[backend] fix: verify opencti requests with jwks (#4973)

MarineLeM · guillaumejparis · Copilot · web-flow · commit df23bbf1d855 · 2026-02-20T15:36:47.000+01:00
Signed-off-by: Marine LM &lt;marine.lemezo@filigran.io&gt;
Co-authored-by: Guillaume &lt;guillaume.paris@filigran.io&gt;
Co-authored-by: Copilot &lt;175728472+Copilot@users.noreply.github.com&gt;
diff --git a/openaev-api/src/main/java/io/openaev/config/AppSecurityConfig.java b/openaev-api/src/main/java/io/openaev/config/AppSecurityConfig.java
@@ -8,6 +8,7 @@
 import io.openaev.config.security.OpenSamlConfig;
 import io.openaev.config.security.SecurityService;
 import io.openaev.database.model.User;
+import io.openaev.security.OpenCTIJwtAuthenticationFilter;
 import io.openaev.security.SsoRefererAuthenticationFailureHandler;
 import io.openaev.security.SsoRefererAuthenticationSuccessHandler;
 import io.openaev.security.TokenAuthenticationFilter;
@@ -61,6 +62,8 @@ public class AppSecurityConfig {
   @Bean
   public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
     http.addFilterBefore(tokenAuthenticationFilter(), UsernamePasswordAuthenticationFilter.class)
+        .addFilterBefore(
+            openCTIJwtAuthenticationFilter(), UsernamePasswordAuthenticationFilter.class)
         .requestCache(Customizer.withDefaults())
         .requestCache(cache -> cache.requestCache(new HttpSessionRequestCache()))
         .csrf(AbstractHttpConfigurer::disable)
@@ -131,6 +134,11 @@ public TokenAuthenticationFilter tokenAuthenticationFilter() {
     return new TokenAuthenticationFilter();
   }
 
+  @Bean
+  public OpenCTIJwtAuthenticationFilter openCTIJwtAuthenticationFilter() {
+    return new OpenCTIJwtAuthenticationFilter();
+  }
+
   public User userOauth2Management(ClientRegistration clientRegistration, OAuth2User user) {
     String emailAttribute = user.getAttribute("email");
     String registrationId = clientRegistration.getRegistrationId();
diff --git a/openaev-api/src/main/java/io/openaev/opencti/client/mutations/Ping.java b/openaev-api/src/main/java/io/openaev/opencti/client/mutations/Ping.java
@@ -21,6 +21,7 @@ public class Ping implements Mutation {
       mutation PingConnector($id: ID!, $state: String, $connectorInfo: ConnectorInfoInput ) {
         pingConnector(id: $id, state: $state, connectorInfo: $connectorInfo) {
           id
+          jwks
           connector_state
           connector_info {
               run_and_terminate
@@ -57,6 +58,9 @@ public static class PingConnectorContent {
       @JsonProperty("connector_state")
       private ObjectNode connectorState;
 
+      @JsonProperty("jwks")
+      private String jwks;
+
       @JsonProperty("connector_info")
       private ConnectorInfo connectorInfo;
 
diff --git a/openaev-api/src/main/java/io/openaev/opencti/client/mutations/RegisterConnector.java b/openaev-api/src/main/java/io/openaev/opencti/client/mutations/RegisterConnector.java
@@ -23,6 +23,7 @@ mutation RegisterConnector($input: RegisterConnectorInput) {
       registerConnector(input: $input) {
         id
         connector_state
+        jwks
         config {
           connection {
             host
@@ -95,6 +96,9 @@ public static class RegisterConnectorContent {
       @JsonProperty("connector_state")
       private ObjectNode connectorState;
 
+      @JsonProperty("jwks")
+      private String jwks;
+
       @JsonProperty("config")
       private ConfigNode config;
 
diff --git a/openaev-api/src/main/java/io/openaev/opencti/connectors/impl/SecurityCoverageConnector.java b/openaev-api/src/main/java/io/openaev/opencti/connectors/impl/SecurityCoverageConnector.java
@@ -9,6 +9,7 @@
 import java.util.ArrayList;
 import java.util.List;
 import lombok.Getter;
+import lombok.Setter;
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.boot.context.properties.ConfigurationProperties;
 import org.springframework.stereotype.Component;
@@ -25,6 +26,7 @@ public class SecurityCoverageConnector extends ConnectorBase {
 
   private final ConnectorType type = ConnectorType.INTERNAL_ENRICHMENT;
   private final String name = "OpenAEV Coverage";
+  @Setter private volatile String jwks;
 
   public SecurityCoverageConnector() {
     this.setScope(new ArrayList<>(List.of("security-coverage")));
diff --git a/openaev-api/src/main/java/io/openaev/opencti/connectors/service/OpenCTIConnectorService.java b/openaev-api/src/main/java/io/openaev/opencti/connectors/service/OpenCTIConnectorService.java
@@ -22,12 +22,13 @@ public class OpenCTIConnectorService {
   private final OpenCTIService openCTIService;
 
   @NotNull
-  private Optional<ConnectorBase> getConnectorBase() {
+  public Optional<SecurityCoverageConnector> getConnectorBase() {
     // don't examine the bundle
     // pick the first occurrence of the correct connector type
     // it's not supported yet to have more than one active connector of each type
     return connectors.stream()
         .filter(c -> c instanceof SecurityCoverageConnector && c.shouldRegister())
+        .map(c -> (SecurityCoverageConnector) c)
         .findFirst();
   }
 
@@ -56,7 +57,7 @@ public void registerOrPingAllConnectors() {
   }
 
   public void pushSecurityCoverageStixBundle(Bundle bundle) throws ConnectorError, IOException {
-    Optional<ConnectorBase> connector = getConnectorBase();
+    Optional<SecurityCoverageConnector> connector = getConnectorBase();
 
     if (connector.isEmpty()) {
       throw new ConnectorError(
@@ -67,7 +68,7 @@ public void pushSecurityCoverageStixBundle(Bundle bundle) throws ConnectorError,
   }
 
   public void acknowledgeReceivedOfCoverage(String workId, String message) {
-    Optional<ConnectorBase> connector = getConnectorBase();
+    Optional<SecurityCoverageConnector> connector = getConnectorBase();
 
     if (connector.isPresent()) {
       try {
@@ -79,7 +80,7 @@ public void acknowledgeReceivedOfCoverage(String workId, String message) {
   }
 
   public void acknowledgeProcessedOfCoverage(String workId, String message, Boolean inError) {
-    Optional<ConnectorBase> connector = getConnectorBase();
+    Optional<SecurityCoverageConnector> connector = getConnectorBase();
 
     if (connector.isPresent()) {
       try {
diff --git a/openaev-api/src/main/java/io/openaev/opencti/service/OpenCTIService.java b/openaev-api/src/main/java/io/openaev/opencti/service/OpenCTIService.java
@@ -11,6 +11,7 @@
 import io.openaev.opencti.client.response.fields.Error;
 import io.openaev.opencti.config.OpenCTIConfig;
 import io.openaev.opencti.connectors.ConnectorBase;
+import io.openaev.opencti.connectors.impl.SecurityCoverageConnector;
 import io.openaev.opencti.connectors.service.PrivilegeService;
 import io.openaev.opencti.errors.ConnectorError;
 import io.openaev.stix.objects.Bundle;
@@ -32,6 +33,12 @@ public class OpenCTIService {
   private final ObjectMapper mapper;
   private final PrivilegeService privilegeService;
 
+  private void applyJwksIfApplicable(ConnectorBase connector, String jwks) {
+    if (connector instanceof SecurityCoverageConnector scc) {
+      scc.setJwks(jwks);
+    }
+  }
+
   public RegisterConnector.ResponsePayload registerConnector(ConnectorBase connector)
       throws IOException, ConnectorError {
 
@@ -60,6 +67,9 @@ public RegisterConnector.ResponsePayload registerConnector(ConnectorBase connect
           "Registered connector {} with OpenCTI at {}", connector.getName(), connector.getApiUrl());
       // side effect on transient state
       connector.setRegistered(true);
+      if (payload.getRegisterConnectorContent() != null) {
+        applyJwksIfApplicable(connector, payload.getRegisterConnectorContent().getJwks());
+      }
       return payload;
     }
   }
@@ -91,6 +101,9 @@ public Ping.ResponsePayload pingConnector(ConnectorBase connector)
       Ping.ResponsePayload payload = mapper.convertValue(r.getData(), Ping.ResponsePayload.class);
       log.info(
           "Pinged connector {} with OpenCTI at {}", connector.getName(), connector.getApiUrl());
+      if (payload.getPingConnectorContent() != null) {
+        applyJwksIfApplicable(connector, payload.getPingConnectorContent().getJwks());
+      }
       return payload;
     }
   }
diff --git a/openaev-api/src/main/java/io/openaev/security/OpenCTIJwtAuthenticationFilter.java b/openaev-api/src/main/java/io/openaev/security/OpenCTIJwtAuthenticationFilter.java
@@ -0,0 +1,94 @@
+package io.openaev.security;
+
+import io.jsonwebtoken.Jwts;
+import io.jsonwebtoken.security.Jwks;
+import io.openaev.opencti.connectors.impl.SecurityCoverageConnector;
+import io.openaev.opencti.connectors.service.OpenCTIConnectorService;
+import io.openaev.service.UserService;
+import jakarta.servlet.FilterChain;
+import jakarta.servlet.ServletException;
+import jakarta.servlet.http.HttpServletRequest;
+import jakarta.servlet.http.HttpServletResponse;
+import java.io.IOException;
+import java.util.Optional;
+import lombok.extern.slf4j.Slf4j;
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.web.filter.OncePerRequestFilter;
+
+@Slf4j
+public class OpenCTIJwtAuthenticationFilter extends OncePerRequestFilter {
+  private UserService userService;
+  private OpenCTIConnectorService openCTIConnectorService;
+
+  @Autowired
+  public void setUserService(UserService userService) {
+    this.userService = userService;
+  }
+
+  @Autowired
+  public void setOpenCTIConnectorService(OpenCTIConnectorService openCTIConnectorService) {
+    this.openCTIConnectorService = openCTIConnectorService;
+  }
+
+  @Override
+  protected boolean shouldNotFilter(HttpServletRequest request) {
+    // only runs for /api/stix/** — skipped for everything else
+    return !request.getRequestURI().startsWith("/api/stix/");
+  }
+
+  /**
+   * Function used to validate JWT token with OpenCTI jwks
+   *
+   * @param jwt JWT token to validate
+   * @throws Exception if token not valid
+   */
+  public void validateOpenCTIJwt(String jwt) throws Exception {
+    Optional<SecurityCoverageConnector> openCTIConnector =
+        openCTIConnectorService.getConnectorBase();
+    if (openCTIConnector.isEmpty()) {
+      throw new ServletException("Connector not found");
+    }
+
+    Jwts.parser()
+        .requireIssuer("opencti")
+        .requireSubject("connector")
+        .keyLocator(
+            header -> {
+              String kid = (String) header.get("kid");
+              return Jwks.setParser()
+                  .build()
+                  .parse(openCTIConnector.get().getJwks())
+                  .getKeys()
+                  .stream()
+                  .filter(k -> kid.equals(k.getId()))
+                  .findFirst()
+                  .orElseThrow()
+                  .toKey();
+            })
+        .build()
+        .parseSignedClaims(jwt);
+  }
+
+  @Override
+  protected void doFilterInternal(
+      HttpServletRequest request, HttpServletResponse response, FilterChain filterChain)
+      throws ServletException, IOException {
+
+    String authHeader = request.getHeader("Authorization");
+    if (authHeader == null || !authHeader.startsWith("Bearer")) {
+      filterChain.doFilter(request, response);
+      return;
+    }
+    String token = authHeader.substring("Bearer ".length()).trim();
+
+    try {
+      validateOpenCTIJwt(token);
+      this.userService.createAdminSession();
+    } catch (Exception e) {
+      response.sendError(HttpServletResponse.SC_UNAUTHORIZED, e.getMessage());
+      return;
+    }
+
+    filterChain.doFilter(request, response);
+  }
+}
diff --git a/openaev-api/src/main/java/io/openaev/service/UserService.java b/openaev-api/src/main/java/io/openaev/service/UserService.java
@@ -24,6 +24,7 @@
 import java.util.*;
 import lombok.RequiredArgsConstructor;
 import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.beans.factory.annotation.Value;
 import org.springframework.cache.Cache;
 import org.springframework.cache.CacheManager;
 import org.springframework.security.core.Authentication;
@@ -49,6 +50,9 @@
 public class UserService {
   @Resource private SessionManager sessionManager;
 
+  @Value("${openbas.admin.email:${openaev.admin.email:#{null}}}")
+  private String adminEmail;
+
   /** Password encoder using Argon2 algorithm (Spring Security 5.8 defaults). */
   private final Argon2PasswordEncoder passwordEncoder =
       Argon2PasswordEncoder.defaultsForSpringSecurity_v5_8();
@@ -129,6 +133,12 @@ public void createUserSession(User user) {
     SecurityContextHolder.setContext(context);
   }
 
+  /** Creates admin security session */
+  public void createAdminSession() {
+    User adminUser = this.userRepository.findByEmailIgnoreCase(this.adminEmail).orElseThrow();
+    this.createUserSession(adminUser);
+  }
+
   /**
    * Encodes a plaintext password using Argon2.
    *
diff --git a/openaev-api/src/test/java/io/openaev/opencti/OpenCTIJwtAuthenticationTest.java b/openaev-api/src/test/java/io/openaev/opencti/OpenCTIJwtAuthenticationTest.java
diff --git a/openaev-api/src/test/java/io/openaev/opencti/service/OpenCTIServiceTest.java b/openaev-api/src/test/java/io/openaev/opencti/service/OpenCTIServiceTest.java
diff --git a/pom.xml b/pom.xml
