feat(jans-cli-tui): client tokens and sessions

[devrimyatar]

[x] closes #9413
[ ] closes #9412

• Relevant documentation has been updated if any (i.e. user guides, installation and configuration guides, technical design docs etc)

[dryrunsecurity]

DryRun Security Summary

The pull request includes changes to the jans-cli-tui application, focusing on improving the user interface and functionality, particularly in the areas of SMTP configuration, OAuth client management, and various utility functions, while highlighting the need for thorough security review in areas such as input validation, secure storage and transmission, encryption and signing configuration, error handling and logging, and access control and authorization.

Expand for full summary

Summary:

The code changes in this pull request span across three different files in the jans-cli-tui application. The changes primarily focus on improving the user interface and functionality of the application, with a particular emphasis on the SMTP configuration, OAuth client management, and various utility functions.

From an application security perspective, the changes do not introduce any obvious security vulnerabilities. However, there are several areas that should be carefully reviewed to ensure the overall security of the application:

1. Input Validation: It's crucial to thoroughly validate all user inputs, especially those related to sensitive information (e.g., SMTP credentials, keystore details, OAuth client configurations) to prevent potential security issues such as injection attacks.

2. Secure Storage and Transmission: Sensitive information, such as SMTP credentials and OAuth client secrets, must be stored and transmitted securely to protect against unauthorized access and data breaches.

3. Encryption and Signing Configuration: The proper configuration of encryption and signing algorithms for various purposes (e.g., ID tokens, access tokens) is essential to ensure the confidentiality and integrity of sensitive data.

4. Error Handling and Logging: Robust error handling and comprehensive logging mechanisms can help identify and address potential security issues, as well as provide valuable information for incident response and forensic analysis.

5. Access Control and Authorization: The management of OAuth clients and their associated resources (e.g., scopes, active tokens, UMA resources) should be implemented with a strong access control and authorization model to prevent unauthorized access and modifications.

Overall, the code changes appear to be focused on improving the user experience and functionality of the application, and they do not immediately raise any major security concerns. However, it's important to review the application's security posture holistically and address the areas mentioned above to maintain a secure and robust system.

Files Changed:

1. jans-cli-tui/cli_tui/utils/static.py:

   • A new string constant confirm has been added to the common_strings class, likely to be used for displaying a confirmation message or dialog in the application. This change does not introduce any obvious security concerns.

2. jans-cli-tui/cli_tui/plugins/080_smtp/main.py:

   • The changes involve the removal of several imported modules and the simplification of the prepare_container method, which is responsible for creating the user interface elements for the SMTP configuration.
   • The code allows users to configure SMTP authentication credentials, keystore details, and connection protection methods. It's important to ensure that these configurations are handled securely to prevent potential security issues.

3. jans-cli-tui/cli_tui/plugins/010_auth_server/edit_client_dialog.py:

   • This file implements an "Edit Client Dialog" for managing OAuth clients, including their basic information, token settings, logout configurations, software information, and more.
   • The code covers a wide range of client configuration options and provides mechanisms for managing sensitive information, such as client secrets and access tokens. It's important to review the implementation of access control, input validation, and secure storage of sensitive data.

Code Analysis

We ran 9 analyzers against 3 files and 0 analyzers had findings. 9 analyzers had no findings.

Riskiness

🟢 Risk threshold not exceeded.

View PR in the DryRun Dashboard.

[sonarcloud]

Quality Gate passed for 'jans-pycloudlib'

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarCloud

[sonarcloud]

Quality Gate passed for 'jans-cli'

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarCloud

[sonarcloud]

Quality Gate passed for 'jans-linux-setup'

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarCloud

[sonarcloud]

Quality Gate passed for 'orm'

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarCloud

[sonarcloud]

Quality Gate passed for 'jans-config-api-parent'

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarCloud