feat(config-api): session and token search enhancement

[pujavs]

Prepare

• Read PR guidelines
• Read license information

---

Description

Target issue

• Issue#9666: session endpoint search enhancements to use comparison operator

• Issue#9717: fix(config-api): token-endpoint search error - IndexOutOfBoundsException

closes #9666 #9717

Implementation Details

---

Test and Document the changes

• Static code analysis has been run locally and issues have been fixed
• Relevant unit and integration tests have been added/updated
• Relevant documentation has been updated if any (i.e. user guides, installation and configuration guides, technical design docs etc)

Please check the below before submitting your PR. The PR will not be merged if there are no commits that start with docs: to indicate documentation changes or if the below checklist is not selected.

• I confirm that there is no impact on the docs due to the code changes in this PR.

[dryrunsecurity]

DryRun Security Summary

The provided code changes focus on improving the security and reliability of the Jans Config API application, with a particular emphasis on enhancing the Fido2 registration service, token management, session management, and various utility classes to prevent potential security issues, such as SQL injection vulnerabilities, and ensure proper input validation, data handling, and logging of sensitive information.

Expand for full summary

Summary:

The provided code changes cover various improvements and enhancements to the Jans Config API application, with a focus on security-related functionality and best practices. The changes span multiple files, including the Fido2 registration service, token management, session management, and utility classes.

The key security-related aspects of the changes include:

1. Improved Filtering and Search Functionality: The changes introduce more efficient and secure approaches to constructing search filters, handling user input, and mapping field values to database fields. This helps prevent potential security issues, such as SQL injection vulnerabilities.

2. Enhanced Token and Session Management: The changes improve the handling of token and session-related operations, including the ability to revoke tokens and delete sessions. This strengthens the overall security of the application's authentication and authorization mechanisms.

3. Input Validation and Data Handling: The changes demonstrate a focus on proper input validation, data type handling, and the use of utility methods to ensure that user input is correctly formatted and processed. This helps mitigate potential security risks.

4. Logging and Sensitive Information: The changes include some logging-related updates, and it's important to ensure that sensitive information, such as search parameters or filter values, is not logged in a way that could expose sensitive data or enable potential attacks.

Overall, the code changes appear to be a reasonable and security-focused set of improvements to the Jans Config API application. However, it's crucial to review the broader application context and ensure that the changes are properly integrated and do not introduce any unintended security implications.

Files Changed:

1. Fido2RegistrationService.java: The changes focus on improving the efficiency and accuracy of the Fido2 registration search functionality, with a consideration for security best practices.

2. TokenService.java: The changes enhance the token management functionality, including the generation of user DNs and the construction of search filters, to improve the security and reliability of the application.

3. SessionService.java: The changes improve the session management capabilities, including search and revocation functionality, which is crucial for maintaining the security of the application.

4. Util.java: The changes focus on improving the handling of field values and their mapping to database fields, with a consideration for potential security implications.

5. BaseResource.java: The changes enhance the search functionality and input validation, with a focus on ensuring that sensitive information is not exposed in logging or other output.

6. DataUtil.java: The changes introduce new utility functions for handling different data types and creating filters for database queries, which is important for maintaining security.

7. jans-config-api-swagger.yaml: The changes appear to be focused on improving the organization and structure of the Swagger documentation, without introducing any major security-related functionality.

8. FilterOperator.java: The new file defines an enumeration of different filter operators, which is a common functionality in many applications. It's important to ensure that these operators are used correctly and securely throughout the application.

9. FieldFilterData.java: The new class represents a data structure for holding information about a field, its operator, value, and type. Proper input validation and secure usage of this class are crucial to prevent potential security issues.

10. SearchRequest.java: The changes introduce a new field called "fieldFilterData" to the SearchRequest class, which should be reviewed to ensure that the data is properly validated and secured.

Code Analysis

We ran 9 analyzers against 10 files and 1 analyzer had findings. 8 analyzers had no findings.

Analyzer	Findings
Authn/Authz Analyzer	8 findings

Riskiness

🟢 Risk threshold not exceeded.

View PR in the DryRun Dashboard.

[sonarqubecloud]

Quality Gate passed for 'jans-core'

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarCloud

[sonarqubecloud]

Quality Gate passed for 'SCIM API'

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarCloud