feat(jans-lock): add audit/health/telemetry endpoint protection

[yurem]

closes #8817

• I confirm that there is no impact on the docs due to the code changes in this PR.

[dryrunsecurity]

DryRun Security Summary

The provided code changes introduce several security-focused enhancements to the Jans Lock application, including an authorization mechanism, OpenID protection, an authorization processing filter, audit-related functionality, and secure integration with LDAP and SQL data stores.

Expand for full summary

Summary:

The provided code changes introduce several security-focused enhancements to the Jans Lock application. The key changes include:

1. Authorization Mechanism: The introduction of the ProtectionService interface and the ProtectedApi annotation suggests the implementation of a robust authorization mechanism within the application. This will help ensure that access to sensitive APIs and resources is restricted to only authorized clients with the necessary permissions.

2. OpenID Protection: The OpenIdProtectionService class implements comprehensive token validation, including checks for the token's issuer, expiration, signature, and required scopes. This is a crucial security measure to prevent unauthorized access to protected resources.

3. Authorization Processing Filter: The AuthorizationProcessingFilter centralizes the authorization logic, intercepting incoming requests and performing the necessary checks before allowing access to the requested resources. This approach helps to ensure consistent and secure handling of API requests.

4. Audit-related Functionality: The changes related to the AuditRestWebService and AuditRestWebServiceImpl classes focus on securing the audit-related functionality of the application, including the introduction of access control measures and potential improvements to input validation and error handling.

5. LDAP and SQL Integration: The code changes for the LDAP and SQL document store samples highlight the importance of input validation, secure data handling, and least privilege access control when integrating with external data sources.

Overall, the provided code changes demonstrate a strong focus on implementing robust security measures, including access control, authorization, and input validation, to protect the Jans Lock application and its users. As an application security engineer, I would recommend thoroughly reviewing the implementation details of these security-focused enhancements to ensure they are correctly and securely implemented.

Files Changed:

1. jans-lock/lock-master/service/src/main/java/io/jans/lock/service/filter/ProtectionService.java: Introduces a new ProtectionService interface for handling authorization-related tasks.
2. jans-core/service/src/main/java/io/jans/service/security/api/ProtectedApi.java: Adds a new ProtectedApi annotation for marking protected APIs.
3. jans-lock/lock-master/service/src/main/java/io/jans/lock/service/filter/openid/OpenIdProtectionService.java: Implements a comprehensive OpenID protection service for validating access tokens.
4. jans-lock/lock-master/service/src/main/java/io/jans/lock/service/filter/AuthorizationProcessingFilter.java: Introduces an authorization processing filter to centralize the authorization logic.
5. jans-lock/lock-master/service/src/main/java/io/jans/lock/service/ws/rs/audit/AuditRestWebService.java and AuditRestWebServiceImpl.java: Focuses on securing the audit-related functionality of the application.
6. jans-orm/ldap-sample/src/main/java/io/jans/orm/ldap/LdapDocumentStoreSample.java and jans-orm/sql-sample/src/main/java/io/jans/orm/sql/SqlDocumentStoreSample.java: Demonstrate the integration with LDAP and SQL data stores, highlighting the importance of secure data handling.
7. jans-orm/ldap-sample/src/main/java/io/jans/orm/ldap/model/Document.java and jans-orm/sql-sample/src/main/java/io/jans/orm/sql/model/Document.java: Introduce new data model classes for LDAP and SQL document stores.

Code Analysis

We ran 9 analyzers against 12 files and 1 analyzer had findings. 8 analyzers had no findings.

Analyzer	Findings
Authn/Authz Analyzer	2 findings

Riskiness

🟢 Risk threshold not exceeded.

View PR in the DryRun Dashboard.

[sonarqubecloud]

Quality Gate passed for 'jans-core'

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarCloud

[sonarqubecloud]

Quality Gate failed for 'orm'

Failed conditions
246 Duplicated Lines on New Code (required ≤ 20)

See analysis details on SonarCloud

[sonarqubecloud]

Quality Gate passed for 'SCIM API'

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarCloud

[sonarqubecloud]

Quality Gate passed for 'jans-cli'

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarCloud

[sonarqubecloud]

Quality Gate passed for 'jans-linux-setup'

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarCloud

[sonarqubecloud]

Quality Gate passed for 'jans-config-api-parent'

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarCloud