Skip to content

Commit b433ebd

Browse files
swalter-letsdevswalter-letsdev
committed
add server ip whitelisting
1 parent 52e4703 commit b433ebd

21 files changed

Lines changed: 147 additions & 37 deletions

File tree

‎basyx.aasdiscoveryservice/basyx.aasdiscoveryservice-feature-authorization/src/main/java/org/eclipse/digitaltwin/basyx/aasdiscoveryservice/feature/authorization/letsdev/LdSsoConfigProperties.java‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,12 @@ public class LdSsoConfigProperties {
1010
String baseUrl;
1111
String audience;
1212
Boolean debugEnabled = false;
13+
String[] whitelistedIps = {};
14+
15+
public String[] getWhitelistedIps() {
16+
17+
return whitelistedIps;
18+
}
1319

1420
public String getBaseUrl() {
1521

‎basyx.aasdiscoveryservice/basyx.aasdiscoveryservice-feature-authorization/src/main/java/org/eclipse/digitaltwin/basyx/aasdiscoveryservice/feature/authorization/letsdev/WebSecurityConfig.java‎

Lines changed: 22 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -15,6 +15,9 @@
1515
import org.springframework.security.oauth2.jwt.NimbusJwtDecoder;
1616
import org.springframework.security.oauth2.server.resource.authentication.JwtAuthenticationConverter;
1717
import org.springframework.security.web.SecurityFilterChain;
18+
import org.springframework.security.web.util.matcher.IpAddressMatcher;
19+
20+
import java.util.ArrayList;
1821
import java.util.List;
1922
import static org.springframework.security.oauth2.core.OAuth2TokenIntrospectionClaimNames.AUD;
2023

@@ -35,18 +38,25 @@ public WebSecurityConfig(LdSsoConfigProperties ldSsoConfigProperties) {
3538
public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
3639

3740
http
38-
.oauth2ResourceServer(oauth2ResourceServerCustomizer ->
39-
oauth2ResourceServerCustomizer.jwt(jwtCustomizer -> {
40-
jwtCustomizer.jwkSetUri(ldSsoConfigProperties.getBaseUrl() + JWKS_PATH);
41-
jwtCustomizer.jwtAuthenticationConverter(new JwtAuthenticationConverter());
42-
jwtCustomizer.decoder(jwtDecoder()); // Validate jwt aud claim
43-
})
44-
)
45-
.authorizeHttpRequests(customizer ->
46-
customizer
47-
.anyRequest()
48-
.authenticated()
49-
);
41+
.oauth2ResourceServer(oauth2ResourceServerCustomizer ->
42+
oauth2ResourceServerCustomizer.jwt(jwtCustomizer -> {
43+
jwtCustomizer.jwkSetUri(ldSsoConfigProperties.getBaseUrl() + JWKS_PATH);
44+
jwtCustomizer.jwtAuthenticationConverter(new JwtAuthenticationConverter());
45+
jwtCustomizer.decoder(jwtDecoder()); // Validate jwt aud claim
46+
})
47+
)
48+
.authorizeHttpRequests(customizer -> {
49+
for (int i = 0; i < ldSsoConfigProperties.getWhitelistedIps().length; i++) {
50+
String currentIp = ldSsoConfigProperties.getWhitelistedIps()[i];
51+
customizer
52+
.requestMatchers(new IpAddressMatcher(currentIp))
53+
.permitAll();
54+
}
55+
56+
customizer
57+
.anyRequest()
58+
.authenticated();
59+
});
5060

5161
return http.build();
5262
}

‎basyx.aasdiscoveryservice/basyx.aasdiscoveryservice.component/src/main/resources/application.properties‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -33,3 +33,4 @@ basyx.backend=InMemory
3333
ld-sso.base-url = https://sso.twinmap.de
3434
ld-sso.audience = aas_twinmaps_daimler
3535
ld-sso.debug-enabled = false
36+
ld-sso.whitelisted-ips = TODO

‎basyx.aasenvironment/basyx.aasenvironment-feature-authorization/src/main/java/org/eclipse/digitaltwin/basyx/aasenvironment/feature/authorization/letsdev/LdSsoConfigProperties.java‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,12 @@ public class LdSsoConfigProperties {
1010
String baseUrl;
1111
String audience;
1212
Boolean debugEnabled = false;
13+
String[] whitelistedIps = {};
14+
15+
public String[] getWhitelistedIps() {
16+
17+
return whitelistedIps;
18+
}
1319

1420
public String getBaseUrl() {
1521

‎basyx.aasenvironment/basyx.aasenvironment-feature-authorization/src/main/java/org/eclipse/digitaltwin/basyx/aasenvironment/feature/authorization/letsdev/WebSecurityConfig.java‎

Lines changed: 12 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -15,6 +15,7 @@
1515
import org.springframework.security.oauth2.jwt.NimbusJwtDecoder;
1616
import org.springframework.security.oauth2.server.resource.authentication.JwtAuthenticationConverter;
1717
import org.springframework.security.web.SecurityFilterChain;
18+
import org.springframework.security.web.util.matcher.IpAddressMatcher;
1819

1920
import java.util.List;
2021

@@ -44,11 +45,18 @@ public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Excepti
4445
jwtCustomizer.decoder(jwtDecoder()); // Validate jwt aud claim
4546
})
4647
)
47-
.authorizeHttpRequests(customizer ->
48+
.authorizeHttpRequests(customizer -> {
49+
for (int i = 0; i < ldSsoConfigProperties.getWhitelistedIps().length; i++) {
50+
String currentIp = ldSsoConfigProperties.getWhitelistedIps()[i];
4851
customizer
49-
.anyRequest()
50-
.authenticated()
51-
);
52+
.requestMatchers(new IpAddressMatcher(currentIp))
53+
.permitAll();
54+
}
55+
56+
customizer
57+
.anyRequest()
58+
.authenticated();
59+
});
5260

5361
return http.build();
5462
}

‎basyx.aasenvironment/basyx.aasenvironment.component/src/main/resources/application.properties‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -78,3 +78,4 @@ basyx.backend = InMemory
7878
ld-sso.base-url = https://sso.twinmap.de
7979
ld-sso.audience = aas_twinmaps_daimler
8080
ld-sso.debug-enabled = false
81+
ld-sso.whitelisted-ips = TODO

‎basyx.aasregistry/basyx.aasregistry-feature-authorization/src/main/java/org/eclipse/digitaltwin/basyx/aasregistry/feature/authorization/letsdev/LdSsoConfigProperties.java‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,12 @@ public class LdSsoConfigProperties {
1010
String baseUrl;
1111
String audience;
1212
Boolean debugEnabled = false;
13+
String[] whitelistedIps = {};
14+
15+
public String[] getWhitelistedIps() {
16+
17+
return whitelistedIps;
18+
}
1319

1420
public String getBaseUrl() {
1521

‎basyx.aasregistry/basyx.aasregistry-feature-authorization/src/main/java/org/eclipse/digitaltwin/basyx/aasregistry/feature/authorization/letsdev/WebSecurityConfig.java‎

Lines changed: 12 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -15,6 +15,7 @@
1515
import org.springframework.security.oauth2.jwt.NimbusJwtDecoder;
1616
import org.springframework.security.oauth2.server.resource.authentication.JwtAuthenticationConverter;
1717
import org.springframework.security.web.SecurityFilterChain;
18+
import org.springframework.security.web.util.matcher.IpAddressMatcher;
1819

1920
import java.util.List;
2021

@@ -44,11 +45,18 @@ public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Excepti
4445
jwtCustomizer.decoder(jwtDecoder()); // Validate jwt aud claim
4546
})
4647
)
47-
.authorizeHttpRequests(customizer ->
48+
.authorizeHttpRequests(customizer -> {
49+
for (int i = 0; i < ldSsoConfigProperties.getWhitelistedIps().length; i++) {
50+
String currentIp = ldSsoConfigProperties.getWhitelistedIps()[i];
4851
customizer
49-
.anyRequest()
50-
.authenticated()
51-
);
52+
.requestMatchers(new IpAddressMatcher(currentIp))
53+
.permitAll();
54+
}
55+
56+
customizer
57+
.anyRequest()
58+
.authenticated();
59+
});
5260

5361
return http.build();
5462
}

‎basyx.aasrepository/basyx.aasrepository-feature-authorization/src/main/java/org/eclipse/digitaltwin/basyx/aasrepository/feature/authorization/letsdev/LdSsoConfigProperties.java‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,12 @@ public class LdSsoConfigProperties {
1010
String baseUrl;
1111
String audience;
1212
Boolean debugEnabled = false;
13+
String[] whitelistedIps = {};
14+
15+
public String[] getWhitelistedIps() {
16+
17+
return whitelistedIps;
18+
}
1319

1420
public String getBaseUrl() {
1521

‎basyx.aasrepository/basyx.aasrepository-feature-authorization/src/main/java/org/eclipse/digitaltwin/basyx/aasrepository/feature/authorization/letsdev/WebSecurityConfig.java‎

Lines changed: 12 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -15,6 +15,7 @@
1515
import org.springframework.security.oauth2.jwt.NimbusJwtDecoder;
1616
import org.springframework.security.oauth2.server.resource.authentication.JwtAuthenticationConverter;
1717
import org.springframework.security.web.SecurityFilterChain;
18+
import org.springframework.security.web.util.matcher.IpAddressMatcher;
1819

1920
import java.util.List;
2021

@@ -44,11 +45,18 @@ public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Excepti
4445
jwtCustomizer.decoder(jwtDecoder()); // Validate jwt aud claim
4546
})
4647
)
47-
.authorizeHttpRequests(customizer ->
48+
.authorizeHttpRequests(customizer -> {
49+
for (int i = 0; i < ldSsoConfigProperties.getWhitelistedIps().length; i++) {
50+
String currentIp = ldSsoConfigProperties.getWhitelistedIps()[i];
4851
customizer
49-
.anyRequest()
50-
.authenticated()
51-
);
52+
.requestMatchers(new IpAddressMatcher(currentIp))
53+
.permitAll();
54+
}
55+
56+
customizer
57+
.anyRequest()
58+
.authenticated();
59+
});
5260

5361
return http.build();
5462
}

0 commit comments

Comments
 (0)