security.crypto.KeyManager;
 import alpine.server.auth.AlpineAuthenticationException;
 import alpine.server.auth.AuthenticationNotRequired;
@@ -45,6 +47,9 @@
 import org.apache.commons.lang3.StringUtils;
 import org.dependencytrack.auth.Permissions;
 import org.dependencytrack.model.IdentifiableObject;
+import org.dependencytrack.notification.NotificationConstants;
+import org.dependencytrack.notification.NotificationGroup;
+import org.dependencytrack.notification.NotificationScope;
 import org.dependencytrack.persistence.QueryManager;
 import org.owasp.security.logging.SecurityMarkers;
 
@@ -383,6 +388,13 @@ public Response createLdapUser(LdapUser jsonUser) {
             if (user == null) {
                 user = qm.createLdapUser(jsonUser.getUsername());
                 super.logSecurityEvent(LOGGER, SecurityMarkers.SECURITY_AUDIT, "LDAP user created: " + jsonUser.getUsername());
+                Notification.dispatch(new Notification()
+                        .scope(NotificationScope.SYSTEM)
+                        .group(NotificationGroup.USER_CREATED)
+                        .title(NotificationConstants.Title.USER_CREATED)
+                        .level(NotificationLevel.INFORMATIONAL)
+                        .content("LDAP user created")
+                        .subject(user));
                 return Response.status(Response.Status.CREATED).entity(user).build();
             } else {
                 return Response.status(Response.Status.CONFLICT).entity("A user with the same username already exists. Cannot create new user.").build();
@@ -407,8 +419,16 @@ public Response deleteLdapUser(LdapUser jsonUser) {
         try (QueryManager qm = new QueryManager()) {
             final LdapUser user = qm.getLdapUser(jsonUser.getUsername());
             if (user != null) {
+                final LdapUser detachedUser = qm.getPersistenceManager().detachCopy(user);
                 qm.delete(user);
-                super.logSecurityEvent(LOGGER, SecurityMarkers.SECURITY_AUDIT, "LDAP user deleted: " + jsonUser.getUsername());
+                super.logSecurityEvent(LOGGER, SecurityMarkers.SECURITY_AUDIT, "LDAP user deleted: " + detachedUser);
+                Notification.dispatch(new Notification()
+                        .scope(NotificationScope.SYSTEM)
+                        .group(NotificationGroup.USER_DELETED)
+                        .title(NotificationConstants.Title.USER_DELETED)
+                        .level(NotificationLevel.INFORMATIONAL)
+                        .content("LDAP user deleted")
+                        .subject(detachedUser));
                 return Response.status(Response.Status.NO_CONTENT).build();
             } else {
                 return Response.status(Response.Status.NOT_FOUND).entity("The user could not be found.").build();
@@ -456,6 +476,13 @@ public Response createManagedUser(ManagedUser jsonUser) {
                         String.valueOf(PasswordService.createHash(jsonUser.getNewPassword().toCharArray())),
                         jsonUser.isForcePasswordChange(), jsonUser.isNonExpiryPassword(), jsonUser.isSuspended());
                 super.logSecurityEvent(LOGGER, SecurityMarkers.SECURITY_AUDIT, "Managed user created: " + jsonUser.getUsername());
+                Notification.dispatch(new Notification()
+                        .scope(NotificationScope.SYSTEM)
+                        .group(NotificationGroup.USER_CREATED)
+                        .title(NotificationConstants.Title.USER_CREATED)
+                        .level(NotificationLevel.INFORMATIONAL)
+                        .content("Managed user created")
+                        .subject(user));
                 return Response.status(Response.Status.CREATED).entity(user).build();
             } else {
                 return Response.status(Response.Status.CONFLICT).entity("A user with the same username already exists. Cannot create new user.").build();
@@ -522,8 +549,16 @@ public Response deleteManagedUser(ManagedUser jsonUser) {
         try (QueryManager qm = new QueryManager()) {
             final ManagedUser user = qm.getManagedUser(jsonUser.getUsername());
             if (user != null) {
+                final ManagedUser detachedUser = qm.getPersistenceManager().detachCopy(user);
                 qm.delete(user);
-                super.logSecurityEvent(LOGGER, SecurityMarkers.SECURITY_AUDIT, "Managed user deleted: " + jsonUser.getUsername());
+                super.logSecurityEvent(LOGGER, SecurityMarkers.SECURITY_AUDIT, "Managed user deleted: " +detachedUser);
+                Notification.dispatch(new Notification()
+                        .scope(NotificationScope.SYSTEM)
+                        .group(NotificationGroup.USER_DELETED)
+                        .title(NotificationConstants.Title.USER_DELETED)
+                        .level(NotificationLevel.INFORMATIONAL)
+                        .content("Managed user deleted")
+                        .subject(detachedUser));
                 return Response.status(Response.Status.NO_CONTENT).build();
             } else {
                 return Response.status(Response.Status.NOT_FOUND).entity("The user could not be found.").build();
@@ -555,6 +590,13 @@ public Response createOidcUser(final OidcUser jsonUser) {
             if (user == null) {
                 user = qm.createOidcUser(jsonUser.getUsername());
                 super.logSecurityEvent(LOGGER, SecurityMarkers.SECURITY_AUDIT, "OpenID Connect user created: " + jsonUser.getUsername());
+                Notification.dispatch(new Notification()
+                        .scope(NotificationScope.SYSTEM)
+                        .group(NotificationGroup.USER_CREATED)
+                        .title(NotificationConstants.Title.USER_CREATED)
+                        .level(NotificationLevel.INFORMATIONAL)
+                        .content("OpenID Connect user created")
+                        .subject(user));
                 return Response.status(Response.Status.CREATED).entity(user).build();
             } else {
                 return Response.status(Response.Status.CONFLICT).entity("A user with the same username already exists. Cannot create new user.").build();
@@ -579,8 +621,16 @@ public Response deleteOidcUser(final OidcUser jsonUser) {
         try (QueryManager qm = new QueryManager()) {
             final OidcUser user = qm.getOidcUser(jsonUser.getUsername());
             if (user != null) {
+                final OidcUser detachedUser = qm.getPersistenceManager().detachCopy(user);
                 qm.delete(user);
-                super.logSecurityEvent(LOGGER, SecurityMarkers.SECURITY_AUDIT, "OpenID Connect user deleted: " + jsonUser.getUsername());
+                super.logSecurityEvent(LOGGER, SecurityMarkers.SECURITY_AUDIT, "OpenID Connect user deleted: " + detachedUser);
+                Notification.dispatch(new Notification()
+                        .scope(NotificationScope.SYSTEM)
+                        .group(NotificationGroup.USER_DELETED)
+                        .title(NotificationConstants.Title.USER_DELETED)
+                        .level(NotificationLevel.INFORMATIONAL)
+                        .content("OpenID Connect user deleted")
+                        .subject(detachedUser));
                 return Response.status(Response.Status.NO_CONTENT).build();
             } else {
                 return Response.status(Response.Status.NOT_FOUND).entity("The user could not be found.").build();

src/main/java/org/dependencytrack/util/NotificationUtil.java

@@ -19,6 +19,7 @@
 package org.dependencytrack.util;
 
 import alpine.model.ConfigProperty;
+import alpine.model.UserPrincipal;
 import alpine.notification.Notification;
 import alpine.notification.NotificationLevel;
 import org.apache.commons.io.FileUtils;
@@ -272,6 +273,22 @@ public static JsonObject toJson(final Project project) {
         return projectBuilder.build();
     }
 
+    public static JsonObject toJson(final UserPrincipal user) {
+        final JsonObjectBuilder userBuilder = Json.createObjectBuilder();
+
+        userBuilder.add("username", user.getUsername());
+
+        if (user.getName() != null) {
+            userBuilder.add("name", user.getName());
+        }
+
+        if (user.getEmail() != null) {
+            userBuilder.add("email", user.getEmail());
+        }
+
+        return userBuilder.build();
+    }
+
     public static JsonObject toJson(final Component component) {
         final JsonObjectBuilder componentBuilder = Json.createObjectBuilder();
         componentBuilder.add("uuid", component.getUuid().toString());