Skip to content

Commit

Permalink
Forenkling av TokenFlow (#1318)
Browse files Browse the repository at this point in the history 
* Forenkling av TokenFlow

* Fiks test

* Et par kommentarer

---------

Co-authored-by: Michal J. Sladek <[email protected]>
  • Loading branch information
@jolarsen @mrsladek
jolarsen and mrsladek authored Aug 29, 2023
1 parent d677ea4 commit fb76ed5
Show file tree
Hide file tree
Showing 6 changed files with 23 additions and 50 deletions.
3 changes: 3 additions & 0 deletions felles/kontekst/src/main/java/no/nav/vedtak/sikkerhet/kontekst/BasisKontekst.java
View file
Original file line number Diff line number Diff line change
Expand Up @@ -50,10 +50,13 @@ public String getKonsumentId() {
return konsumentId;
}

// Brukes kun i abakus / dignostikk. Sjekk om kan endres til forProsesstaskUtenSystembruker
@Deprecated(forRemoval = true) // Erstatt med forProsesstaskUtenSystembruker
public static BasisKontekst forProsesstask() {
return new BasisKontekst(SikkerhetContext.SYSTEM, Systembruker.username(), IdentType.Prosess, Systembruker.username());
}

// Denne brukes i prosesstask
public static BasisKontekst forProsesstaskUtenSystembruker() {
var username = "srv" + Optional.ofNullable(Environment.current().application()).orElse("local");
var konsument = Optional.ofNullable(Environment.current().clientId()).orElse(username);
Expand Down
36 changes: 7 additions & 29 deletions felles/oidc/src/main/java/no/nav/vedtak/sikkerhet/oidc/token/TokenProvider.java
View file
Original file line number Diff line number Diff line change
Expand Up @@ -9,8 +9,6 @@
import no.nav.vedtak.sikkerhet.kontekst.KontekstProvider;
import no.nav.vedtak.sikkerhet.kontekst.RequestKontekst;
import no.nav.vedtak.sikkerhet.kontekst.SikkerhetContext;
import no.nav.vedtak.sikkerhet.oidc.config.ConfigProvider;
import no.nav.vedtak.sikkerhet.oidc.config.OpenIDConfiguration;
import no.nav.vedtak.sikkerhet.oidc.config.OpenIDProvider;
import no.nav.vedtak.sikkerhet.oidc.token.impl.AzureBrukerTokenKlient;
import no.nav.vedtak.sikkerhet.oidc.token.impl.AzureSystemTokenKlient;
Expand All @@ -25,8 +23,6 @@ public final class TokenProvider {
.or(() -> Optional.ofNullable(Environment.current().application()))
.orElse("local");
private static final Set<SikkerhetContext> USE_SYSTEM = Set.of(SikkerhetContext.SYSTEM, SikkerhetContext.WSREQUEST);
// Denne finnes utelukkende pga k9-verdikjede ..... sjekk om kan fjerne =false i abakus
private static final boolean SYSTEM_USE_AZURE = !"false".equalsIgnoreCase(Environment.current().getProperty("token.system.use.azure"));

private TokenProvider() {
}
Expand All @@ -38,8 +34,7 @@ public static SikkerhetContext getCurrentKontekst() {
public static OpenIDToken getTokenForKontekst(String scopes) {
var kontekst = KONTEKST_PROVIDER.getKontekst();
if (USE_SYSTEM.contains(kontekst.getContext())) {
// Bytt om til AzureCC når k9-verdikjede er klar for det.....
return SYSTEM_USE_AZURE ? getAzureSystemToken(scopes) : getStsSystemToken();
return getAzureSystemToken(scopes);
}
if (kontekst instanceof RequestKontekst requestKontekst) {
return getOutgoingTokenFor(requestKontekst, scopes);
Expand All @@ -55,12 +50,11 @@ private static OpenIDToken getOutgoingTokenFor(RequestKontekst requestKontekst,
}
var providerIncoming = getProvider(incoming);
var identType = Optional.ofNullable(requestKontekst.getIdentType()).orElse(IdentType.InternBruker);
if (OpenIDProvider.AZUREAD.equals(providerIncoming)) {
return identType.erSystem() ? getAzureSystemToken(scopes) : veksleAzureAccessToken(requestKontekst.getUid(), incoming, scopes);
} else if (OpenIDProvider.TOKENX.equals(providerIncoming)){
return TokenXchange.exchange(incoming, scopes);
}
return incoming;
return switch (providerIncoming) {
case AZUREAD -> identType.erSystem() ? getAzureSystemToken(scopes) : veksleAzureAccessToken(requestKontekst.getUid(), incoming, scopes);
case TOKENX -> TokenXchange.exchange(incoming, scopes);
case STS -> getAzureSystemToken(scopes);
};
}

public static OpenIDToken getTokenForSystem() {
Expand All @@ -84,9 +78,7 @@ public static OpenIDToken getTokenForSystem(OpenIDProvider provider, String scop
public static String getConsumerIdFor(SikkerhetContext context) {
return switch (context) {
case REQUEST, WSREQUEST -> getCurrentConsumerId();
case SYSTEM -> SYSTEM_USE_AZURE ? ENV_CLIENT_ID : ConfigProvider.getOpenIDConfiguration(OpenIDProvider.STS)
.map(OpenIDConfiguration::clientId)
.orElse(null);
case SYSTEM -> ENV_CLIENT_ID;
};
}

Expand All @@ -95,20 +87,6 @@ public static String getCurrentConsumerId() {
return Optional.ofNullable(kontekst.getKonsumentId()).orElseGet(kontekst::getUid);
}

// Ved omlegging til AzureAD for system-kontekst må denne gjennomgås (returner true hvis system)
public static boolean isAzureContext() {
try {
var kontekst = KONTEKST_PROVIDER.getKontekst();
if (kontekst instanceof RequestKontekst requestKontekst) {
return OpenIDProvider.AZUREAD.equals(getProvider(requestKontekst.getToken()));
} else {
return SikkerhetContext.SYSTEM.equals(kontekst.getContext()) && SYSTEM_USE_AZURE;
}
} catch (Exception e) {
return false;
}
}

private static OpenIDToken getStsSystemToken() {
return StsSystemTokenKlient.hentAccessToken();
}
Expand Down
4 changes: 2 additions & 2 deletions ...on-klient/src/test/java/no/nav/vedtak/felles/integrasjon/person/PersondataKlientTest.java
View file
Original file line number Diff line number Diff line change
Expand Up @@ -82,7 +82,7 @@ void skal_returnere_person() {
var rq = captor.getValue();
rq.validateRequest(r -> assertThat(r.headers().map().get("TEMA")).contains("FOR"));
rq.validateRequest(r -> assertThat(r.headers().map().get("behandlingsnummer")).contains(Persondata.Ytelse.FORELDREPENGER.getBehandlingsnummer()));
assertThat(rq.validateDelayedHeaders(Set.of("Authorization", "Nav-Consumer-Token", "Nav-Consumer-Id"))).isTrue();
assertThat(rq.validateDelayedHeaders(Set.of("Authorization", "Nav-Consumer-Id"))).isTrue();
}

@Test
Expand Down Expand Up @@ -171,7 +171,7 @@ void testErrorHandler() {
assertEquals(HttpURLConnection.HTTP_UNAUTHORIZED, e.getStatus());
}

@RestClientConfig(tokenConfig = TokenFlow.ADAPTIVE_ADD_CONSUMER, endpointProperty = "pdl.base.url", endpointDefault = "http://pdl-api.pdl/graphql", scopesProperty = "pdl.scopes", scopesDefault = "api://prod-fss.pdl.pdl-api/.default")
@RestClientConfig(tokenConfig = TokenFlow.ADAPTIVE, endpointProperty = "pdl.base.url", endpointDefault = "http://pdl-api.pdl/graphql", scopesProperty = "pdl.scopes", scopesDefault = "api://prod-fss.pdl.pdl-api/.default")
private static class TestPdlKLient extends AbstractPersonKlient {
public TestPdlKLient(RestClient restKlient) {
super(restKlient, Tema.FOR);
Expand Down
3 changes: 0 additions & 3 deletions .../rest-klient/src/main/java/no/nav/vedtak/felles/integrasjon/rest/OidcContextSupplier.java
View file
Original file line number Diff line number Diff line change
Expand Up @@ -34,7 +34,4 @@ public Supplier<OpenIDToken> consumerToken() {
return TokenProvider::getTokenForSystem;
}

public boolean isAzureContext() {
return TokenProvider.isAzureContext();
}
}
15 changes: 6 additions & 9 deletions integrasjon/rest-klient/src/main/java/no/nav/vedtak/felles/integrasjon/rest/RestRequest.java
View file
Original file line number Diff line number Diff line change
Expand Up @@ -69,8 +69,8 @@ private RestRequest(HttpRequest.Builder builder, TokenFlow tokenConfig, String s
if (!TokenFlow.NO_AUTH_NEEDED.equals(tokenConfig)) {
this.authorization(selectTokenSupplier(tokenConfig, scopes)).validator(RestRequest::validateRestHeaders);
}
if (TokenFlow.STS_ADD_CONSUMER.equals(tokenConfig) || TokenFlow.ADAPTIVE_ADD_CONSUMER.equals(tokenConfig)) {
this.consumerToken(tokenConfig);
if (TokenFlow.STS_ADD_CONSUMER.equals(tokenConfig)) {
this.consumerToken();
}
}

Expand Down Expand Up @@ -140,10 +140,7 @@ private static HttpRequest.Builder getHttpRequestBuilder(Method method, URI targ
};
}

private RestRequest consumerToken(TokenFlow tokenConfig) {
if (TokenFlow.ADAPTIVE_ADD_CONSUMER.equals(tokenConfig) && CONTEXT_SUPPLIER.isAzureContext()) {
return this;
}
private RestRequest consumerToken() {
delayedHeader(NavHeaders.HEADER_NAV_CONSUMER_TOKEN, () -> OIDC_AUTH_HEADER_PREFIX + CONTEXT_SUPPLIER.consumerToken().get().token());
return this;
}
Expand All @@ -162,16 +159,16 @@ private static Supplier<String> ensureCallId() {

private static Supplier<OpenIDToken> selectTokenSupplier(TokenFlow tokenConfig, String scopes) {
return switch (tokenConfig) {
case ADAPTIVE, ADAPTIVE_ADD_CONSUMER -> CONTEXT_SUPPLIER.adaptive(scopes);
case SYSTEM, STS_CC, STS_ADD_CONSUMER -> CONTEXT_SUPPLIER.tokenForSystem();
case ADAPTIVE -> CONTEXT_SUPPLIER.adaptive(scopes);
case STS_CC, STS_ADD_CONSUMER -> CONTEXT_SUPPLIER.tokenForSystem();
case AZUREAD_CC -> CONTEXT_SUPPLIER.azureTokenForSystem(scopes);
case NO_AUTH_NEEDED -> throw new IllegalArgumentException("No supplier needed");
};
}

private static Supplier<String> selectConsumerId(TokenFlow tokenConfig) {
return switch (tokenConfig) {
case SYSTEM, STS_CC, AZUREAD_CC -> CONTEXT_SUPPLIER.consumerIdFor(SikkerhetContext.SYSTEM);
case STS_CC, AZUREAD_CC -> CONTEXT_SUPPLIER.consumerIdFor(SikkerhetContext.SYSTEM);
default -> CONTEXT_SUPPLIER.consumerIdForCurrentKontekst();
};
}
Expand Down
12 changes: 5 additions & 7 deletions integrasjon/rest-klient/src/main/java/no/nav/vedtak/felles/integrasjon/rest/TokenFlow.java
View file
Original file line number Diff line number Diff line change
@@ -1,12 +1,10 @@
package no.nav.vedtak.felles.integrasjon.rest;

public enum TokenFlow {
ADAPTIVE, // DWIM for targets accepting both azuread, sts tokens, and tokenx
ADAPTIVE_ADD_CONSUMER, // ADAPTIVE + adding consumer token
SYSTEM, // Current system user
STS_CC,
STS_ADD_CONSUMER, // Midlertidig til vi har lagt om AAreg til Azure. Skyldes kontextkall i abakus
AZUREAD_CC,
ADAPTIVE, // DWIM for targets accepting both azuread, sts tokens, and tokenx. STS->AzureCC
STS_CC, // Mot endepunkt som insisterer på STS og ikke aksepterer Azure
STS_ADD_CONSUMER, // Trengs inntil videre pga brreg.proxy
AZUREAD_CC, // Mot endepunkt som bare støtter AzureCC, ikke AzureOBO-flow
NO_AUTH_NEEDED;

// Does the endpoint require an Azure AD token?
Expand All @@ -16,6 +14,6 @@ public boolean isAzureAD() {

// Does the endpoint require a system client?
public boolean isSystemRequired() {
return SYSTEM.equals(this) || STS_CC.equals(this) || AZUREAD_CC.equals(this);
return STS_CC.equals(this) || AZUREAD_CC.equals(this);
}
}

0 comments on commit fb76ed5

Please sign in to comment.