Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[feat] PIP-257: Add AuthenticationProviderOpenID #19849

Merged
merged 28 commits into from
Apr 10, 2023
Merged

[feat] PIP-257: Add AuthenticationProviderOpenID #19849

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
28 commits
Select commit Hold shift + click to select a range
60df13a
[feat] PIP-257: Add AuthenticationProviderOpenID
michaeljmarshall Mar 17, 2023
c7474fa
Improve imports in pom.xml
michaeljmarshall Mar 17, 2023
af7e3ae
Refactor packaging: move under oidc
michaeljmarshall Mar 17, 2023
518aa08
Reorder imports
michaeljmarshall Mar 17, 2023
e93b903
Upgrade auth0 dependencies; improve claims validation
michaeljmarshall Mar 17, 2023
dcb6008
Remove some versions in child pom.xml
michaeljmarshall Mar 17, 2023
6f76bbd
Use async http client to get JWKS
michaeljmarshall Mar 20, 2023
c4bdd59
Require JWT has OIDC's required claims
michaeljmarshall Mar 20, 2023
83a512a
Remove audit logging; it belongs in framework
michaeljmarshall Mar 20, 2023
08d971a
Cleanup failure metrics
michaeljmarshall Mar 20, 2023
dd96e17
Cleanup pom.xml
michaeljmarshall Mar 20, 2023
1b46eb4
Cleanup Javadocs
michaeljmarshall Mar 20, 2023
6ea2331
Add Auth0 to license.bin.txt
michaeljmarshall Mar 20, 2023
64c8c15
Close the httpClient
michaeljmarshall Mar 28, 2023
fdf6f36
Normalize URL when getting openid-configuration
michaeljmarshall Mar 29, 2023
3d96294
Cover invalid audience claim in integration tests
michaeljmarshall Mar 29, 2023
941a9f5
Improve failure scenario coverage in integration tests
michaeljmarshall Mar 29, 2023
bc4e421
Add support for k8s Api Server
michaeljmarshall Mar 29, 2023
dadbf4c
Support a custom trust store for issuers http client
michaeljmarshall Mar 29, 2023
7340b0e
Improve config name for openIDRequireIssuersUseHttps
michaeljmarshall Mar 29, 2023
932dcd7
Add k8s discover mode to support EKS, AKS, GKE
michaeljmarshall Mar 29, 2023
5eccb86
Make discovery mode more abstract to enable future additions
michaeljmarshall Mar 29, 2023
ecb5566
Remove test dependency on hard coded port
michaeljmarshall Apr 7, 2023
fa93b4c
Refactor to support refreshAfterWrite
michaeljmarshall Apr 7, 2023
a94315b
Remove unused import
michaeljmarshall Apr 7, 2023
f4b18a0
Exclude io.prometheus:simpdleclient_httpserver from k8s client
michaeljmarshall Apr 8, 2023
511b27a
Remove trailing / from issuer per OIDC Discovery Section 4.1
michaeljmarshall Apr 10, 2023
860ceff
Require token has role claim
michaeljmarshall Apr 10, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Prev Previous commit
Next Next commit
Refactor packaging: move under oidc
  • Loading branch information
@michaeljmarshall
michaeljmarshall committed Mar 17, 2023
commit af7e3aed33fdf34d70f49ed8f332ccfaa2da6e67
19 changes: 0 additions & 19 deletions ...r-auth-oidc/src/main/java/org/apache/pulsar/broker/authentication/model/package-info.java
View file
Open in desktop

This file was deleted.

2 changes: 1 addition & 1 deletion ...tication/AuthenticationExceptionCode.java → ...ion/oidc/AuthenticationExceptionCode.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,7 +16,7 @@
* specific language governing permissions and limitations
* under the License.
*/
package org.apache.pulsar.broker.authentication;
package org.apache.pulsar.broker.authentication.oidc;

/**
* Enum used to classify the types of exceptions encountered
Expand Down
14 changes: 9 additions & 5 deletions ...ication/AuthenticationProviderOpenID.java → ...on/oidc/AuthenticationProviderOpenID.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,12 +16,12 @@
* specific language governing permissions and limitations
* under the License.
*/
package org.apache.pulsar.broker.authentication;
package org.apache.pulsar.broker.authentication.oidc;

import static org.apache.pulsar.broker.authentication.ConfigUtils.getConfigValueAsBoolean;
import static org.apache.pulsar.broker.authentication.ConfigUtils.getConfigValueAsInt;
import static org.apache.pulsar.broker.authentication.ConfigUtils.getConfigValueAsSet;
import static org.apache.pulsar.broker.authentication.ConfigUtils.getConfigValueAsString;
import static org.apache.pulsar.broker.authentication.oidc.ConfigUtils.getConfigValueAsBoolean;
import static org.apache.pulsar.broker.authentication.oidc.ConfigUtils.getConfigValueAsInt;
import static org.apache.pulsar.broker.authentication.oidc.ConfigUtils.getConfigValueAsSet;
import static org.apache.pulsar.broker.authentication.oidc.ConfigUtils.getConfigValueAsString;
import com.auth0.jwk.GuavaCachedJwkProvider;
import com.auth0.jwk.InvalidPublicKeyException;
import com.auth0.jwk.Jwk;
Expand Down Expand Up @@ -54,6 +54,10 @@
import javax.naming.AuthenticationException;
import javax.net.ssl.SSLSession;
import org.apache.pulsar.broker.ServiceConfiguration;
import org.apache.pulsar.broker.authentication.AuthenticationDataSource;
import org.apache.pulsar.broker.authentication.AuthenticationProvider;
import org.apache.pulsar.broker.authentication.AuthenticationProviderToken;
import org.apache.pulsar.broker.authentication.AuthenticationState;
import org.apache.pulsar.broker.authentication.metrics.AuthenticationMetrics;
import org.apache.pulsar.common.api.AuthData;
import org.slf4j.Logger;
Expand Down
5 changes: 4 additions & 1 deletion ...entication/AuthenticationStateOpenID.java → ...ation/oidc/AuthenticationStateOpenID.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,13 +16,16 @@
* specific language governing permissions and limitations
* under the License.
*/
package org.apache.pulsar.broker.authentication;
package org.apache.pulsar.broker.authentication.oidc;

import static java.nio.charset.StandardCharsets.UTF_8;
import java.net.SocketAddress;
import java.util.concurrent.CompletableFuture;
import javax.naming.AuthenticationException;
import javax.net.ssl.SSLSession;
import org.apache.pulsar.broker.authentication.AuthenticationDataCommand;
import org.apache.pulsar.broker.authentication.AuthenticationDataSource;
import org.apache.pulsar.broker.authentication.AuthenticationState;
import org.apache.pulsar.common.api.AuthData;

/**
Expand Down
2 changes: 1 addition & 1 deletion ...ar/broker/authentication/ConfigUtils.java → ...oker/authentication/oidc/ConfigUtils.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,7 +16,7 @@
* specific language governing permissions and limitations
* under the License.
*/
package org.apache.pulsar.broker.authentication;
package org.apache.pulsar.broker.authentication.oidc;

import java.util.Arrays;
import java.util.Collections;
Expand Down
2 changes: 1 addition & 1 deletion ...ication/model/OpenIDProviderMetadata.java → ...tication/oidc/OpenIDProviderMetadata.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,7 +16,7 @@
* specific language governing permissions and limitations
* under the License.
*/
package org.apache.pulsar.broker.authentication.model;
package org.apache.pulsar.broker.authentication.oidc;

import com.fasterxml.jackson.annotation.JsonCreator;
import com.fasterxml.jackson.annotation.JsonGetter;
Expand Down
13 changes: 6 additions & 7 deletions ...tication/OpenIDProviderMetadataCache.java → ...ion/oidc/OpenIDProviderMetadataCache.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,13 +16,13 @@
* specific language governing permissions and limitations
* under the License.
*/
package org.apache.pulsar.broker.authentication;
package org.apache.pulsar.broker.authentication.oidc;

import static org.apache.pulsar.broker.authentication.AuthenticationProviderOpenID.METADATA_CACHE_SIZE;
import static org.apache.pulsar.broker.authentication.AuthenticationProviderOpenID.METADATA_CONNECTION_TIMEOUT_MILLIS;
import static org.apache.pulsar.broker.authentication.AuthenticationProviderOpenID.METADATA_EXPIRES_SECONDS;
import static org.apache.pulsar.broker.authentication.AuthenticationProviderOpenID.METADATA_READ_TIMEOUT_MILLIS;
import static org.apache.pulsar.broker.authentication.ConfigUtils.getConfigValueAsInt;
import static org.apache.pulsar.broker.authentication.oidc.AuthenticationProviderOpenID.METADATA_CACHE_SIZE;
import static org.apache.pulsar.broker.authentication.oidc.AuthenticationProviderOpenID.METADATA_CONNECTION_TIMEOUT_MILLIS;
import static org.apache.pulsar.broker.authentication.oidc.AuthenticationProviderOpenID.METADATA_EXPIRES_SECONDS;
import static org.apache.pulsar.broker.authentication.oidc.AuthenticationProviderOpenID.METADATA_READ_TIMEOUT_MILLIS;
import static org.apache.pulsar.broker.authentication.oidc.ConfigUtils.getConfigValueAsInt;
import com.fasterxml.jackson.databind.ObjectMapper;
import com.fasterxml.jackson.databind.ObjectReader;
import com.github.benmanes.caffeine.cache.AsyncCacheLoader;
Expand All @@ -35,7 +35,6 @@
import javax.annotation.Nonnull;
import javax.naming.AuthenticationException;
import org.apache.pulsar.broker.ServiceConfiguration;
import org.apache.pulsar.broker.authentication.model.OpenIDProviderMetadata;
import org.asynchttpclient.AsyncHttpClient;
import org.asynchttpclient.AsyncHttpClientConfig;
import org.asynchttpclient.DefaultAsyncHttpClient;
Expand Down
2 changes: 1 addition & 1 deletion ...r/broker/authentication/package-info.java → ...ker/authentication/oidc/package-info.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,4 +16,4 @@
* specific language governing permissions and limitations
* under the License.
*/
package org.apache.pulsar.broker.authentication;
package org.apache.pulsar.broker.authentication.oidc;
4 changes: 3 additions & 1 deletion ...icationProviderOpenIDIntegrationTest.java → ...icationProviderOpenIDIntegrationTest.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,7 +16,7 @@
* specific language governing permissions and limitations
* under the License.
*/
package org.apache.pulsar.broker.authentication;
package org.apache.pulsar.broker.authentication.oidc;

import static com.github.tomakehurst.wiremock.client.WireMock.aResponse;
import static com.github.tomakehurst.wiremock.client.WireMock.get;
Expand All @@ -41,6 +41,8 @@
import java.util.concurrent.ExecutionException;
import javax.naming.AuthenticationException;
import org.apache.pulsar.broker.ServiceConfiguration;
import org.apache.pulsar.broker.authentication.AuthenticationDataCommand;
import org.apache.pulsar.broker.authentication.AuthenticationState;
import org.apache.pulsar.common.api.AuthData;
import org.testng.annotations.AfterClass;
import org.testng.annotations.BeforeTest;
Expand Down
3 changes: 2 additions & 1 deletion ...ion/AuthenticationProviderOpenIDTest.java → ...idc/AuthenticationProviderOpenIDTest.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,7 +16,7 @@
* specific language governing permissions and limitations
* under the License.
*/
package org.apache.pulsar.broker.authentication;
package org.apache.pulsar.broker.authentication.oidc;

import static org.testng.Assert.assertNull;
import com.auth0.jwt.JWT;
Expand All @@ -36,6 +36,7 @@
import java.util.Properties;
import java.util.Set;
import org.apache.pulsar.broker.ServiceConfiguration;
import org.apache.pulsar.broker.authentication.AuthenticationDataCommand;
import org.testng.Assert;
import org.testng.annotations.Test;

Expand Down
2 changes: 1 addition & 1 deletion ...cation/AuthenticationStateOpenIDTest.java → ...n/oidc/AuthenticationStateOpenIDTest.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,7 +16,7 @@
* specific language governing permissions and limitations
* under the License.
*/
package org.apache.pulsar.broker.authentication;
package org.apache.pulsar.broker.authentication.oidc;

import static org.testng.Assert.assertEquals;
import static org.testng.Assert.assertFalse;
Expand Down
2 changes: 1 addition & 1 deletion ...roker/authentication/ConfigUtilsTest.java → .../authentication/oidc/ConfigUtilsTest.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,7 +16,7 @@
* specific language governing permissions and limitations
* under the License.
*/
package org.apache.pulsar.broker.authentication;
package org.apache.pulsar.broker.authentication.oidc;

import static org.testng.Assert.assertEquals;
import static org.testng.Assert.assertFalse;
Expand Down