-
Notifications
You must be signed in to change notification settings - Fork 117
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Update TokenVerifier to verify authorization too (#4061)
* tiny fix in OIDCDiscoveryConfig logger * Remove unneeded verify method of TokenVerifier * Move TokenVerifier to receiver package and TokenProvider to dispatcher package * Add classes for TokenMatchers (Exact and Prefix) * Add wrapper for EventPolicy * Add EventPolicies to IngressProducer * Add authorization check to TokenVerifier * run hack/update-codegen.sh
- Loading branch information
Showing
27 changed files
with
534 additions
and
57 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
27 changes: 27 additions & 0 deletions
27
...in/java/dev/knative/eventing/kafka/broker/receiver/impl/auth/AuthenticationException.java
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,27 @@ | ||
| /* | ||
| * Copyright © 2018 Knative Authors ([email protected]) | ||
| * | ||
| * Licensed under the Apache License, Version 2.0 (the "License"); | ||
| * you may not use this file except in compliance with the License. | ||
| * You may obtain a copy of the License at | ||
| * | ||
| * http://www.apache.org/licenses/LICENSE-2.0 | ||
| * | ||
| * Unless required by applicable law or agreed to in writing, software | ||
| * distributed under the License is distributed on an "AS IS" BASIS, | ||
| * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. | ||
| * See the License for the specific language governing permissions and | ||
| * limitations under the License. | ||
| */ | ||
| package dev.knative.eventing.kafka.broker.receiver.impl.auth; | ||
|
|
||
| public class AuthenticationException extends Exception { | ||
|
|
||
| public AuthenticationException(String message) { | ||
| super(message); | ||
| } | ||
|
|
||
| public AuthenticationException(Exception e) { | ||
| super(e); | ||
| } | ||
| } |
27 changes: 27 additions & 0 deletions
27
...ain/java/dev/knative/eventing/kafka/broker/receiver/impl/auth/AuthorizationException.java
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,27 @@ | ||
| /* | ||
| * Copyright © 2018 Knative Authors ([email protected]) | ||
| * | ||
| * Licensed under the Apache License, Version 2.0 (the "License"); | ||
| * you may not use this file except in compliance with the License. | ||
| * You may obtain a copy of the License at | ||
| * | ||
| * http://www.apache.org/licenses/LICENSE-2.0 | ||
| * | ||
| * Unless required by applicable law or agreed to in writing, software | ||
| * distributed under the License is distributed on an "AS IS" BASIS, | ||
| * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. | ||
| * See the License for the specific language governing permissions and | ||
| * limitations under the License. | ||
| */ | ||
| package dev.knative.eventing.kafka.broker.receiver.impl.auth; | ||
|
|
||
| public class AuthorizationException extends Exception { | ||
|
|
||
| public AuthorizationException(String message) { | ||
| super(message); | ||
| } | ||
|
|
||
| public AuthorizationException(Exception e) { | ||
| super(e); | ||
| } | ||
| } |
47 changes: 47 additions & 0 deletions
47
...eiver/src/main/java/dev/knative/eventing/kafka/broker/receiver/impl/auth/EventPolicy.java
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,47 @@ | ||
| /* | ||
| * Copyright © 2018 Knative Authors ([email protected]) | ||
| * | ||
| * Licensed under the Apache License, Version 2.0 (the "License"); | ||
| * you may not use this file except in compliance with the License. | ||
| * You may obtain a copy of the License at | ||
| * | ||
| * http://www.apache.org/licenses/LICENSE-2.0 | ||
| * | ||
| * Unless required by applicable law or agreed to in writing, software | ||
| * distributed under the License is distributed on an "AS IS" BASIS, | ||
| * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. | ||
| * See the License for the specific language governing permissions and | ||
| * limitations under the License. | ||
| */ | ||
| package dev.knative.eventing.kafka.broker.receiver.impl.auth; | ||
|
|
||
| import dev.knative.eventing.kafka.broker.contract.DataPlaneContract; | ||
| import java.util.List; | ||
| import java.util.Map; | ||
| import java.util.stream.Collectors; | ||
|
|
||
| public class EventPolicy { | ||
| private final List<TokenMatcher> tokenMatchers; | ||
|
|
||
| public static EventPolicy fromContract(DataPlaneContract.EventPolicy contractEventPolicy) { | ||
| return new EventPolicy(TokenMatcher.fromContract(contractEventPolicy.getTokenMatchersList())); | ||
| } | ||
|
|
||
| public static List<EventPolicy> fromContract(List<DataPlaneContract.EventPolicy> contractEventPolicies) { | ||
| return contractEventPolicies.stream().map(EventPolicy::fromContract).collect(Collectors.toList()); | ||
| } | ||
|
|
||
| public EventPolicy(List<TokenMatcher> tokenMatchers) { | ||
| this.tokenMatchers = tokenMatchers; | ||
| } | ||
|
|
||
| public boolean isAuthorized(Map<String, List<String>> claims) { | ||
| for (TokenMatcher matcher : tokenMatchers) { | ||
| if (matcher.match(claims)) { | ||
| return true; | ||
| } | ||
| } | ||
|
|
||
| return false; | ||
| } | ||
| } |
46 changes: 46 additions & 0 deletions
46
...src/main/java/dev/knative/eventing/kafka/broker/receiver/impl/auth/ExactTokenMatcher.java
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,46 @@ | ||
| /* | ||
| * Copyright © 2018 Knative Authors ([email protected]) | ||
| * | ||
| * Licensed under the Apache License, Version 2.0 (the "License"); | ||
| * you may not use this file except in compliance with the License. | ||
| * You may obtain a copy of the License at | ||
| * | ||
| * http://www.apache.org/licenses/LICENSE-2.0 | ||
| * | ||
| * Unless required by applicable law or agreed to in writing, software | ||
| * distributed under the License is distributed on an "AS IS" BASIS, | ||
| * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. | ||
| * See the License for the specific language governing permissions and | ||
| * limitations under the License. | ||
| */ | ||
| package dev.knative.eventing.kafka.broker.receiver.impl.auth; | ||
|
|
||
| import dev.knative.eventing.kafka.broker.contract.DataPlaneContract; | ||
| import java.util.List; | ||
| import java.util.Map; | ||
|
|
||
| class ExactTokenMatcher implements TokenMatcher { | ||
|
|
||
| private final Map<String, String> requiredMatches; | ||
|
|
||
| public static ExactTokenMatcher fromContract(DataPlaneContract.Exact exactTokenMatcher) { | ||
| return new ExactTokenMatcher(exactTokenMatcher.getAttributesMap()); | ||
| } | ||
|
|
||
| public ExactTokenMatcher(Map<String, String> requiredMatches) { | ||
| this.requiredMatches = requiredMatches; | ||
| } | ||
|
|
||
| @Override | ||
| public boolean match(Map<String, List<String>> claims) { | ||
| for (var requiredMatch : requiredMatches.entrySet()) { | ||
| if (!claims.containsKey(requiredMatch.getKey()) | ||
| || !claims.get(requiredMatch.getKey()).contains(requiredMatch.getValue())) { | ||
| // as soon as one of the required claims does not match, the matcher should fail | ||
| return false; | ||
| } | ||
| } | ||
|
|
||
| return true; | ||
| } | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
46 changes: 46 additions & 0 deletions
46
...rc/main/java/dev/knative/eventing/kafka/broker/receiver/impl/auth/PrefixTokenMatcher.java
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,46 @@ | ||
| /* | ||
| * Copyright © 2018 Knative Authors ([email protected]) | ||
| * | ||
| * Licensed under the Apache License, Version 2.0 (the "License"); | ||
| * you may not use this file except in compliance with the License. | ||
| * You may obtain a copy of the License at | ||
| * | ||
| * http://www.apache.org/licenses/LICENSE-2.0 | ||
| * | ||
| * Unless required by applicable law or agreed to in writing, software | ||
| * distributed under the License is distributed on an "AS IS" BASIS, | ||
| * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. | ||
| * See the License for the specific language governing permissions and | ||
| * limitations under the License. | ||
| */ | ||
| package dev.knative.eventing.kafka.broker.receiver.impl.auth; | ||
|
|
||
| import dev.knative.eventing.kafka.broker.contract.DataPlaneContract; | ||
| import java.util.List; | ||
| import java.util.Map; | ||
|
|
||
| class PrefixTokenMatcher implements TokenMatcher { | ||
| private final Map<String, String> requiredMatches; | ||
|
|
||
| public static PrefixTokenMatcher fromContract(DataPlaneContract.Prefix prefixTokenMatcher) { | ||
| return new PrefixTokenMatcher(prefixTokenMatcher.getAttributesMap()); | ||
| } | ||
|
|
||
| public PrefixTokenMatcher(Map<String, String> requiredMatches) { | ||
| this.requiredMatches = requiredMatches; | ||
| } | ||
|
|
||
| @Override | ||
| public boolean match(Map<String, List<String>> claims) { | ||
| for (Map.Entry<String, String> requiredMatch : requiredMatches.entrySet()) { | ||
| if (!claims.containsKey(requiredMatch.getKey()) | ||
| || !claims.get(requiredMatch.getKey()).stream() | ||
| .anyMatch(s -> s.startsWith(requiredMatch.getValue()))) { | ||
| // as soon as one of the required claims does not match, the matcher should fail | ||
| return false; | ||
| } | ||
| } | ||
|
|
||
| return true; | ||
| } | ||
| } |
38 changes: 38 additions & 0 deletions
38
...iver/src/main/java/dev/knative/eventing/kafka/broker/receiver/impl/auth/TokenMatcher.java
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,38 @@ | ||
| /* | ||
| * Copyright © 2018 Knative Authors ([email protected]) | ||
| * | ||
| * Licensed under the Apache License, Version 2.0 (the "License"); | ||
| * you may not use this file except in compliance with the License. | ||
| * You may obtain a copy of the License at | ||
| * | ||
| * http://www.apache.org/licenses/LICENSE-2.0 | ||
| * | ||
| * Unless required by applicable law or agreed to in writing, software | ||
| * distributed under the License is distributed on an "AS IS" BASIS, | ||
| * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. | ||
| * See the License for the specific language governing permissions and | ||
| * limitations under the License. | ||
| */ | ||
| package dev.knative.eventing.kafka.broker.receiver.impl.auth; | ||
|
|
||
| import dev.knative.eventing.kafka.broker.contract.DataPlaneContract; | ||
| import java.util.ArrayList; | ||
| import java.util.List; | ||
| import java.util.Map; | ||
|
|
||
| public interface TokenMatcher { | ||
| boolean match(Map<String, List<String>> claims); | ||
|
|
||
| static List<TokenMatcher> fromContract(List<DataPlaneContract.TokenMatcher> contractTokenMatchers) { | ||
| List<TokenMatcher> matchers = new ArrayList<>(contractTokenMatchers.size()); | ||
|
|
||
| for (var contractTokenMatcher : contractTokenMatchers) { | ||
| switch (contractTokenMatcher.getMatcherCase()) { | ||
| case EXACT -> matchers.add(ExactTokenMatcher.fromContract(contractTokenMatcher.getExact())); | ||
| case PREFIX -> matchers.add(PrefixTokenMatcher.fromContract(contractTokenMatcher.getPrefix())); | ||
| } | ||
| } | ||
|
|
||
| return matchers; | ||
| } | ||
| } |
Oops, something went wrong.