Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

pac4j: fix incompatible dependencies + authorization regression #15753

Merged
merged 7 commits into from
Feb 1, 2024
Merged

pac4j: fix incompatible dependencies + authorization regression #15753

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
a47970c
FIX Pac4j issue
Pankaj260100 Jan 24, 2024
4f55b09
Fix default Authorization
Pankaj260100 Jan 25, 2024
dfbab89
Addressing review comment
Pankaj260100 Jan 25, 2024
9e91369
Fix build
Pankaj260100 Jan 29, 2024
41f65ec
adding test cases
Pankaj260100 Jan 30, 2024
597922f
addressing review comments
Pankaj260100 Jan 31, 2024
5173f8b
Correct indentation
Pankaj260100 Jan 31, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions extensions-core/druid-pac4j/pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -38,8 +38,8 @@

<!-- Following must be updated along with any updates to pac4j version -->
<nimbus.lang.tag.version>1.7</nimbus.lang.tag.version>
<nimbus.jose.jwt.version>7.9</nimbus.jose.jwt.version>
<oauth2.oidc.sdk.version>6.5</oauth2.oidc.sdk.version>
<nimbus.jose.jwt.version>8.22.1</nimbus.jose.jwt.version>
<oauth2.oidc.sdk.version>8.22</oauth2.oidc.sdk.version>
Pankaj260100 marked this conversation as resolved.
Show resolved Hide resolved
</properties>

<dependencies>
Expand Down
32 changes: 29 additions & 3 deletions extensions-core/druid-pac4j/src/main/java/org/apache/druid/security/pac4j/Pac4jFilter.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -29,7 +29,11 @@
import org.pac4j.core.engine.DefaultCallbackLogic;
import org.pac4j.core.engine.DefaultSecurityLogic;
import org.pac4j.core.engine.SecurityLogic;
import org.pac4j.core.exception.TechnicalException;
import org.pac4j.core.exception.http.HttpAction;
import org.pac4j.core.exception.http.RedirectionAction;
import org.pac4j.core.exception.http.WithContentAction;
import org.pac4j.core.exception.http.WithLocationAction;
import org.pac4j.core.http.adapter.HttpActionAdapter;
import org.pac4j.core.profile.UserProfile;

Expand All @@ -48,7 +52,29 @@ public class Pac4jFilter implements Filter
{
private static final Logger LOGGER = new Logger(Pac4jFilter.class);

private static final HttpActionAdapter<String, JEEContext> NOOP_HTTP_ACTION_ADAPTER = (HttpAction code, JEEContext ctx) -> null;
private static final HttpActionAdapter<String, JEEContext> HTTP_ACTION_ADAPTER = (HttpAction action, JEEContext context) -> {
Pankaj260100 marked this conversation as resolved.
Show resolved Hide resolved
if (action instanceof RedirectionAction) {
Pankaj260100 marked this conversation as resolved.
Show resolved Hide resolved
int code = action.getCode();
HttpServletResponse response = context.getNativeResponse();
response.setStatus(code);
if (action instanceof WithLocationAction) {
WithLocationAction withLocationAction = (WithLocationAction) action;
context.setResponseHeader("Location", withLocationAction.getLocation());
} else if (action instanceof WithContentAction) {
WithContentAction withContentAction = (WithContentAction) action;
String content = withContentAction.getContent();
if (content != null) {
try {
response.getWriter().write(content);
}
catch (IOException var8) {
Pankaj260100 marked this conversation as resolved.
Show resolved Hide resolved
throw new TechnicalException(var8);
}
}
}
}
return null;
};

private final Config pac4jConfig;
private final SecurityLogic<String, JEEContext> securityLogic;
Expand Down Expand Up @@ -95,7 +121,7 @@ public void doFilter(ServletRequest servletRequest, ServletResponse servletRespo
callbackLogic.perform(
context,
pac4jConfig,
NOOP_HTTP_ACTION_ADAPTER,
HTTP_ACTION_ADAPTER,
"/",
true, false, false, null);
} else {
Expand All @@ -110,7 +136,7 @@ public void doFilter(ServletRequest servletRequest, ServletResponse servletRespo
return profiles.iterator().next().getId();
}
},
NOOP_HTTP_ACTION_ADAPTER,
HTTP_ACTION_ADAPTER,
null, null, null, null);
Copy link
Contributor Author

@Pankaj260100 Pankaj260100 Jan 25, 2024 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Changed the Authorizer from null to "none". In the older version, if it is null, it simply returns authenticated and authorized -> grant access. But in the 4.5.7 pac4j version, it uses CsrfAuthorizer as default, And because of this, I was getting 403 in API calls. So, I have set it to "none".


if (uid != null) {
Expand Down
4 changes: 2 additions & 2 deletions licenses.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -809,7 +809,7 @@ name: com.nimbusds nimbus-jose-jwt
license_category: binary
module: extensions/druid-pac4j
license_name: Apache License version 2.0
version: 7.9
version: 8.22.1
libraries:
- com.nimbusds: nimbus-jose-jwt

Expand All @@ -819,7 +819,7 @@ name: com.nimbusds oauth2-oidc-sdk
license_category: binary
module: extensions/druid-pac4j
license_name: Apache License version 2.0
version: 6.5
version: 8.22
libraries:
- com.nimbusds: oauth2-oidc-sdk

Expand Down
Loading