Feature/354 openid auth #1007
Merged
Feature/354 openid auth #1007
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
|
Still thinking of ways to automate testing this without going overboard. |
* Add extension to start keycloak instance. * Configure OpenID parameters for test CDA instance. * Add additional user to keycloak that intentionally doesn't have privileges * Verify keycloak user with priveleges works.
MikeNeilson
added
the
approved-W192HQ23F0232-task4
rma-rripken
reviewed
Feb 7, 2025
rma-rripken
reviewed
Feb 7, 2025
rma-rripken
reviewed
Feb 7, 2025
cwms-data-api/src/main/java/cwms/cda/security/OpenIDAccessManager.java
Outdated
Show resolved
Hide resolved
rma-rripken
reviewed
Feb 7, 2025
cwms-data-api/src/main/java/cwms/cda/security/OpenIDAccessManager.java
Outdated
Show resolved
Hide resolved
rma-rripken
reviewed
Feb 7, 2025
cwms-data-api/src/main/java/cwms/cda/security/OpenIDAccessManager.java
Outdated
Show resolved
Hide resolved
rma-rripken
reviewed
Feb 7, 2025
cwms-data-api/src/test/java/cwms/cda/api/auth/OpenIdConnectTestIT.java
Outdated
Show resolved
Hide resolved
rma-rripken
reviewed
Feb 7, 2025
|
I'm not in a position to test this on my own. The changes look ok but there are several things here that I don't entirely understand. Not in a "I'm confused about it" sense but in the sense that I don't know any of the details so I don't have an opinion. |
rma-rripken
previously approved these changes
Feb 7, 2025
rma-rripken
reviewed
Feb 7, 2025
cwms-data-api/src/test/java/fixtures/CwmsDataApiSetupCallback.java
Outdated
Show resolved
Hide resolved
rma-rripken
requested changes
Feb 12, 2025
rma-rripken
reviewed
Feb 19, 2025
rma-rripken
approved these changes
Feb 19, 2025
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Adds support for initial user creation from a trusted JWT.
NOTES:
Uses the "principle_name" (note: spelled incorrectly in database) field to store the combination of JWT issuer and subject claim . The subject is a UUID and so the combination of issue+subject is always unique. This was done after discovering that the one of the test infrastructure OIDC providers doesn't include the CAC EDIPI anywhere and it could not be used for user lookup.
Using a full identity provider principal is better anyways, so may as well start here.
Additionally updates the docker-compose to require no external setup. This should make testing and development far easier for newcomers to the project.