CGDMF-73: Make use of ZGW client id/secrets so we can get rid of if case in auth-jwt

Author: wouterpot

.bruno/CG-DMF/environments/CI.bru

@@ -4,10 +4,10 @@ vars {
   catalogusBaseUrl: https://openzaak.dev.baseflow.com/catalogi/api/v1
   storage.defaultRepo: minio-local
   storage.secondaryRepo: minio-archive
-  jwt.clientId: gzac
-  oidc.clientId: cg-dmf
+  jwt.clientId: cg-dmf-integration-test
+  oidc.authUrl: https://auth.gzac.baseflow.com/realms/cg-dmf/protocol/openid-connect/auth
+  oidc.tokenUrl: https://auth.gzac.baseflow.com/realms/cg-dmf/protocol/openid-connect/token
 }
 vars:secret [
   jwt.clientSecret
 ]
-

docker-compose.integration-test.yml

@@ -68,7 +68,7 @@ services:
       BESTANDSDELEN_CHUNK_SIZE: ${BESTANDSDELEN_CHUNK_SIZE:-100000}
       ENCRYPTION_SECRET_KEY: ${ENCRYPTION_SECRET_KEY:-changeme-use-a-strong-key-in-production}
       ENCRYPTION_SALT: ${ENCRYPTION_SALT:-deadbeefcafe0123456789abcdef0123}
-      OIDC_JWT_SECRET: ${JWT_CLIENT_SECRET:-your-secret}
+      ZGW_CLIENT_SECRETS: cg-dmf-integration-test:${JWT_CLIENT_SECRET:-your-secret}
       WOPI_ENABLED: true
       WOPI_SLAT_SECRET: ${WOPI_SLAT_SECRET:-changeme-use-a-strong-key-in-production}
     healthcheck:

src/main/kotlin/config/AuthenticationModule.kt

@@ -25,7 +25,6 @@ import java.util.concurrent.TimeUnit
 fun Application.authenticationModule() {
     val logger = LoggerFactory.getLogger("AuthenticationModule")
     val issuer = AuthenticationConfig.issuer
-    val jwtSecret = AuthenticationConfig.jwtSecret
     val zgwClientSecrets = AuthenticationConfig.zgwClientSecrets
 
     install(Authentication) {
@@ -35,28 +34,16 @@ fun Application.authenticationModule() {
                 header?.let { parseAuthorizationHeader(it) }
             }
 
-            if (jwtSecret != null) {
-                // HS256 verification using a shared secret (e.g. local dev or symmetric key setup).
-                logger.info("[JWT] Using HS256 secret verification for auth-jwt")
-                verifier(
-                    JWT.require(Algorithm.HMAC256(jwtSecret))
-                        .withIssuer(issuer)
-                        .acceptLeeway(3)
-                        .build(),
-                )
-            } else {
-                // Configure JWK provider to fetch signing keys from Keycloak.
-                // Only used when OIDC_JWT_SECRET is not set.
-                val jwkProvider = JwkProviderBuilder(URI("$issuer/protocol/openid-connect/certs").toURL())
-                    .cached(10, 24, TimeUnit.HOURS)
-                    .rateLimited(10, 1, TimeUnit.MINUTES)
-                    .build()
+            // Configure JWK provider to fetch signing keys from Keycloak.
+            val jwkProvider = JwkProviderBuilder(URI("$issuer/protocol/openid-connect/certs").toURL())
+                .cached(10, 24, TimeUnit.HOURS)
+                .rateLimited(10, 1, TimeUnit.MINUTES)
+                .build()
 
-                // RS256 verification via Keycloak's JWK endpoint (production default).
-                logger.info("[JWT] Using JWK/RS256 verification for auth-jwt (issuer={})", issuer)
-                verifier(jwkProvider, issuer) {
-                    acceptLeeway(3)
-                }
+            // RS256 verification via Keycloak's JWK endpoint (production default).
+            logger.info("[JWT] Using JWK/RS256 verification for auth-jwt (issuer={})", issuer)
+            verifier(jwkProvider, issuer) {
+                acceptLeeway(3)
             }
 
             validate { credential ->