feat(jans-auth): new cluster beans and services

[yurem]

Prepare

• Read PR guidelines
• Read license information

---

Description

Target issue

closes #issue-number-here

Implementation Details

---

Test and Document the changes

• Static code analysis has been run locally and issues have been fixed
• Relevant unit and integration tests have been added/updated
• Relevant documentation has been updated if any (i.e. user guides, installation and configuration guides, technical design docs etc)

Closes #8668,

[dryrunsecurity]

Hi there 👋, @DryRunSecurity here, below is a summary of our analysis and findings.

DryRun Security	Status	Findings
Configured Codepaths Analyzer	✅	0 findings
Secrets Analyzer	✅	0 findings
Sensitive Files Analyzer	✅	0 findings
Authn/Authz Analyzer	✅	0 findings
AppSec Analyzer	✅	0 findings

Note

🟢 Risk threshold not exceeded.

Change Summary (click to expand)

The following is a summary of changes in this pull request made by me, your security buddy 🤖. Note that this summary is auto-generated and not meant to be a definitive list of security issues but rather a helpful summary from a security perspective.

Summary:

The code changes in this pull request cover various components of the Jans Auth Server application, with a focus on improving the management and security of the application's cluster nodes, token pools, and client-related operations.

The key security-related aspects to highlight are:

1. Input Validation and Sanitization: Ensure that user-provided input is properly validated and sanitized to prevent potential injection attacks, such as LDAP injection or SQL injection.
2. Access Control and Privilege Management: Review the access control mechanisms and ensure that the application's functionality is restricted based on the user's or component's privileges, following the principle of least privilege.
3. Secure Configuration and Key Management: Verify that sensitive configuration details and encryption keys are properly secured and access to them is restricted.
4. Logging and Monitoring: Ensure that sensitive information is not inadvertently logged, and implement appropriate logging and monitoring mechanisms to detect any suspicious activity.
5. Concurrency Control and Race Conditions: Review the implementation of concurrency control mechanisms, such as locking and synchronization, to prevent potential race conditions and ensure the integrity of the application's data.
6. Secure Serialization and Deserialization: Ensure that the serialization and deserialization of data, especially for distributed and clustered environments, are implemented securely to prevent potential vulnerabilities, such as object injection attacks.

Overall, the code changes appear to be focused on improving the application's security and reliability in a distributed environment. However, it's essential to review the entire codebase and the application's architecture to identify and address any potential security vulnerabilities or concerns.

Files Changed:

1. BaseDnConfiguration.java: The changes add a new field called "nodes" to the BaseDnConfiguration class, which should be reviewed to ensure that the field is used and handled securely.
2. ClusterNode.java: The new ClusterNode class introduces a locking mechanism and stores sensitive data, which should be reviewed for proper input validation, access control, and secure data handling.
3. TokenStatus.java: The changes define an enum for token status, which does not appear to introduce any significant security concerns.
4. TokenPool.java: The new TokenPool class is responsible for managing token-related data, which should be reviewed for secure data handling, concurrency control, and proper serialization/deserialization.
5. CleanerTimer.java: The changes in this class are related to a periodic cleanup process, which should be reviewed to ensure proper handling of sensitive data and access control.
6. GrantService.java: The changes focus on improving the handling and management of authorization grants and related token entities, which is a crucial security aspect of the application.
7. ScopeService.java: The changes in this class are related to managing scopes, which are essential for authentication and authorization. The implementation should be reviewed for proper input validation and secure data handling.
8. ClientService.java: The changes in this class are focused on improving the security and performance of client-related operations, such as authentication, token rotation, and encryption/decryption of client secrets.
9. TokenPoolService.java: The new TokenPoolService class is responsible for managing the token pool in a distributed environment, which should be reviewed for secure communication, access control, and input validation.
10. jans_schema.json: The changes add a new attribute "jansNum" to the Jans schema, which does not appear to introduce any obvious security risks but should be reviewed in the context of the application's overall security.
11. ClusterNodeService.java: The changes in this class are related to the management of cluster nodes, which should be reviewed for input validation, access control, and secure configuration.

Powered by DryRun Security

[mo-auto]

Error: Hi @yurem, You did not reference an open issue in your PR. I attempted to create an issue for you.
Please update that issues' title and body and make sure I correctly referenced it in the above PRs body.

[sonarcloud]

Quality Gate passed for 'jans-cli'

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
No data about Coverage
No data about Duplication

See analysis details on SonarCloud

[sonarcloud]

Quality Gate passed for 'jans-linux-setup'

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
No data about Coverage
0.0% Duplication on New Code

See analysis details on SonarCloud

[sonarcloud]

Quality Gate passed for 'jans-core'

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
No data about Coverage
No data about Duplication

See analysis details on SonarCloud

[sonarcloud]

Quality Gate passed for 'jans-config-api-parent'

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
No data about Coverage
No data about Duplication

See analysis details on SonarCloud

[yuriyz]

We decided to go on in same jans-auth-server-8562 branch.
#8620