diff --git a/felles/abac-kontekst/src/main/resources/META-INF/beans.xml b/felles/abac-kontekst/src/main/resources/META-INF/beans.xml index 8c5870f12..d1a201021 100644 --- a/felles/abac-kontekst/src/main/resources/META-INF/beans.xml +++ b/felles/abac-kontekst/src/main/resources/META-INF/beans.xml @@ -1,6 +1,6 @@ diff --git a/felles/abac/src/main/resources/META-INF/beans.xml b/felles/abac/src/main/resources/META-INF/beans.xml index 8c5870f12..d1a201021 100644 --- a/felles/abac/src/main/resources/META-INF/beans.xml +++ b/felles/abac/src/main/resources/META-INF/beans.xml @@ -1,6 +1,6 @@ diff --git a/felles/abac/src/test/resources/META-INF/beans.xml b/felles/abac/src/test/resources/META-INF/beans.xml index 8c5870f12..d1a201021 100644 --- a/felles/abac/src/test/resources/META-INF/beans.xml +++ b/felles/abac/src/test/resources/META-INF/beans.xml @@ -1,6 +1,6 @@ diff --git a/felles/auth-filter/src/main/java/no/nav/vedtak/sikkerhet/jaxrs/AuthenticationFilterDelegate.java b/felles/auth-filter/src/main/java/no/nav/vedtak/sikkerhet/jaxrs/AuthenticationFilterDelegate.java index d8b2b74f6..78d8fdd9b 100644 --- a/felles/auth-filter/src/main/java/no/nav/vedtak/sikkerhet/jaxrs/AuthenticationFilterDelegate.java +++ b/felles/auth-filter/src/main/java/no/nav/vedtak/sikkerhet/jaxrs/AuthenticationFilterDelegate.java @@ -70,10 +70,10 @@ public static void validerSettKontekst(ResourceInfo resourceInfo, ContainerReque } else if (beskyttetRessurs == null) { throw new WebApplicationException(metodenavn + " mangler annotering", Response.Status.INTERNAL_SERVER_ERROR); } else { - var tokenString = getTokenFromHeader(ctx) - .or(() -> getCookie(ctx, cookiePath)) - .orElseThrow(() -> new TokenFeil("Mangler token")); - validerToken(tokenString); + var tokenString = getToken(ctx, cookiePath) + .orElseThrow(() -> new ValideringsFeil("Mangler token")); + validerTokenSetKontekst(tokenString); + setUserAndConsumerId(KontekstHolder.getKontekst().getUid()); } } catch (TekniskException | TokenFeil e) { throw new WebApplicationException(e, Response.Status.FORBIDDEN); @@ -101,6 +101,17 @@ private static void setCallAndConsumerId(ContainerRequestContext request) { .ifPresent(MDCOperations::putConsumerId); } + private static void setUserAndConsumerId(String subject) { + Optional.ofNullable(subject).ifPresent(MDCOperations::putUserId); + if (MDCOperations.getConsumerId() == null && subject != null) { + MDCOperations.putConsumerId(subject); + } + } + + private static Optional getToken(ContainerRequestContext request, String cookiePath) { + return getTokenFromHeader(request).or(() -> getCookieToken(request, cookiePath)); + } + private static Optional getTokenFromHeader(ContainerRequestContext request) { String headerValue = request.getHeaderString(AUTHORIZATION_HEADER); return headerValue != null && headerValue.startsWith(OpenIDToken.OIDC_DEFAULT_TOKEN_TYPE) @@ -108,24 +119,15 @@ private static Optional getTokenFromHeader(ContainerRequestContext : Optional.empty(); } - private static Optional getCookie(ContainerRequestContext request, String cookiePath) { - if (cookiePath == null || request.getCookies() == null) { - return Optional.empty(); - } - return request.getCookies().values().stream() - .filter(c -> c.getValue() != null) - .filter(c -> ID_TOKEN_COOKIE_NAME.equalsIgnoreCase(c.getName())) - .filter(c -> cookiePath.equalsIgnoreCase(c.getPath())) - .findFirst() - .or(() -> request.getCookies().values().stream() - .filter(c -> c.getValue() != null) - .filter(c -> ID_TOKEN_COOKIE_NAME.equalsIgnoreCase(c.getName())) - .findFirst()) + private static Optional getCookieToken(ContainerRequestContext request, String cookiePath) { + var idTokenCookie = Optional.ofNullable(request.getCookies()).map(c -> c.get(ID_TOKEN_COOKIE_NAME)); + return idTokenCookie.filter(c -> cookiePath != null && cookiePath.equalsIgnoreCase(c.getPath())) + .or(() -> idTokenCookie) .map(Cookie::getValue) .map(TokenString::new); } - public static void validerToken(TokenString tokenString) { + public static void validerTokenSetKontekst(TokenString tokenString) { // Sett opp OpenIDToken var claims = JwtUtil.getClaims(tokenString.token()); var configuration = ConfigProvider.getOpenIDConfiguration(JwtUtil.getIssuer(claims)) diff --git a/felles/auth-filter/src/main/resources/META-INF/beans.xml b/felles/auth-filter/src/main/resources/META-INF/beans.xml deleted file mode 100644 index 8c5870f12..000000000 --- a/felles/auth-filter/src/main/resources/META-INF/beans.xml +++ /dev/null @@ -1,6 +0,0 @@ - - - diff --git a/felles/auth-filter/src/test/java/no/nav/vedtak/sikkerhet/jaxrs/AuthenticationFilterDelegateTest.java b/felles/auth-filter/src/test/java/no/nav/vedtak/sikkerhet/jaxrs/AuthenticationFilterDelegateTest.java index e1e7e02f1..c6265ddac 100644 --- a/felles/auth-filter/src/test/java/no/nav/vedtak/sikkerhet/jaxrs/AuthenticationFilterDelegateTest.java +++ b/felles/auth-filter/src/test/java/no/nav/vedtak/sikkerhet/jaxrs/AuthenticationFilterDelegateTest.java @@ -92,7 +92,7 @@ public void teardown() { try { AuthenticationFilterDelegate.validerSettKontekst(ri, request); } catch (WebApplicationException e) { - assertThat(e.getResponse().getStatus()).isEqualTo(403); + assertThat(e.getResponse().getStatus()).isEqualTo(401); } } diff --git a/felles/db/src/main/resources/META-INF/beans.xml b/felles/db/src/main/resources/META-INF/beans.xml index 8c5870f12..d1a201021 100644 --- a/felles/db/src/main/resources/META-INF/beans.xml +++ b/felles/db/src/main/resources/META-INF/beans.xml @@ -1,6 +1,6 @@ diff --git a/felles/klient/src/main/resources/META-INF/beans.xml b/felles/klient/src/main/resources/META-INF/beans.xml deleted file mode 100644 index 8c5870f12..000000000 --- a/felles/klient/src/main/resources/META-INF/beans.xml +++ /dev/null @@ -1,6 +0,0 @@ - - - diff --git a/felles/konfig/src/main/resources/META-INF/beans.xml b/felles/konfig/src/main/resources/META-INF/beans.xml index 8c5870f12..d1a201021 100644 --- a/felles/konfig/src/main/resources/META-INF/beans.xml +++ b/felles/konfig/src/main/resources/META-INF/beans.xml @@ -1,6 +1,6 @@ diff --git a/felles/kontekst/pom.xml b/felles/kontekst/pom.xml index f6ecb09dc..501e7afff 100644 --- a/felles/kontekst/pom.xml +++ b/felles/kontekst/pom.xml @@ -15,10 +15,6 @@ jar - - jakarta.enterprise - jakarta.enterprise.cdi-api - no.nav.foreldrepenger.felles felles-konfig diff --git a/felles/log/src/main/resources/META-INF/beans.xml b/felles/log/src/main/resources/META-INF/beans.xml index 8c5870f12..d1a201021 100644 --- a/felles/log/src/main/resources/META-INF/beans.xml +++ b/felles/log/src/main/resources/META-INF/beans.xml @@ -1,6 +1,6 @@ diff --git a/felles/oidc/src/main/java/no/nav/vedtak/sikkerhet/oidc/validator/OidcTokenValidator.java b/felles/oidc/src/main/java/no/nav/vedtak/sikkerhet/oidc/validator/OidcTokenValidator.java index 76a1f953d..676ee1695 100644 --- a/felles/oidc/src/main/java/no/nav/vedtak/sikkerhet/oidc/validator/OidcTokenValidator.java +++ b/felles/oidc/src/main/java/no/nav/vedtak/sikkerhet/oidc/validator/OidcTokenValidator.java @@ -149,8 +149,9 @@ private OidcTokenValidatorResult validateAzure(JwtClaims claims, String subject) if (isAzureClientCredentials(claims, subject)) { var brukSubject = Optional.ofNullable(JwtUtil.getStringClaim(claims, AzureProperty.AZP_NAME)).orElse(subject); // Ta med bakoverkompatibelt navn ettersom azp_name er ganske langt (tabeller / opprettet_av) - if (brukSubject.lastIndexOf(':') >= 0) { - var appSrvName = "srv" + brukSubject.substring(brukSubject.lastIndexOf(':') + 1); + var sisteKolon = brukSubject.lastIndexOf(':'); + if (sisteKolon >= 0) { + var appSrvName = "srv" + brukSubject.substring(sisteKolon + 1); if (appSrvName.length() > 20) { appSrvName = appSrvName.substring(0, 19); } diff --git a/felles/oidc/src/main/resources/META-INF/beans.xml b/felles/oidc/src/main/resources/META-INF/beans.xml deleted file mode 100644 index 8c5870f12..000000000 --- a/felles/oidc/src/main/resources/META-INF/beans.xml +++ /dev/null @@ -1,6 +0,0 @@ - - - diff --git a/felles/oidc/src/test/resources/META-INF/beans.xml b/felles/oidc/src/test/resources/META-INF/beans.xml deleted file mode 100644 index 8c5870f12..000000000 --- a/felles/oidc/src/test/resources/META-INF/beans.xml +++ /dev/null @@ -1,6 +0,0 @@ - - - diff --git a/felles/sikkerhet/src/main/java/no/nav/vedtak/sikkerhet/context/SubjectHandler.java b/felles/sikkerhet/src/main/java/no/nav/vedtak/sikkerhet/context/SubjectHandler.java deleted file mode 100644 index e69de29bb..000000000 diff --git a/felles/sikkerhet/src/main/java/no/nav/vedtak/sikkerhet/jaspic/OidcAuthModule.java b/felles/sikkerhet/src/main/java/no/nav/vedtak/sikkerhet/jaspic/OidcAuthModule.java index 458b0a651..5447a890f 100644 --- a/felles/sikkerhet/src/main/java/no/nav/vedtak/sikkerhet/jaspic/OidcAuthModule.java +++ b/felles/sikkerhet/src/main/java/no/nav/vedtak/sikkerhet/jaspic/OidcAuthModule.java @@ -107,9 +107,9 @@ public AuthStatus validateRequest(MessageInfo messageInfo, Subject clientSubject return FAILURE; // Vil gi 403 } } catch (Exception e) { - throw new TekniskException("F-396795", "Klarte ikke å sende respons", e); + throw new TekniskException("F-396795", "Klarte ikke å sende respons", e); // Gir 500 } - return SEND_CONTINUE; // TODO - skal man returnere SEND_FAILURE? SEND_CONTINUE virker mest relevant for redirect to login + return SEND_CONTINUE; // SEND_CONTINUE sørger for svar med 401. (SEND_)FAILURE gir 403 } if (SUCCESS.equals(authStatus)) { @@ -151,7 +151,7 @@ public void setCallAndConsumerId(HttpServletRequest request) { } } - protected AuthStatus oidcLogin(Subject clientSubject, HttpServletRequest request) { + protected AuthStatus handleProtectedResource(Subject clientSubject, HttpServletRequest request) { // Get token var oidcToken = tokenLocator.getToken(request); if (oidcToken.isEmpty()) { @@ -174,7 +174,7 @@ protected AuthStatus oidcLogin(Subject clientSubject, HttpServletRequest request return FAILURE; } - // Dummy - finnes kun pga Jakarta Authentication 3.0 kap 6 LoginModule Bridge Profile. Mulig kan fjernes helt - prøv i neste runde + // Dummy - finnes kun pga Jakarta Authentication 3.0 kap 6 LoginModule Bridge Profile. LoginContext loginContext = createLoginContext(clientSubject); try { loginContext.login(); @@ -184,8 +184,13 @@ protected AuthStatus oidcLogin(Subject clientSubject, HttpServletRequest request clientSubject.getPrincipals().add(new BrukerNavnType(sluttbruker.uid(), sluttbruker.identType())); + MDCOperations.putUserId(sluttbruker.uid()); + if (MDCOperations.getConsumerId() == null) { + MDCOperations.putConsumerId(sluttbruker.uid()); + } + // Handle result - return handleValidatedToken(clientSubject, sluttbruker.uid()); + return notifyContainerAboutLogin(clientSubject, sluttbruker.uid()); } private LoginContext createLoginContext(Subject clientSubject) { @@ -207,30 +212,14 @@ public void handle(Callback[] callbacks) throws UnsupportedCallbackException { } } - protected AuthStatus handleProtectedResource(Subject clientSubject, HttpServletRequest originalRequest) { - return oidcLogin(clientSubject, originalRequest); - } - - protected AuthStatus handleValidatedToken(Subject clientSubject, String username) { - AuthStatus authStatus = notifyContainerAboutLogin(clientSubject, username); - - MDCOperations.putUserId(username); - if (MDCOperations.getConsumerId() == null) { - MDCOperations.putConsumerId(username); - } - return authStatus; - } - /** * Asks the container to register the given username. *

- *

* Note that after this call returned, the authenticated identity will not be * immediately active. This will only take place (should not errors occur) after * the {@link ServerAuthContext} or {@link ServerAuthModule} in which this call * takes place return control back to the runtime. *

- *

* As a convenience this method returns SUCCESS, so this method can be used in * one fluent return statement from an auth module. * diff --git a/felles/sikkerhet/src/main/resources/META-INF/beans.xml b/felles/sikkerhet/src/main/resources/META-INF/beans.xml deleted file mode 100644 index 8c5870f12..000000000 --- a/felles/sikkerhet/src/main/resources/META-INF/beans.xml +++ /dev/null @@ -1,6 +0,0 @@ - - - diff --git a/felles/sikkerhet/src/test/resources/META-INF/beans.xml b/felles/sikkerhet/src/test/resources/META-INF/beans.xml deleted file mode 100644 index 8c5870f12..000000000 --- a/felles/sikkerhet/src/test/resources/META-INF/beans.xml +++ /dev/null @@ -1,6 +0,0 @@ - - - diff --git a/felles/testutilities/src/main/resources/META-INF/beans.xml b/felles/testutilities/src/main/resources/META-INF/beans.xml index 8c5870f12..d1a201021 100644 --- a/felles/testutilities/src/main/resources/META-INF/beans.xml +++ b/felles/testutilities/src/main/resources/META-INF/beans.xml @@ -1,6 +1,6 @@ diff --git a/felles/testutilities/src/test/resources/META-INF/beans.xml b/felles/testutilities/src/test/resources/META-INF/beans.xml index 8c5870f12..d1a201021 100644 --- a/felles/testutilities/src/test/resources/META-INF/beans.xml +++ b/felles/testutilities/src/test/resources/META-INF/beans.xml @@ -1,6 +1,6 @@ diff --git a/felles/util/src/main/resources/META-INF/beans.xml b/felles/util/src/main/resources/META-INF/beans.xml deleted file mode 100644 index 8c5870f12..000000000 --- a/felles/util/src/main/resources/META-INF/beans.xml +++ /dev/null @@ -1,6 +0,0 @@ - - - diff --git a/felles/util/src/test/resources/META-INF/beans.xml b/felles/util/src/test/resources/META-INF/beans.xml deleted file mode 100644 index 8c5870f12..000000000 --- a/felles/util/src/test/resources/META-INF/beans.xml +++ /dev/null @@ -1,6 +0,0 @@ - - - diff --git a/integrasjon/arbeidsfordeling-klient/src/main/resources/META-INF/beans.xml b/integrasjon/arbeidsfordeling-klient/src/main/resources/META-INF/beans.xml deleted file mode 100644 index 8c5870f12..000000000 --- a/integrasjon/arbeidsfordeling-klient/src/main/resources/META-INF/beans.xml +++ /dev/null @@ -1,6 +0,0 @@ - - - diff --git a/integrasjon/dokarkiv-klient/src/main/resources/META-INF/beans.xml b/integrasjon/dokarkiv-klient/src/main/resources/META-INF/beans.xml deleted file mode 100644 index 8c5870f12..000000000 --- a/integrasjon/dokarkiv-klient/src/main/resources/META-INF/beans.xml +++ /dev/null @@ -1,6 +0,0 @@ - - - diff --git a/integrasjon/dokarkiv-klient/src/test/resources/META-INF/beans.xml b/integrasjon/dokarkiv-klient/src/test/resources/META-INF/beans.xml deleted file mode 100644 index 8c5870f12..000000000 --- a/integrasjon/dokarkiv-klient/src/test/resources/META-INF/beans.xml +++ /dev/null @@ -1,6 +0,0 @@ - - - diff --git a/integrasjon/ereg-klient/src/main/resources/META-INF/beans.xml b/integrasjon/ereg-klient/src/main/resources/META-INF/beans.xml deleted file mode 100644 index 8c5870f12..000000000 --- a/integrasjon/ereg-klient/src/main/resources/META-INF/beans.xml +++ /dev/null @@ -1,6 +0,0 @@ - - - diff --git a/integrasjon/infotrygd-grunnlag-klient/src/main/resources/META-INF/beans.xml b/integrasjon/infotrygd-grunnlag-klient/src/main/resources/META-INF/beans.xml deleted file mode 100644 index 8c5870f12..000000000 --- a/integrasjon/infotrygd-grunnlag-klient/src/main/resources/META-INF/beans.xml +++ /dev/null @@ -1,6 +0,0 @@ - - - diff --git a/integrasjon/infotrygd-grunnlag-klient/src/test/resources/META-INF/beans.xml b/integrasjon/infotrygd-grunnlag-klient/src/test/resources/META-INF/beans.xml deleted file mode 100644 index 8c5870f12..000000000 --- a/integrasjon/infotrygd-grunnlag-klient/src/test/resources/META-INF/beans.xml +++ /dev/null @@ -1,6 +0,0 @@ - - - diff --git a/integrasjon/oppgave-rest-klient/src/main/resources/META-INF/beans.xml b/integrasjon/oppgave-rest-klient/src/main/resources/META-INF/beans.xml deleted file mode 100644 index 8c5870f12..000000000 --- a/integrasjon/oppgave-rest-klient/src/main/resources/META-INF/beans.xml +++ /dev/null @@ -1,6 +0,0 @@ - - - diff --git a/integrasjon/person-klient/src/main/resources/META-INF/beans.xml b/integrasjon/person-klient/src/main/resources/META-INF/beans.xml deleted file mode 100644 index 8c5870f12..000000000 --- a/integrasjon/person-klient/src/main/resources/META-INF/beans.xml +++ /dev/null @@ -1,6 +0,0 @@ - - - diff --git a/integrasjon/rest-klient/src/main/resources/META-INF/beans.xml b/integrasjon/rest-klient/src/main/resources/META-INF/beans.xml deleted file mode 100644 index 8c5870f12..000000000 --- a/integrasjon/rest-klient/src/main/resources/META-INF/beans.xml +++ /dev/null @@ -1,6 +0,0 @@ - - - diff --git a/integrasjon/rest-klient/src/test/resources/META-INF/beans.xml b/integrasjon/rest-klient/src/test/resources/META-INF/beans.xml deleted file mode 100644 index 8c5870f12..000000000 --- a/integrasjon/rest-klient/src/test/resources/META-INF/beans.xml +++ /dev/null @@ -1,6 +0,0 @@ - - - diff --git a/integrasjon/saf-klient/src/main/resources/META-INF/beans.xml b/integrasjon/saf-klient/src/main/resources/META-INF/beans.xml deleted file mode 100644 index 8c5870f12..000000000 --- a/integrasjon/saf-klient/src/main/resources/META-INF/beans.xml +++ /dev/null @@ -1,6 +0,0 @@ - - - diff --git a/integrasjon/spokelse-klient/src/main/resources/META-INF/beans.xml b/integrasjon/spokelse-klient/src/main/resources/META-INF/beans.xml deleted file mode 100644 index 8c5870f12..000000000 --- a/integrasjon/spokelse-klient/src/main/resources/META-INF/beans.xml +++ /dev/null @@ -1,6 +0,0 @@ - - -