Implement RAS Authentication Provider #195

Gcolon021 · 2024-08-02T16:47:03Z

Create OktaAuthenticationService by extracting generic OKTA authentication code.
Create & Implement RASAuthenticationService and RASAuthenticationServiceTest.
Create & Implement RASPassportService and RASPassportServiceTest.
Implement RAS Passport handling and polling.
- Add new enum for potential passport validation responses. This is used to ensure all potential return values are handled with in a switch statement.
Add model for RAS Passport and RAS Visas.
Add Passport property to User entity.
- Includes a corresponding migration script to add new column to database.
Add new methods to the JWTUtil class to assist with decoding and parsing RAS Passports which use a JWT format.
Included SessionService for session management with caching support.

Create OktaAuthenticationService to extract OKTA implementation. Added RASAuthenticationService and RASPassportService. Implement RAS Passport handling and polling. Added SessionService for session management with caching support. Implemented unit tests for RASAuthenticationService and RASPassPortService to validate RAS authentication flows and passport handling.

Introduced a set to track public access roles in `RoleService` and automatically assign these roles to users in `UserService`. This ensures every user has access to public datasets by default.

We no longer use the security context to retrieve the user. We now use the authentication token. This ensures we don't have lazy loading exceptions associated with the previous approach.

Extracted expired visa validation from `validateVisa` method to simplify the logic and duty separation. Modified tests to use a parsed visa for more accurate validation simulations. Added placeholder `updateExpirationTime` method to JWTUtil for future use.

Extend the `CustomLogoutHandler` to remove the user's passport upon logout by calling the new `removeUserPassport` method in `UserService`.

This update introduces checks for RAS passport validity, including expiration validation and issuer. Additionally, a new configuration property for passport issuer was added. Test cases were extended to include these validation steps.

...auth-services/src/main/java/edu/harvard/hms/dbmi/avillach/auth/service/impl/UserService.java

…lach/auth/service/impl/UserService.java

ToString does no include visas for security purposes.

Updated the logging messages to include additional context by incorporating the authorization code and user subject. These changes were made to allow for chaining logs in splunk.

...auth-services/src/main/java/edu/harvard/hms/dbmi/avillach/auth/service/impl/RoleService.java

Reduced the fixed delay for passport validation from 3000000 to 300000 milliseconds to ensure more frequent checks. Added logging to indicate the start of the passport validation process for better traceability.

pic-sure-auth-db/db/sql/V5__MIGRATE_TO_ACCESSRULE_JOINTABLE.sql

ramari16 · 2024-08-19T18:45:20Z

...uth-services/src/main/java/edu/harvard/hms/dbmi/avillach/auth/model/ras/Ga4ghPassportV1.java

+
+import java.util.List;
+
+public class Ga4ghPassportV1 {


It might be a pain, but do we want to name these what they actually stand for and json map them individually? At the very least we should add documentation what they mean

...rvices/src/main/java/edu/harvard/hms/dbmi/avillach/auth/service/impl/RASPassPortService.java

Luke-Sikina

Didn't have time to review tests.

...ervices/src/main/java/edu/harvard/hms/dbmi/avillach/auth/service/impl/AccessRuleService.java

Luke-Sikina · 2024-08-19T16:08:09Z

pic-sure-auth-services/src/main/java/edu/harvard/hms/dbmi/avillach/auth/entity/User.java

@@ -280,6 +283,14 @@ public void setToken(String token) {
 		this.token = token;
 	}

+	public String getPassport() {


What is a passport?

...vices/src/main/java/edu/harvard/hms/dbmi/avillach/auth/enums/PassportValidationResponse.java

...services/src/main/java/edu/harvard/hms/dbmi/avillach/auth/rest/AuthenticationController.java

...services/src/main/java/edu/harvard/hms/dbmi/avillach/auth/service/impl/PrivilegeService.java

...auth-services/src/main/java/edu/harvard/hms/dbmi/avillach/auth/service/impl/RoleService.java

...uth-services/src/main/java/edu/harvard/hms/dbmi/avillach/auth/service/impl/TokenService.java

...auth-services/src/main/java/edu/harvard/hms/dbmi/avillach/auth/service/impl/UserService.java

Refactor RoleService to modularize role extraction and validation logic during fence mapping permission creation. Cleaned up the initialization logic in RASPassPortService and improved string handling. Simplified access rule cache eviction and standardized user variable naming across authentication services.

Reversed the condition to correctly handle non-empty authentication responses. Previously, the code incorrectly treated non-empty responses as empty, leading to skipped session initialization.

Changed the token refresh service to return typed `RefreshToken` responses instead of maps. Introduced `ValidRefreshToken` and `InvalidRefreshToken` types. Updated tests and controller to handle the new response types appropriately.

Created a migration script to add a 'passport' column of type TEXT to the 'user' table.

Gcolon021 self-assigned this Aug 2, 2024

Gcolon021 added the enhancement New feature or request label Aug 2, 2024

Gcolon021 added 10 commits August 2, 2024 12:56

Remove RasAPIEndpoints enum class

3952dff

Refactor passport validation and logging

4dd8cb5

Add public dataset access to default user roles

9e7da73

Introduced a set to track public access roles in `RoleService` and automatically assign these roles to users in `UserService`. This ensures every user has access to public datasets by default.

Refactor exception handling and add RAS passport check

fe1af3a

Change fetch type of privileges to EAGER

858688d

Change fetch types for Application and Privilege entities.

c6b365d

Add id_token to authorization code flow test

b22e717

Refactor refreshToken logic and remove redundant tests.

208387c

We no longer use the security context to retrieve the user. We now use the authentication token. This ensures we don't have lazy loading exceptions associated with the previous approach.

Log RAS passport details during authentication

f4649bb

Gcolon021 force-pushed the RAS-Passport branch from 9cf82da to f4649bb Compare August 9, 2024 15:24

Gcolon021 added 3 commits August 9, 2024 13:42

Log RAS passport details during authentication

18d1a5a

Add user passport removal on logout

e876285

Extend the `CustomLogoutHandler` to remove the user's passport upon logout by calling the new `removeUserPassport` method in `UserService`.

Gcolon021 force-pushed the RAS-Passport branch from 8782b6e to e2a9d92 Compare August 13, 2024 14:10

Gcolon021 commented Aug 13, 2024

View reviewed changes

...auth-services/src/main/java/edu/harvard/hms/dbmi/avillach/auth/service/impl/UserService.java Outdated Show resolved Hide resolved

Gcolon021 and others added 6 commits August 13, 2024 10:17

Update pic-sure-auth-services/src/main/java/edu/harvard/hms/dbmi/avil…

1c7d81e

…lach/auth/service/impl/UserService.java

Update log message for RAS passport

7a70f92

Verify Issued at (iat) in passport claims

b7a0fdf

Refactor log messages for clarity and add Passport toString

d34c01a

ToString does no include visas for security purposes.

Refactor logging statements for clarity and consistency

f93acb2

Enhance login logging in RASAuthenticationService

cfdafd6

Updated the logging messages to include additional context by incorporating the authorization code and user subject. These changes were made to allow for chaining logs in splunk.

Gcolon021 force-pushed the RAS-Passport branch from c933640 to ca691a2 Compare August 14, 2024 16:21

Improve logs for splunk log chaining

5ea2384

Gcolon021 force-pushed the RAS-Passport branch from ca691a2 to 5ea2384 Compare August 14, 2024 16:22

JamesPeck reviewed Aug 15, 2024

View reviewed changes

...auth-services/src/main/java/edu/harvard/hms/dbmi/avillach/auth/service/impl/RoleService.java Show resolved Hide resolved

Add missing whitespace

cb2bd18

Gcolon021 added 3 commits August 16, 2024 16:49

Update passport validation schedule and add logging

539fd80

Reduced the fixed delay for passport validation from 3000000 to 300000 milliseconds to ensure more frequent checks. Added logging to indicate the start of the passport validation process for better traceability.

Add check for users with passports before validation

a523b46

Remove unused property from application.properties

226e166

ramari16 reviewed Aug 19, 2024

View reviewed changes

pic-sure-auth-db/db/sql/V5__MIGRATE_TO_ACCESSRULE_JOINTABLE.sql Show resolved Hide resolved

ramari16 reviewed Aug 19, 2024

View reviewed changes

...rvices/src/main/java/edu/harvard/hms/dbmi/avillach/auth/service/impl/RASPassPortService.java Outdated Show resolved Hide resolved

Remove "fence" keyword from generic functionality

83d8953

Luke-Sikina reviewed Aug 19, 2024

View reviewed changes

Gcolon021 added 5 commits August 20, 2024 10:56

Fix authentication logic in AuthenticationController

fca1548

Reversed the condition to correctly handle non-empty authentication responses. Previously, the code incorrectly treated non-empty responses as empty, leading to skipped session initialization.

Refactor token refresh response handling.

29b140b

Changed the token refresh service to return typed `RefreshToken` responses instead of maps. Introduced `ValidRefreshToken` and `InvalidRefreshToken` types. Updated tests and controller to handle the new response types appropriately.

Remove unnecessary comment

90c0cca

Add passport column to user table

7dc39e1

Created a migration script to add a 'passport' column of type TEXT to the 'user' table.

Gcolon021 merged commit e726eb3 into release Aug 22, 2024
2 checks passed

Gcolon021 deleted the RAS-Passport branch September 18, 2024 22:35

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Implement RAS Authentication Provider #195

Implement RAS Authentication Provider #195

Gcolon021 commented Aug 2, 2024 •

edited

Loading

ramari16 Aug 19, 2024

Luke-Sikina left a comment

Luke-Sikina Aug 19, 2024

Implement RAS Authentication Provider #195

Implement RAS Authentication Provider #195

Conversation

Gcolon021 commented Aug 2, 2024 • edited Loading

ramari16 Aug 19, 2024

Choose a reason for hiding this comment

Luke-Sikina left a comment

Choose a reason for hiding this comment

Luke-Sikina Aug 19, 2024

Choose a reason for hiding this comment

Gcolon021 commented Aug 2, 2024 •

edited

Loading