Jans linux setup jans cli 9710

[devrimyatar]

closes #9710

• I confirm that there is no impact on the docs due to the code changes in this PR.

[dryrunsecurity]

DryRun Security Summary

The pull request includes updates to the system profile configuration and a Python script that serves as a top-level wrapper for managing the Janssen Server, an open-source identity and access management (IAM) platform, with a focus on introducing a command-line interface (CLI) mode, service management functionality, health checks, and commands to display log file paths and important URLs.

Expand for full summary

Summary:

The code changes in this pull request appear to be focused on updates to the system profile configuration and a Python script that serves as a top-level wrapper for managing the Janssen Server, an open-source identity and access management (IAM) platform.

The changes to the system profile configuration remove the OPENDJ_JAVA_HOME environment variable and update the PATH environment variable to include the %(jansOptBinFolder)s directory. These changes do not seem to have any significant security implications, as they are routine system configuration updates.

The changes to the jans Python script introduce a command-line interface (CLI) mode, service management functionality, health checks, and commands to display log file paths and important URLs. While these features can be useful for managing the Janssen Server, it's crucial to ensure that the script is properly secured to prevent unauthorized access, command execution, and information disclosure.

Files Changed:

1. jans-linux-setup/jans_setup/templates/system_profile_systemd:

   • The OPENDJ_JAVA_HOME environment variable has been removed.
   • The PATH environment variable has been updated to include the %(jansOptBinFolder)s directory.
   • These changes appear to be routine system configuration updates and do not have any significant security implications.

2. jans-linux-setup/jans_setup/static/scripts/jans:

   • The script introduces a CLI mode, which could potentially allow users to execute arbitrary commands on the system. This should be carefully reviewed to ensure proper security controls.
   • The script provides commands to start, stop, and restart Janssen Server services, which should be properly authenticated and authorized.
   • The script includes health-check functionality, which should ensure that the health-check endpoints are properly secured.
   • The script provides commands to display log file paths and important URLs, which should be reviewed to prevent information disclosure.

Overall, the changes in this pull request do not appear to have any major security concerns, but it's essential to thoroughly review and test the functionality introduced in the jans Python script to ensure that it is properly secured and does not introduce any vulnerabilities.

Code Analysis

We ran 9 analyzers against 2 files and 0 analyzers had findings. 9 analyzers had no findings.

Riskiness

🟢 Risk threshold not exceeded.

View PR in the DryRun Dashboard.

[sonarqubecloud]

Quality Gate passed for 'jans-linux-setup'

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarCloud

[sonarqubecloud]

Quality Gate passed for 'Jans-Keycloak-Link'

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarCloud

[sonarqubecloud]

Quality Gate passed for 'jans-config-api-parent'

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarCloud

[sonarqubecloud]

Quality Gate passed for 'Fido2 API'

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarCloud

[sonarqubecloud]

Quality Gate passed for 'SCIM API'

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarCloud