Skip to content

Commit 52e4703

Browse files
swalter-letsdevswalter-letsdev
committed
add ld sso integration to components
1 parent c1614a1 commit 52e4703

21 files changed

Lines changed: 897 additions & 4 deletions

File tree

‎basyx.aasdiscoveryservice/basyx.aasdiscoveryservice-feature-authorization/src/main/java/org/eclipse/digitaltwin/basyx/aasdiscoveryservice/feature/authorization/letsdev/LdSsoConfigProperties.java‎

Lines changed: 43 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,43 @@
1+
package org.eclipse.digitaltwin.basyx.aasdiscoveryservice.feature.authorization.letsdev;
2+
3+
import org.springframework.boot.context.properties.ConfigurationProperties;
4+
import org.springframework.context.annotation.Configuration;
5+
6+
@Configuration
7+
@ConfigurationProperties("ld-sso")
8+
public class LdSsoConfigProperties {
9+
10+
String baseUrl;
11+
String audience;
12+
Boolean debugEnabled = false;
13+
14+
public String getBaseUrl() {
15+
16+
return baseUrl;
17+
}
18+
19+
public void setBaseUrl(String baseUrl) {
20+
21+
this.baseUrl = baseUrl;
22+
}
23+
24+
public String getAudience() {
25+
26+
return audience;
27+
}
28+
29+
public void setAudience(String audience) {
30+
31+
this.audience = audience;
32+
}
33+
34+
public Boolean getDebugEnabled() {
35+
36+
return debugEnabled;
37+
}
38+
39+
public void setDebugEnabled(Boolean debugEnabled) {
40+
41+
this.debugEnabled = debugEnabled;
42+
}
43+
}

‎basyx.aasdiscoveryservice/basyx.aasdiscoveryservice-feature-authorization/src/main/java/org/eclipse/digitaltwin/basyx/aasdiscoveryservice/feature/authorization/letsdev/WebSecurityConfig.java‎

Lines changed: 79 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,79 @@
1+
package org.eclipse.digitaltwin.basyx.aasdiscoveryservice.feature.authorization.letsdev;
2+
3+
import org.springframework.context.annotation.Bean;
4+
import org.springframework.context.annotation.Configuration;
5+
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
6+
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
7+
import org.springframework.security.config.annotation.web.configuration.WebSecurityCustomizer;
8+
import org.springframework.security.oauth2.core.DelegatingOAuth2TokenValidator;
9+
import org.springframework.security.oauth2.core.OAuth2TokenValidator;
10+
import org.springframework.security.oauth2.jwt.Jwt;
11+
import org.springframework.security.oauth2.jwt.JwtClaimValidator;
12+
import org.springframework.security.oauth2.jwt.JwtDecoder;
13+
import org.springframework.security.oauth2.jwt.JwtDecoders;
14+
import org.springframework.security.oauth2.jwt.JwtValidators;
15+
import org.springframework.security.oauth2.jwt.NimbusJwtDecoder;
16+
import org.springframework.security.oauth2.server.resource.authentication.JwtAuthenticationConverter;
17+
import org.springframework.security.web.SecurityFilterChain;
18+
import java.util.List;
19+
import static org.springframework.security.oauth2.core.OAuth2TokenIntrospectionClaimNames.AUD;
20+
21+
@Configuration
22+
@EnableWebSecurity(debug = true)
23+
public class WebSecurityConfig {
24+
25+
private static final String JWKS_PATH = "/.well-known/jwks.json";
26+
27+
private final LdSsoConfigProperties ldSsoConfigProperties;
28+
29+
public WebSecurityConfig(LdSsoConfigProperties ldSsoConfigProperties) {
30+
31+
this.ldSsoConfigProperties = ldSsoConfigProperties;
32+
}
33+
34+
@Bean
35+
public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
36+
37+
http
38+
.oauth2ResourceServer(oauth2ResourceServerCustomizer ->
39+
oauth2ResourceServerCustomizer.jwt(jwtCustomizer -> {
40+
jwtCustomizer.jwkSetUri(ldSsoConfigProperties.getBaseUrl() + JWKS_PATH);
41+
jwtCustomizer.jwtAuthenticationConverter(new JwtAuthenticationConverter());
42+
jwtCustomizer.decoder(jwtDecoder()); // Validate jwt aud claim
43+
})
44+
)
45+
.authorizeHttpRequests(customizer ->
46+
customizer
47+
.anyRequest()
48+
.authenticated()
49+
);
50+
51+
return http.build();
52+
}
53+
54+
OAuth2TokenValidator<Jwt> audienceValidator() {
55+
return new JwtClaimValidator<List<String>>(AUD, aud -> aud.contains(ldSsoConfigProperties.getAudience()));
56+
}
57+
58+
@Bean
59+
public JwtDecoder jwtDecoder() {
60+
61+
String issuerUri = ldSsoConfigProperties.getBaseUrl();
62+
63+
NimbusJwtDecoder jwtDecoder = JwtDecoders.fromIssuerLocation(issuerUri);
64+
65+
OAuth2TokenValidator<Jwt> audienceValidator = audienceValidator();
66+
OAuth2TokenValidator<Jwt> withIssuer = JwtValidators.createDefaultWithIssuer(issuerUri);
67+
OAuth2TokenValidator<Jwt> withAudience = new DelegatingOAuth2TokenValidator<>(withIssuer, audienceValidator);
68+
69+
jwtDecoder.setJwtValidator(withAudience);
70+
71+
return jwtDecoder;
72+
}
73+
74+
@Bean
75+
public WebSecurityCustomizer webSecurityCustomizer() {
76+
77+
return web -> web.debug(ldSsoConfigProperties.getDebugEnabled());
78+
}
79+
}

‎basyx.aasdiscoveryservice/basyx.aasdiscoveryservice.component/src/main/resources/application.properties‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -28,4 +28,8 @@ basyx.backend=InMemory
2828
#basyx.feature.authorization.type = rbac
2929
#basyx.feature.authorization.jwtBearerTokenProvider = keycloak
3030
#basyx.feature.authorization.rbac.file = classpath:rbac_rules.json
31-
#spring.security.oauth2.resourceserver.jwt.issuer-uri= http://localhost:9096/realms/BaSyx
31+
#spring.security.oauth2.resourceserver.jwt.issuer-uri= http://localhost:9096/realms/BaSyx
32+
33+
ld-sso.base-url = https://sso.twinmap.de
34+
ld-sso.audience = aas_twinmaps_daimler
35+
ld-sso.debug-enabled = false

‎basyx.aasenvironment/basyx.aasenvironment-feature-authorization/src/main/java/org/eclipse/digitaltwin/basyx/aasenvironment/feature/authorization/letsdev/LdSsoConfigProperties.java‎

Lines changed: 43 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,43 @@
1+
package org.eclipse.digitaltwin.basyx.aasenvironment.feature.authorization.letsdev;
2+
3+
import org.springframework.boot.context.properties.ConfigurationProperties;
4+
import org.springframework.context.annotation.Configuration;
5+
6+
@Configuration
7+
@ConfigurationProperties("ld-sso")
8+
public class LdSsoConfigProperties {
9+
10+
String baseUrl;
11+
String audience;
12+
Boolean debugEnabled = false;
13+
14+
public String getBaseUrl() {
15+
16+
return baseUrl;
17+
}
18+
19+
public void setBaseUrl(String baseUrl) {
20+
21+
this.baseUrl = baseUrl;
22+
}
23+
24+
public String getAudience() {
25+
26+
return audience;
27+
}
28+
29+
public void setAudience(String audience) {
30+
31+
this.audience = audience;
32+
}
33+
34+
public Boolean getDebugEnabled() {
35+
36+
return debugEnabled;
37+
}
38+
39+
public void setDebugEnabled(Boolean debugEnabled) {
40+
41+
this.debugEnabled = debugEnabled;
42+
}
43+
}

‎basyx.aasenvironment/basyx.aasenvironment-feature-authorization/src/main/java/org/eclipse/digitaltwin/basyx/aasenvironment/feature/authorization/letsdev/WebSecurityConfig.java‎

Lines changed: 81 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,81 @@
1+
package org.eclipse.digitaltwin.basyx.aasenvironment.feature.authorization.letsdev;
2+
3+
import org.springframework.context.annotation.Bean;
4+
import org.springframework.context.annotation.Configuration;
5+
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
6+
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
7+
import org.springframework.security.config.annotation.web.configuration.WebSecurityCustomizer;
8+
import org.springframework.security.oauth2.core.DelegatingOAuth2TokenValidator;
9+
import org.springframework.security.oauth2.core.OAuth2TokenValidator;
10+
import org.springframework.security.oauth2.jwt.Jwt;
11+
import org.springframework.security.oauth2.jwt.JwtClaimValidator;
12+
import org.springframework.security.oauth2.jwt.JwtDecoder;
13+
import org.springframework.security.oauth2.jwt.JwtDecoders;
14+
import org.springframework.security.oauth2.jwt.JwtValidators;
15+
import org.springframework.security.oauth2.jwt.NimbusJwtDecoder;
16+
import org.springframework.security.oauth2.server.resource.authentication.JwtAuthenticationConverter;
17+
import org.springframework.security.web.SecurityFilterChain;
18+
19+
import java.util.List;
20+
21+
import static org.springframework.security.oauth2.core.OAuth2TokenIntrospectionClaimNames.AUD;
22+
23+
@Configuration
24+
@EnableWebSecurity(debug = true)
25+
public class WebSecurityConfig {
26+
27+
private static final String JWKS_PATH = "/.well-known/jwks.json";
28+
29+
private final LdSsoConfigProperties ldSsoConfigProperties;
30+
31+
public WebSecurityConfig(LdSsoConfigProperties ldSsoConfigProperties) {
32+
33+
this.ldSsoConfigProperties = ldSsoConfigProperties;
34+
}
35+
36+
@Bean
37+
public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
38+
39+
http
40+
.oauth2ResourceServer(oauth2ResourceServerCustomizer ->
41+
oauth2ResourceServerCustomizer.jwt(jwtCustomizer -> {
42+
jwtCustomizer.jwkSetUri(ldSsoConfigProperties.getBaseUrl() + JWKS_PATH);
43+
jwtCustomizer.jwtAuthenticationConverter(new JwtAuthenticationConverter());
44+
jwtCustomizer.decoder(jwtDecoder()); // Validate jwt aud claim
45+
})
46+
)
47+
.authorizeHttpRequests(customizer ->
48+
customizer
49+
.anyRequest()
50+
.authenticated()
51+
);
52+
53+
return http.build();
54+
}
55+
56+
OAuth2TokenValidator<Jwt> audienceValidator() {
57+
return new JwtClaimValidator<List<String>>(AUD, aud -> aud.contains(ldSsoConfigProperties.getAudience()));
58+
}
59+
60+
@Bean
61+
public JwtDecoder jwtDecoder() {
62+
63+
String issuerUri = ldSsoConfigProperties.getBaseUrl();
64+
65+
NimbusJwtDecoder jwtDecoder = JwtDecoders.fromIssuerLocation(issuerUri);
66+
67+
OAuth2TokenValidator<Jwt> audienceValidator = audienceValidator();
68+
OAuth2TokenValidator<Jwt> withIssuer = JwtValidators.createDefaultWithIssuer(issuerUri);
69+
OAuth2TokenValidator<Jwt> withAudience = new DelegatingOAuth2TokenValidator<>(withIssuer, audienceValidator);
70+
71+
jwtDecoder.setJwtValidator(withAudience);
72+
73+
return jwtDecoder;
74+
}
75+
76+
@Bean
77+
public WebSecurityCustomizer webSecurityCustomizer() {
78+
79+
return web -> web.debug(ldSsoConfigProperties.getDebugEnabled());
80+
}
81+
}

‎basyx.aasenvironment/basyx.aasenvironment.component/src/main/resources/application.properties‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -73,4 +73,8 @@ basyx.backend = InMemory
7373
####################################################################################
7474
# To define the total request size for a multipart/form-data (default 10 MB)
7575

76-
# spring.servlet.multipart.max-request-size=128KB
76+
# spring.servlet.multipart.max-request-size=128KB
77+
78+
ld-sso.base-url = https://sso.twinmap.de
79+
ld-sso.audience = aas_twinmaps_daimler
80+
ld-sso.debug-enabled = false

‎basyx.aasregistry/basyx.aasregistry-feature-authorization/src/main/java/org/eclipse/digitaltwin/basyx/aasregistry/feature/authorization/letsdev/LdSsoConfigProperties.java‎

Lines changed: 43 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,43 @@
1+
package org.eclipse.digitaltwin.basyx.aasregistry.feature.authorization.letsdev;
2+
3+
import org.springframework.boot.context.properties.ConfigurationProperties;
4+
import org.springframework.context.annotation.Configuration;
5+
6+
@Configuration
7+
@ConfigurationProperties("ld-sso")
8+
public class LdSsoConfigProperties {
9+
10+
String baseUrl;
11+
String audience;
12+
Boolean debugEnabled = false;
13+
14+
public String getBaseUrl() {
15+
16+
return baseUrl;
17+
}
18+
19+
public void setBaseUrl(String baseUrl) {
20+
21+
this.baseUrl = baseUrl;
22+
}
23+
24+
public String getAudience() {
25+
26+
return audience;
27+
}
28+
29+
public void setAudience(String audience) {
30+
31+
this.audience = audience;
32+
}
33+
34+
public Boolean getDebugEnabled() {
35+
36+
return debugEnabled;
37+
}
38+
39+
public void setDebugEnabled(Boolean debugEnabled) {
40+
41+
this.debugEnabled = debugEnabled;
42+
}
43+
}

‎basyx.aasregistry/basyx.aasregistry-feature-authorization/src/main/java/org/eclipse/digitaltwin/basyx/aasregistry/feature/authorization/letsdev/WebSecurityConfig.java‎

Lines changed: 81 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,81 @@
1+
package org.eclipse.digitaltwin.basyx.aasregistry.feature.authorization.letsdev;
2+
3+
import org.springframework.context.annotation.Bean;
4+
import org.springframework.context.annotation.Configuration;
5+
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
6+
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
7+
import org.springframework.security.config.annotation.web.configuration.WebSecurityCustomizer;
8+
import org.springframework.security.oauth2.core.DelegatingOAuth2TokenValidator;
9+
import org.springframework.security.oauth2.core.OAuth2TokenValidator;
10+
import org.springframework.security.oauth2.jwt.Jwt;
11+
import org.springframework.security.oauth2.jwt.JwtClaimValidator;
12+
import org.springframework.security.oauth2.jwt.JwtDecoder;
13+
import org.springframework.security.oauth2.jwt.JwtDecoders;
14+
import org.springframework.security.oauth2.jwt.JwtValidators;
15+
import org.springframework.security.oauth2.jwt.NimbusJwtDecoder;
16+
import org.springframework.security.oauth2.server.resource.authentication.JwtAuthenticationConverter;
17+
import org.springframework.security.web.SecurityFilterChain;
18+
19+
import java.util.List;
20+
21+
import static org.springframework.security.oauth2.core.OAuth2TokenIntrospectionClaimNames.AUD;
22+
23+
@Configuration
24+
@EnableWebSecurity(debug = true)
25+
public class WebSecurityConfig {
26+
27+
private static final String JWKS_PATH = "/.well-known/jwks.json";
28+
29+
private final LdSsoConfigProperties ldSsoConfigProperties;
30+
31+
public WebSecurityConfig(LdSsoConfigProperties ldSsoConfigProperties) {
32+
33+
this.ldSsoConfigProperties = ldSsoConfigProperties;
34+
}
35+
36+
@Bean
37+
public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
38+
39+
http
40+
.oauth2ResourceServer(oauth2ResourceServerCustomizer ->
41+
oauth2ResourceServerCustomizer.jwt(jwtCustomizer -> {
42+
jwtCustomizer.jwkSetUri(ldSsoConfigProperties.getBaseUrl() + JWKS_PATH);
43+
jwtCustomizer.jwtAuthenticationConverter(new JwtAuthenticationConverter());
44+
jwtCustomizer.decoder(jwtDecoder()); // Validate jwt aud claim
45+
})
46+
)
47+
.authorizeHttpRequests(customizer ->
48+
customizer
49+
.anyRequest()
50+
.authenticated()
51+
);
52+
53+
return http.build();
54+
}
55+
56+
OAuth2TokenValidator<Jwt> audienceValidator() {
57+
return new JwtClaimValidator<List<String>>(AUD, aud -> aud.contains(ldSsoConfigProperties.getAudience()));
58+
}
59+
60+
@Bean
61+
public JwtDecoder jwtDecoder() {
62+
63+
String issuerUri = ldSsoConfigProperties.getBaseUrl();
64+
65+
NimbusJwtDecoder jwtDecoder = JwtDecoders.fromIssuerLocation(issuerUri);
66+
67+
OAuth2TokenValidator<Jwt> audienceValidator = audienceValidator();
68+
OAuth2TokenValidator<Jwt> withIssuer = JwtValidators.createDefaultWithIssuer(issuerUri);
69+
OAuth2TokenValidator<Jwt> withAudience = new DelegatingOAuth2TokenValidator<>(withIssuer, audienceValidator);
70+
71+
jwtDecoder.setJwtValidator(withAudience);
72+
73+
return jwtDecoder;
74+
}
75+
76+
@Bean
77+
public WebSecurityCustomizer webSecurityCustomizer() {
78+
79+
return web -> web.debug(ldSsoConfigProperties.getDebugEnabled());
80+
}
81+
}

0 commit comments

Comments
 (0)