-
Notifications
You must be signed in to change notification settings - Fork 276
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
refactor: update KeycloakTokenValidator to support multiple realms an…
…d Connector Builder Server (#13497)
- Loading branch information
Showing
10 changed files
with
195 additions
and
33 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
38 changes: 38 additions & 0 deletions
38
...mmons-server/src/main/kotlin/io/airbyte/commons/server/authorization/TokenRoleResolver.kt
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,38 @@ | ||
| package io.airbyte.commons.server.authorization | ||
|
|
||
| import io.airbyte.commons.auth.AuthRole | ||
| import io.airbyte.commons.server.support.RbacRoleHelper | ||
| import io.github.oshai.kotlinlogging.KotlinLogging | ||
| import io.micronaut.core.annotation.Nullable | ||
| import io.micronaut.http.HttpRequest | ||
| import jakarta.inject.Singleton | ||
|
|
||
| private val logger = KotlinLogging.logger {} | ||
|
|
||
| interface TokenRoleResolver { | ||
| fun resolveRoles( | ||
| @Nullable authUserId: String?, | ||
| httpRequest: HttpRequest<*>, | ||
| ): Set<String> | ||
| } | ||
|
|
||
| @Singleton | ||
| class RbacTokenRoleResolver( | ||
| private val rbacRoleHelper: RbacRoleHelper, | ||
| ) : TokenRoleResolver { | ||
| override fun resolveRoles( | ||
| @Nullable authUserId: String?, | ||
| httpRequest: HttpRequest<*>, | ||
| ): Set<String> { | ||
| logger.debug { "Resolving roles for authUserId $authUserId" } | ||
|
|
||
| if (authUserId.isNullOrBlank()) { | ||
| logger.debug { "Provided authUserId is null or blank, returning empty role set" } | ||
| return setOf() | ||
| } | ||
|
|
||
| return mutableSetOf(AuthRole.AUTHENTICATED_USER.name).apply { | ||
| addAll(rbacRoleHelper.getRbacRoles(authUserId, httpRequest)) | ||
| } | ||
| } | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
43 changes: 43 additions & 0 deletions
43
...rver/src/test/kotlin/io/airbyte/commons/server/authorization/RbacTokenRoleResolverTest.kt
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,43 @@ | ||
| package io.airbyte.commons.server.authorization | ||
|
|
||
| import io.airbyte.commons.auth.AuthRole | ||
| import io.airbyte.commons.server.support.RbacRoleHelper | ||
| import io.micronaut.http.HttpRequest | ||
| import io.mockk.every | ||
| import io.mockk.mockk | ||
| import org.junit.jupiter.api.Assertions.assertEquals | ||
| import org.junit.jupiter.api.BeforeEach | ||
| import org.junit.jupiter.api.Test | ||
|
|
||
| class RbacTokenRoleResolverTest { | ||
| private lateinit var rbacRoleHelper: RbacRoleHelper | ||
| private lateinit var rbacTokenRoleResolver: RbacTokenRoleResolver | ||
|
|
||
| @BeforeEach | ||
| fun setup() { | ||
| rbacRoleHelper = mockk() | ||
| rbacTokenRoleResolver = RbacTokenRoleResolver(rbacRoleHelper) | ||
| } | ||
|
|
||
| @Test | ||
| fun `test resolveRoles with null authUserId`() { | ||
| val roles = rbacTokenRoleResolver.resolveRoles(null, HttpRequest.GET<Any>("/")) | ||
| assertEquals(setOf<String>(), roles) | ||
| } | ||
|
|
||
| @Test | ||
| fun `test resolveRoles with blank authUserId`() { | ||
| val roles = rbacTokenRoleResolver.resolveRoles("", HttpRequest.GET<Any>("/")) | ||
| assertEquals(setOf<String>(), roles) | ||
| } | ||
|
|
||
| @Test | ||
| fun `test resolveRoles with valid authUserId`() { | ||
| val authUserId = "test-user" | ||
| val expectedRoles = setOf("ORGANIZATION_ADMIN", "WORKSPACE_EDITOR") | ||
| every { rbacRoleHelper.getRbacRoles(authUserId, any(HttpRequest::class)) } returns expectedRoles | ||
|
|
||
| val roles = rbacTokenRoleResolver.resolveRoles(authUserId, HttpRequest.GET<Any>("/")) | ||
| assertEquals(setOf(AuthRole.AUTHENTICATED_USER.name).plus(expectedRoles), roles) | ||
| } | ||
| } |
34 changes: 34 additions & 0 deletions
34
...in/kotlin/io/airbyte/connector_builder/authorization/ConnectorBuilderTokenRoleResolver.kt
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,34 @@ | ||
| @file:Suppress("ktlint:standard:package-name") | ||
|
|
||
| package io.airbyte.connector_builder.authorization | ||
|
|
||
| import io.airbyte.commons.auth.AuthRole | ||
| import io.airbyte.commons.server.authorization.TokenRoleResolver | ||
| import io.github.oshai.kotlinlogging.KotlinLogging | ||
| import io.micronaut.context.annotation.Primary | ||
| import jakarta.inject.Singleton | ||
|
|
||
| private val logger = KotlinLogging.logger {} | ||
|
|
||
| /** | ||
| * The Connector Builder Server's role resolver does not apply RBAC-specific roles, because they | ||
| * are not needed and currently inaccessible in the Connector Builder Server, which is isolated | ||
| * from other internal Airbyte applications (like the Config DB). If RBAC roles are needed in the | ||
| * future, the Connector Builder Server will need to be updated such that it is able to determine | ||
| * the RBAC roles of a user based on the Permissions stored in the Config DB. | ||
| */ | ||
| @Primary | ||
| @Singleton | ||
| class ConnectorBuilderTokenRoleResolver : TokenRoleResolver { | ||
| override fun resolveRoles( | ||
| authUserId: String?, | ||
| httpRequest: io.micronaut.http.HttpRequest<*>, | ||
| ): Set<String> { | ||
| if (authUserId.isNullOrBlank()) { | ||
| logger.debug { "Provided authUserId is null or blank, returning empty role set" } | ||
| return setOf() | ||
| } | ||
|
|
||
| return setOf(AuthRole.AUTHENTICATED_USER.name) | ||
| } | ||
| } |
37 changes: 37 additions & 0 deletions
37
...otlin/io/airbyte/connector_builder/authorization/ConnectorBuilderTokenRoleResolverTest.kt
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,37 @@ | ||
| @file:Suppress("ktlint:standard:package-name") | ||
|
|
||
| package io.airbyte.connector_builder.authorization | ||
|
|
||
| import io.airbyte.commons.auth.AuthRole | ||
| import io.micronaut.http.HttpRequest | ||
| import org.junit.jupiter.api.Assertions.assertEquals | ||
| import org.junit.jupiter.api.BeforeEach | ||
| import org.junit.jupiter.api.Test | ||
|
|
||
| class ConnectorBuilderTokenRoleResolverTest { | ||
| private lateinit var resolver: ConnectorBuilderTokenRoleResolver | ||
|
|
||
| @BeforeEach | ||
| fun setup() { | ||
| resolver = ConnectorBuilderTokenRoleResolver() | ||
| } | ||
|
|
||
| @Test | ||
| fun `test resolveRoles with null authUserId`() { | ||
| val roles = resolver.resolveRoles(null, HttpRequest.GET<Any>("/")) | ||
| assertEquals(setOf<String>(), roles) | ||
| } | ||
|
|
||
| @Test | ||
| fun `test resolveRoles with blank authUserId`() { | ||
| val roles = resolver.resolveRoles("", HttpRequest.GET<Any>("/")) | ||
| assertEquals(setOf<String>(), roles) | ||
| } | ||
|
|
||
| @Test | ||
| fun `test resolveRoles with valid authUserId`() { | ||
| val authUserId = "test-user" | ||
| val roles = resolver.resolveRoles(authUserId, HttpRequest.GET<Any>("/")) | ||
| assertEquals(setOf(AuthRole.AUTHENTICATED_USER.name), roles) | ||
| } | ||
| } |