Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

fix: replace default spring x509 authentication in zaas #3971

Merged
merged 13 commits into from
Feb 5, 2025
Merged

fix: replace default spring x509 authentication in zaas #3971

merged 13 commits into from
Feb 5, 2025

Conversation

richard-salac
Copy link
Contributor

@richard-salac richard-salac commented Jan 30, 2025 •
edited
Loading

Description

Zaas is using two level authentication, Zowe server certificate is required on top of traditional client authentication (x509, credentials, token,....). This is causing unexpected behavior with spring X509 authentication when Zowe server certificate may get propagated as authenticated username. To avoid such situations the spring x509 was disabled when possible.

Linked to # (issue)
Part of the # (epic)

Type of change

Please delete options that are not relevant.

  • fix: Bug fix (non-breaking change which fixes an issue)
  • feat: New feature (non-breaking change which adds functionality)
  • docs: Change in a documentation
  • refactor: Refactor the code
  • chore: Chore, repository cleanup, updates the dependencies.
  • BREAKING CHANGE or !: Breaking change (fix or feature that would cause existing functionality to not work as expected)

Checklist:

  • My code follows the style guidelines of this project
  • PR title conforms to commit message guideline ## Commit Message Structure Guideline
  • I have commented my code, particularly in hard-to-understand areas. In JS I did provide JSDoc
  • I have made corresponding changes to the documentation
  • My changes generate no new warnings
  • I have added tests that prove my fix is effective or that my feature works
  • New and existing unit tests pass locally with my changes
  • The java tests in the area I was working on leverage @nested annotations
  • Any dependent changes have been merged and published in downstream modules

For more details about how should the code look like read the Contributing guideline

@github-actions github-actions bot added the Sensitive Sensitive change that requires peer review label Jan 30, 2025
@richard-salac
fix: replace default x509 with categorize certs filter in zaas
8fa0f70 
Signed-off-by: Richard Salac <richard.salac@broadcom.com>
@richard-salac richard-salac force-pushed the reboot/fix/replace-default-x509-auth branch from 26ecb0e to 8fa0f70 Compare January 30, 2025 10:43
@richard-salac
wip: force gateway always use server certificate when calling zaas
beb4dea 
Signed-off-by: Richard Salac <richard.salac@broadcom.com>

Signed-off-by: Richard Salac <richard.salac@broadcom.com>
@richard-salac
wip: new filter to check for client certificate presence
027cf25 
Signed-off-by: Richard Salac <richard.salac@broadcom.com>

Signed-off-by: Richard Salac <richard.salac@broadcom.com>
@richard-salac
Merge branch 'v3.x.x' into reboot/fix/replace-default-x509-auth
0ec425d 
Signed-off-by: Richard Salač <richard.salac@broadcom.com>
@richard-salac richard-salac force-pushed the reboot/fix/replace-default-x509-auth branch 3 times, most recently from 9d17404 to c75cd98 Compare January 31, 2025 23:00
@richard-salac
fix: replace default spring x509 authentication in zaas
a3595fe 
Signed-off-by: Richard Salac <richard.salac@broadcom.com>
@richard-salac
fix: merge and cleanup
db72134 
Signed-off-by: Richard Salac <richard.salac@broadcom.com>
@richard-salac richard-salac force-pushed the reboot/fix/replace-default-x509-auth branch from 7f3f1b0 to db72134 Compare February 4, 2025 18:07
@richard-salac
chore: code cleanup
9bd52ee 
Signed-off-by: Richard Salac <richard.salac@broadcom.com>
richard-salac and others added 3 commits February 5, 2025 13:14
@richard-salac
cr
633ccfe 
Signed-off-by: Richard Salac <richard.salac@broadcom.com>
@richard-salac @pablocarle
Update apiml-security-common/src/test/java/org/zowe/apiml/security/co…
d68139f 
…mmon/auth/saf/SafResourceAccessSafTest.java

Co-authored-by: Pablo Carle <pablocarle@users.noreply.github.com>
Signed-off-by: Richard Salač <richard.salac@broadcom.com>
@richard-salac
chore: javadoc
b1ad98f 
Signed-off-by: Richard Salac <richard.salac@broadcom.com>
pablocarle
pablocarle approved these changes Feb 5, 2025
View reviewed changes
Copy link
Contributor

@pablocarle pablocarle left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Just a couple minor comments

zaas-service/src/main/java/org/zowe/apiml/zaas/security/config/NewSecurityConfiguration.java Outdated Show resolved Hide resolved
zaas-service/src/main/java/org/zowe/apiml/zaas/security/config/NewSecurityConfiguration.java Show resolved Hide resolved
@richard-salac
fix: cleanup the CertificateOrAuthProtectedEndpoints security config
7d8edfe 
Signed-off-by: Richard Salac <richard.salac@broadcom.com>
@richard-salac
remove obsolete comment
097d1cf 
Signed-off-by: Richard Salac <richard.salac@broadcom.com>
@sonarqubecloud SonarQubeCloud
Copy link

sonarqubecloud bot commented Feb 5, 2025

Quality Gate Failed Quality Gate failed

Failed conditions
75.0% Coverage on New Code (required ≥ 80%)

See analysis details on SonarQube Cloud

@richard-salac richard-salac merged commit 6290b1f into v3.x.x Feb 5, 2025
27 of 28 checks passed
@richard-salac richard-salac deleted the reboot/fix/replace-default-x509-auth branch February 5, 2025 19:07
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@pablocarle pablocarle pablocarle approved these changes

Assignees
No one assigned
Labels
Sensitive Sensitive change that requires peer review size/L
Projects
API Mediation Layer Backlog Management
Status: Done
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
2 participants
@richard-salac @pablocarle