diff --git a/.github/SECURITY.md b/.github/SECURITY.md
index cde7527b6c0..395d132edda 100644
--- a/.github/SECURITY.md
+++ b/.github/SECURITY.md
@@ -6,15 +6,16 @@ We appreciate your efforts to responsibly disclose your findings, and will make
## Supported versions
-Security updates will typically only be applied to the latest release (at least until **Janssen** reaches first stable major version).
+Security updates will typically only be applied to the latest release.
-| Version | Supported |
-| -------- | ------------------ |
-| >=0.1 | :white_check_mark: |
+| Version | Supported |
+|---------|--------------------|
+| <1.0.0 | :x: |
+| >=1.0.0 | :white_check_mark: |
## Reporting a vulnerability
-To report a security issue, send an email to [security@jans.io](mailto:security@jans.io?subject=SECURITY)
+To report a security issue email [security@jans.io](mailto:security@jans.io?subject=SECURITY)
The **Janssen** team will send a response indicating the next steps in handling your report.
After the initial reply to your report, the team will keep you informed of the progress towards a fix and full announcement,
diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index f33fe6fac22..97049410915 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -26,10 +26,6 @@ updates:
schedule:
interval: daily
- - package-ecosystem: pip
- directory: /demos/jans-tent
- schedule:
- interval: daily
- package-ecosystem: docker
directory: /docker-jans-all-in-one
diff --git a/.github/workflows/build-docker-image.yml b/.github/workflows/build-docker-image.yml
index d398da52eca..6a0dfef7cb1 100644
--- a/.github/workflows/build-docker-image.yml
+++ b/.github/workflows/build-docker-image.yml
@@ -57,7 +57,7 @@ jobs:
egress-policy: audit
- name: Install Cosign
- uses: sigstore/cosign-installer@v3.5.0
+ uses: sigstore/cosign-installer@59acb6260d9c0ba8f4a2f9d9b48431a222b68e20 # v3.5.0
- name: Checkout
uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
@@ -91,9 +91,9 @@ jobs:
if: steps.build_docker_image.outputs.build || github.event_name == 'tags'
run: |
sudo apt-get update
- sudo python3 -m pip install --upgrade pip
- sudo pip3 install setuptools --upgrade
- sudo pip3 install -r ./automation/requirements.txt
+ sudo python3 -m pip install --upgrade pip || echo "Failed to upgrade pip"
+ sudo pip3 install --ignore-installed setuptools --upgrade
+ sudo pip3 install --ignore-installed -r ./automation/requirements.txt
sudo apt-get update
#- uses: actions/delete-package-versions@v5
@@ -165,19 +165,19 @@ jobs:
fi
# UPDATE BUILD DATES INSIDE THE DOCKERFILE BEFORE BUILDING THE DEV IMAGES TRIGGERED BY JENKINS
- - name: Setup Python 3.7
+ - name: Setup Python 3.10
if: github.event_name == 'workflow_dispatch' && ${{ matrix.docker-images }} != 'loadtesting-jmeter'
uses: actions/setup-python@0a5c61591373683505ea898e09a3ea4f39ef2b9c # v5.0.0
with:
- python-version: 3.7
+ python-version: "3.10"
- name: Install Python dependencies
if: github.event_name == 'workflow_dispatch' && ${{ matrix.docker-images }} != 'loadtesting-jmeter'
run: |
sudo apt-get update
- sudo python3 -m pip install --upgrade pip
- sudo pip3 install setuptools --upgrade
- sudo pip3 install -r ./automation/requirements.txt
+ sudo python3 -m pip install --upgrade pip || echo "Failed to upgrade pip"
+ sudo pip3 install --ignore-installed setuptools --upgrade
+ sudo pip3 install --ignore-installed -r ./automation/requirements.txt
sudo apt-get update
sudo apt-get install jq
diff --git a/.github/workflows/build-docs.yml b/.github/workflows/build-docs.yml
index 7f62905eff6..28e9ce016b9 100644
--- a/.github/workflows/build-docs.yml
+++ b/.github/workflows/build-docs.yml
@@ -207,6 +207,13 @@ jobs:
git add index.yaml && git update-index --refresh
cd ..
# END move generated chart from a previous step
+
+ # copy search from nightly to all other versions. This is to ensure that the search index is available for all versions
+ for folder in v*/; do
+ cp -r nightly/search "$folder"
+ git add $folder/search && git update-index --refresh
+ done
+ # END copy search from nightly to all other versions
echo "Replacing release number markers with actual release number"
cd ${LATEST}
diff --git a/.github/workflows/build-nightly-build.yml b/.github/workflows/build-nightly-build.yml
index 92559bedfbd..83255433c8b 100644
--- a/.github/workflows/build-nightly-build.yml
+++ b/.github/workflows/build-nightly-build.yml
@@ -2,6 +2,11 @@ name: Activate Nightly Build
on:
workflow_dispatch:
+ inputs:
+ branch:
+ description: 'The branch to build night release from'
+ required: false
+ default: 'main'
schedule:
- cron: "0 23 * * *"
permissions:
@@ -37,4 +42,8 @@ jobs:
gh release delete ${NIGHTLY_VERSION} --cleanup-tag --yes || echo "v${NIGHTLY_VERSION}" does not exist
gh release delete ${NIGHTLY_VERSION} --cleanup-tag --yes || echo "v${NIGHTLY_VERSION}" does not exist
git push --delete origin ${NIGHTLY_VERSION} || echo "v${NIGHTLY_VERSION}" does not exist
- gh release create ${NIGHTLY_VERSION} --generate-notes --prerelease --title "${NIGHTLY_VERSION}"
\ No newline at end of file
+ TARGET_BRANCH=${{ github.event.inputs.branch }}
+ if [ -z "$TARGET_BRANCH" ]; then
+ TARGET_BRANCH="main"
+ fi
+ gh release create ${NIGHTLY_VERSION} --generate-notes --prerelease --title "${NIGHTLY_VERSION}" --target "${TARGET_BRANCH}"
\ No newline at end of file
diff --git a/.github/workflows/build-packages.yml b/.github/workflows/build-packages.yml
index 6d5687ec882..c9b886d4c24 100644
--- a/.github/workflows/build-packages.yml
+++ b/.github/workflows/build-packages.yml
@@ -5,6 +5,8 @@ on:
tags:
- 'v**'
- 'nightly'
+permissions:
+ contents: read
jobs:
publish_binary_packages:
if: github.repository == 'JanssenProject/jans'
@@ -196,7 +198,7 @@ jobs:
run: |
sudo apt-get update
sudo apt-get install -y python3 build-essential ca-certificates dbus systemd iproute2 gpg python3-pip python3-dev libpq-dev gcc
- python3 -m pip install --upgrade pip
+ python3 -m pip install --upgrade pip || echo "Failed to upgrade pip"
pip3 install shiv wheel setuptools
echo "Building jans-linux-setup package"
sudo chown -R runner:docker /home/runner/work/jans/jans
@@ -337,7 +339,7 @@ jobs:
gh release upload $VER *.zip *.sha256sum --clobber
build_cedarling_python:
if: github.repository == 'JanssenProject/jans'
- runs-on: ubuntu-latest
+ runs-on: ubuntu-20.04
steps:
- name: Harden Runner
uses: step-security/harden-runner@a4aa98b93cab29d9b1101a6143fb8bce00e2eac4 # v2.7.1
@@ -356,8 +358,8 @@ jobs:
git_user_signingkey: true
git_commit_gpgsign: true
- - uses: actions/setup-python@v5
- - uses: PyO3/maturin-action@v1
+ - uses: actions/setup-python@0b93645e9fea7318ecaed2b359559ac225c90a2b # v5.3.0
+ - uses: PyO3/maturin-action@ea5bac0f1ccd0ab11c805e2b804bfcb65dac2eab # v1.45.0
with:
working-directory: ${{ github.workspace }}/jans-cedarling/bindings/cedarling_python
command: build
@@ -373,9 +375,9 @@ jobs:
TAG="0.0.0"
fi
cd ${{ github.workspace }}/jans-cedarling/target/wheels
- sha256sum cedarling_python-"${TAG}"-cp311-cp311-manylinux_2_34_x86_64.whl > cedarling_python-"${TAG}"-cp311-cp311-manylinux_2_34_x86_64.whl.sha256sum
- sha256sum cedarling_python-"${TAG}"-cp310-cp310-manylinux_2_34_x86_64.whl > cedarling_python-"${TAG}"-cp310-cp310-manylinux_2_34_x86_64.whl.sha256sum
- gpg --armor --detach-sign cedarling_python-"${TAG}"-cp311-cp311-manylinux_2_34_x86_64.whl || echo "Failed to sign"
- gpg --armor --detach-sign cedarling_python-"${TAG}"-cp310-cp310-manylinux_2_34_x86_64.whl || echo "Failed to sign"
+ sha256sum cedarling_python-"${TAG}"-cp311-cp311-manylinux_2_31_x86_64.whl > cedarling_python-"${TAG}"-cp311-cp311-manylinux_2_31_x86_64.whl.sha256sum
+ sha256sum cedarling_python-"${TAG}"-cp310-cp310-manylinux_2_31_x86_64.whl > cedarling_python-"${TAG}"-cp310-cp310-manylinux_2_31_x86_64.whl.sha256sum
+ gpg --armor --detach-sign cedarling_python-"${TAG}"-cp311-cp311-manylinux_2_31_x86_64.whl || echo "Failed to sign"
+ gpg --armor --detach-sign cedarling_python-"${TAG}"-cp310-cp310-manylinux_2_31_x86_64.whl || echo "Failed to sign"
echo "${{ secrets.MOAUTO_WORKFLOW_TOKEN }}" | gh auth login --with-token
gh release upload "${VERSION}" *.whl *.sha256sum *.asc
\ No newline at end of file
diff --git a/.github/workflows/build-test.yml b/.github/workflows/build-test.yml
index 0142d4bc5b4..59fe986c6c5 100644
--- a/.github/workflows/build-test.yml
+++ b/.github/workflows/build-test.yml
@@ -40,35 +40,50 @@ on:
concurrency:
group: run-once
cancel-in-progress: false
+permissions:
+ contents: read
jobs:
cleanup:
- if: github.event_name == 'push' && github.event.ref == 'refs/heads/main'
runs-on: ubuntu-20.04
env:
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+ permissions:
+ contents: read
+ packages: write
steps:
- name: Harden Runner
uses: step-security/harden-runner@a4aa98b93cab29d9b1101a6143fb8bce00e2eac4 # v2.7.1
with:
egress-policy: audit
- name: Get version ID for 0.0.0-nightly
- if: github.event_name == 'push' && github.ref == 'refs/heads/main'
id: get_version_id
run: |
- services=$(gh api -H "Accept: application/vnd.github+json" \
- /orgs/JanssenProject/packages?package_type=maven \
- | jq -r '.[].name')
- for service in "${services}"; do
- version_id=$(gh api -H "Accept: application/vnd.github+json" \
- /orgs/JanssenProject/packages/maven/io.jans.${service}/versions \
- | jq -r '.[] | select(.name == "0.0.0-nightly") | .id')
- echo "version_id=$version_id" >> $GITHUB_ENV
- gh api --method DELETE \
- -H "Accept: application/vnd.github+json" \
- -H "X-GitHub-Api-Version: 2022-11-28" \
- /orgs/JanssenProject/packages/maven/io.jans."${service}"/versions/"${version_id}"
+ page=1
+ services=""
+ while true; do
+ response=$(gh api -H "Accept: application/vnd.github+json" \
+ /orgs/JanssenProject/packages?package_type=maven\&per_page=100\&page=$page)
+ names=$(echo "$response" | jq -r '.[].name')
+ if [ -z "$names" ]; then
+ break
+ fi
+ services="$services $names"
+ page=$((page + 1))
done
-
+
+ services=$(echo "$services" | tr '\n' ' ' | sed 's/ *$//')
+ echo "Services: $services"
+ for service in $services; do
+ echo "Checking $service"
+ version_id=$(gh api -H "Accept: application/vnd.github+json" \
+ /orgs/JanssenProject/packages/maven/"${service}"/versions \
+ | jq -r '.[] | select(.name == "0.0.0-nightly") | .id')
+ echo "version_id=$version_id" >> $GITHUB_ENV
+ gh api --method DELETE \
+ -H "Accept: application/vnd.github+json" \
+ -H "X-GitHub-Api-Version: 2022-11-28" \
+ /orgs/JanssenProject/packages/maven/"${service}"/versions/"${version_id}" || echo "Failed to delete $service"
+ done
prep-matrix:
needs: cleanup
@@ -126,18 +141,18 @@ jobs:
with:
egress-policy: audit
- name: Checkout code
- uses: actions/checkout@v4
+ uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
with:
ref: ${{ github.event.inputs.branch }}
- name: Set up Java 17
- uses: actions/setup-java@v4
+ uses: actions/setup-java@7a6d8a8234af8eb26422e24e3006232cccaa061b # v4.6.0
with:
java-version: '17'
distribution: 'adopt'
- name: Set up Maven
- uses: actions/setup-java@v4
+ uses: actions/setup-java@7a6d8a8234af8eb26422e24e3006232cccaa061b # v4.6.0
with:
java-version: '17'
distribution: 'adopt'
@@ -146,7 +161,8 @@ jobs:
- name: Build ${{ matrix.service }}
run: |
if [ "${{ github.event_name }}" == "pull_request" ]; then
- mvn -f ${{ matrix.service }}/pom.xml -Dcfg=${{ env.PROFILE_NAME }} -Dmaven.test.skip=${{ matrix.maven_skip_tests }} clean install -Drevision=${{ github.head_ref }}-nightly
+ revision=${{ github.sha }}-nightly
+ mvn -f ${{ matrix.service }}/pom.xml -Dcfg=${{ env.PROFILE_NAME }} -Dmaven.test.skip=${{ matrix.maven_skip_tests }} clean install -Drevision=$revision
else
mvn -f ${{ matrix.service }}/pom.xml -Dcfg=${{ env.PROFILE_NAME }} -Dmaven.test.skip=${{ matrix.maven_skip_tests }} clean install
fi
@@ -159,7 +175,7 @@ jobs:
- name: Archive results
if: always()
- uses: actions/upload-artifact@v4
+ uses: actions/upload-artifact@6f51ac03b9356f520e9adb1b1b7802705f340c2b # v4.5.0
with:
name: build-results
path: ${{ matrix.service }}/target
@@ -170,7 +186,9 @@ jobs:
run-tests:
if: github.event_name == 'push' || github.event_name == 'pull_request' || (github.event_name == 'workflow_dispatch' && github.event.inputs.project == 'jans-bom, jans-orm, jans-core, jans-lock/lock-server, agama, jans-auth-server, jans-link, jans-fido2, jans-scim, jans-keycloak-link, jans-config-api, jans-keycloak-integration, jans-casa')
- permissions: write-all
+ permissions:
+ contents: read
+ packages: write
needs: cleanup
runs-on: ubuntu-20.04
env:
@@ -198,18 +216,18 @@ jobs:
with:
egress-policy: audit
- name: Checkout code
- uses: actions/checkout@v4
+ uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
with:
ref: ${{ github.event.inputs.branch }}
- name: Set up Java 17
- uses: actions/setup-java@v4
+ uses: actions/setup-java@7a6d8a8234af8eb26422e24e3006232cccaa061b # v4.6.0
with:
java-version: '17'
distribution: 'adopt'
- name: Set up Maven
- uses: actions/setup-java@v4
+ uses: actions/setup-java@7a6d8a8234af8eb26422e24e3006232cccaa061b # v4.6.0
with:
java-version: '17'
distribution: 'adopt'
@@ -276,13 +294,13 @@ jobs:
ls /tmp/reports/
- name: Upload Test Results
- uses: actions/upload-artifact@v4
+ uses: actions/upload-artifact@6f51ac03b9356f520e9adb1b1b7802705f340c2b # v4.5.0
with:
name: ${{ matrix.persistence }}-test-results
path: /tmp/reports
- name: Publish Test Report ${{ matrix.persistence }}
- uses: starburstdata/action-testng-report@v1
+ uses: starburstdata/action-testng-report@f245422953fb97ec5075d07782a1b596124b7cc4 # v1.0.5
with:
report_paths: /tmp/reports/${{ matrix.persistence }}*.xml
github_token: ${{ github.token }}
diff --git a/.github/workflows/lint-flak8.yml b/.github/workflows/lint-flak8.yml
index 63dadc76b64..e8eff713621 100644
--- a/.github/workflows/lint-flak8.yml
+++ b/.github/workflows/lint-flak8.yml
@@ -4,14 +4,16 @@ on:
branches:
- main
paths:
- #TODO: add all python projects paths below "jans-pycloudlib", "jans-cli-tui", "jans-linux-setup"
- - 'demos/jans-tent/**'
+ - 'jans-pycloudlib/**'
+ - 'jans-cli-tui/**'
+ - 'jans-linux-setup/**'
pull_request:
branches:
- main
paths:
- #TODO: add all python projects paths below "jans-pycloudlib", "jans-cli-tui", "jans-linux-setup"
- - 'demos/jans-tent/**'
+ - 'jans-pycloudlib/**'
+ - 'jans-cli-tui/**'
+ - 'jans-linux-setup/**'
permissions:
contents: read
@@ -23,8 +25,11 @@ jobs:
#max-parallel: 1
fail-fast: false
matrix:
- #TODO: add all python projects paths below "jans-pycloudlib", "jans-cli-tui", "jans-linux-setup"
- python-projects: ["demos/jans-tent"]
+ python-projects: [
+ "jans-pycloudlib",
+ "jans-cli-tui",
+ "jans-linux-setup"
+ ]
steps:
- name: Harden Runner
uses: step-security/harden-runner@a4aa98b93cab29d9b1101a6143fb8bce00e2eac4 # v2.7.1
diff --git a/.github/workflows/ops-docs.yml b/.github/workflows/ops-docs.yml
index 07c61013b3f..34311ad3e04 100644
--- a/.github/workflows/ops-docs.yml
+++ b/.github/workflows/ops-docs.yml
@@ -71,10 +71,10 @@ jobs:
with:
fetch-depth: 0
- - name: Set up Python 3.7
+ - name: Set up Python 3.10
uses: actions/setup-python@0a5c61591373683505ea898e09a3ea4f39ef2b9c # v5.0.0
with:
- python-version: 3.7
+ python-version: "3.10"
- name: Auto-merge inhouse doc prs
run: |
diff --git a/.github/workflows/ops-label-pr-issues.yml b/.github/workflows/ops-label-pr-issues.yml
index 73528021229..bf0b1cd5f83 100644
--- a/.github/workflows/ops-label-pr-issues.yml
+++ b/.github/workflows/ops-label-pr-issues.yml
@@ -31,17 +31,17 @@ jobs:
- name: check out code
uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
- - name: Setup Python 3.7
+ - name: Set up Python 3.10
uses: actions/setup-python@0a5c61591373683505ea898e09a3ea4f39ef2b9c # v5.0.0
with:
- python-version: 3.7
+ python-version: "3.10"
- name: Install dependencies
run: |
sudo apt-get update
- sudo python3 -m pip install --upgrade pip
- sudo pip3 install setuptools --upgrade
- sudo pip3 install -r ./automation/requirements.txt
+ sudo python3 -m pip install --upgrade pip || echo "Failed to upgrade pip"
+ sudo pip3 install --ignore-installed setuptools --upgrade
+ sudo pip3 install --ignore-installed -r ./automation/requirements.txt
sudo apt-get update
sudo apt-get install jq
curl -fsSL https://cli.github.com/packages/githubcli-archive-keyring.gpg | sudo dd of=/usr/share/keyrings/githubcli-archive-keyring.gpg
diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index ca0b9fcd917..d7df2a159cb 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -10,12 +10,17 @@ jobs:
strategy:
fail-fast: false
steps:
+ - name: Harden Runner
+ uses: step-security/harden-runner@0080882f6c36860b6ba35c610c98ce87d4e2f26f # v2.10.2
+ with:
+ egress-policy: audit
+
- name: Checkout
uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
with:
fetch-depth: 0
- - uses: googleapis/release-please-action@v4
+ - uses: googleapis/release-please-action@7987652d64b4581673a76e33ad5e98e3dd56832f # v4.1.3
id: release-please
with:
release-type: simple
diff --git a/.github/workflows/sanitary-github-cache.yml b/.github/workflows/sanitary-github-cache.yml
index b2bfb70f57d..e1dd3fa9676 100644
--- a/.github/workflows/sanitary-github-cache.yml
+++ b/.github/workflows/sanitary-github-cache.yml
@@ -4,7 +4,8 @@ on:
types:
- closed
workflow_dispatch:
-
+permissions:
+ contents: read
jobs:
cleanup:
runs-on: ubuntu-latest
diff --git a/.github/workflows/sanitary-workflow-runs.yml b/.github/workflows/sanitary-workflow-runs.yml
index fd3137becc7..c8115cc62a8 100644
--- a/.github/workflows/sanitary-workflow-runs.yml
+++ b/.github/workflows/sanitary-workflow-runs.yml
@@ -3,6 +3,8 @@ on:
schedule:
- cron: '0 0 */2 * *'
workflow_dispatch:
+permissions:
+ contents: read
jobs:
del_runs:
runs-on: ubuntu-latest
diff --git a/.github/workflows/scan-sonar.yml b/.github/workflows/scan-sonar.yml
index 66284080304..69cac4cfc36 100644
--- a/.github/workflows/scan-sonar.yml
+++ b/.github/workflows/scan-sonar.yml
@@ -55,7 +55,8 @@ on:
- '!**.txt'
workflow_dispatch:
-
+permissions:
+ contents: read
jobs:
sonar-scan:
name: sonar scan
@@ -82,7 +83,9 @@ jobs:
jans-linux-setup
jans-cli-tui
jans-pycloudlib
-
+ permissions:
+ contents: read
+ pull-requests: read
steps:
- name: Harden Runner
uses: step-security/harden-runner@a4aa98b93cab29d9b1101a6143fb8bce00e2eac4 # v2.7.1
diff --git a/.github/workflows/test-cedarling.yml b/.github/workflows/test-cedarling.yml
index 6647eba00c0..0d01fa97dee 100644
--- a/.github/workflows/test-cedarling.yml
+++ b/.github/workflows/test-cedarling.yml
@@ -19,15 +19,39 @@ jobs:
egress-policy: audit
- uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
- name: Install Rust
- uses: dtolnay/rust-toolchain@stable
+ uses: dtolnay/rust-toolchain@1ff72ee08e3cb84d84adba594e0a297990fc1ed3 # stable
- name: Run Tests
+ working-directory: jans-cedarling
run: |
- cd ./jans-cedarling
cargo test --workspace
- - name: Run Clippy
+ - name: Run Clippy on native target
+ working-directory: jans-cedarling
run: |
- cd ./jans-cedarling
cargo clippy -- -Dwarnings
+ wasm_tests:
+ runs-on: ubuntu-latest
+ steps:
+ - name: Harden Runner
+ uses: step-security/harden-runner@a4aa98b93cab29d9b1101a6143fb8bce00e2eac4 # v2.7.1
+ with:
+ egress-policy: audit
+ - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
+ - name: Install Rust
+ uses: dtolnay/rust-toolchain@1ff72ee08e3cb84d84adba594e0a297990fc1ed3 # stable
+ - name: Install WASM dependencies
+ run: curl https://rustwasm.github.io/wasm-pack/installer/init.sh -sSf | sh
+ - name: Run WASM tests using chrome
+ working-directory: jans-cedarling/bindings/cedarling_wasm
+ run: |
+ wasm-pack test --headless --chrome
+ - name: Run WASM tests using firefox
+ working-directory: jans-cedarling/bindings/cedarling_wasm
+ run: |
+ wasm-pack test --headless --firefox
+ - name: Run Clippy on WASM target
+ working-directory: jans-cedarling
+ run: |
+ cargo clippy --target wasm32-unknown-unknown -- -Dwarnings
python_tests:
runs-on: ubuntu-latest
strategy:
@@ -45,9 +69,9 @@ jobs:
python-version: ${{ matrix.python-version }}
- name: Install dependencies
run: |
- python3 -m pip install --upgrade pip
+ python3 -m pip install --upgrade pip || echo "Failed to upgrade pip"
python3 -m pip install tox
- name: Test with pytest
+ working-directory: jans-cedarling/bindings/cedarling_python
run: |
- cd ./jans-cedarling/bindings/cedarling_python
tox
diff --git a/.github/workflows/test-jans-pycloudlib.yml b/.github/workflows/test-jans-pycloudlib.yml
index 3603b64f320..b673adb249f 100644
--- a/.github/workflows/test-jans-pycloudlib.yml
+++ b/.github/workflows/test-jans-pycloudlib.yml
@@ -41,7 +41,7 @@ jobs:
python-version: ${{ matrix.python-version }}
- name: Install dependencies
run: |
- python3 -m pip install --upgrade pip
+ python3 -m pip install --upgrade pip || echo "Failed to upgrade pip"
python3 -m pip install tox
- name: Test with pytest
run: |
diff --git a/README.md b/README.md
index 44b01972fad..f44da2bbc3b 100644
--- a/README.md
+++ b/README.md
@@ -34,9 +34,10 @@ commercial distribution of Janssen Project Components called
**Social**: [Linkedin](https://www.linkedin.com/company/janssen-project)
[](https://artifacthub.io/packages/search?repo=janssen-auth-server)
-[](https://bestpractices.coreinfrastructure.org/projects/4353)
+[](https://scorecard.dev/viewer/?uri=github.com/JanssenProject/jans)
+[](https://www.bestpractices.dev/projects/4353)
[](./LICENSE)
-[](#users-and-community)
+[](#community)
[](https://conventionalcommits.org)
----
@@ -45,26 +46,27 @@ commercial distribution of Janssen Project Components called
| Component | Description | Lifecycle Stage |
|:---------------------------------------------|:--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|:-----------------------------------------------------------------|
-| **[Jans Auth Server](jans-auth-server)** | A very complete Java OAuth Authorization Server and a [certified](https://openid.net/certification/) OpenID Connect Provider. It's the upstream open-source core of [Gluu Flex](https://gluu.org/flex). |  |
+| **[Jans Auth Server](jans-auth-server)** | A complete OAuth Authorization Server and a [certified](https://openid.net/certification/) OpenID Connect Provider written in Java. It's the upstream open-source core of [Gluu Flex](https://gluu.org/flex). |  |
| **[Agama](agama)** | Agama offers an interoperable way to design authentication flows, coded in a DSL purpose-built for writing identity journeys. |  |
| **[Jans FIDO](jans-fido2)** | Enables end-users to enroll and authenticate with passkeys and other FIDO authenticators. |  |
| **[Jans SCIM](jans-scim)** | [SCIM](http://www.simplecloud.info/) JSON/REST [API](https://docs.jans.io/head/admin/reference/openapi/) for user management, including associated FIDO devices. |  |
-| **[Jans Config API](jans-config-api)** | RESTful control plane for all Janssen components. |  |
-| **[Text UI ("TUI")](jans-cli-tui)** | Command line and interactive configuration tools to help you correctly call the Config API. |  |
+| **[Jans Config API](jans-config-api)** | RESTful APIs manage configuration for all Janssen components. |  |
+| **[Text UI ("TUI")](jans-cli-tui)** | User interface accessible from command line. TUI is text-based interactive configuration tool that leverages config-API to configure Janssen Server modules |  |
+| **[Jans CLI](jans-cli-tui)** | Command line configuration tools to help you correctly call the Config API. |  |
| **[Jans Casa](jans-casa)** | Jans Casa is a self-service web portal for end-users to manage authentication and authorization preferences for their account in the Janssen Server |  |
| **[Jans KC](jans-keycloak-integration)** | provides an array of out of the box IAM services in a single lightweight container image. It's handy for many workforce requirements like SAML. The Janssen authenticator module (SPI) simplifies SSO across Janssen and Keycloak websites. |  |
| **[Jans LDAP Link](jans-link)** | a group of components that provide synchronization services to update the Janssen User Store from an external authoritative LDAP data sources |  |
| **[Jans Keycloak Link](jans-keycloak-link)** | a group of components that provide synchronization services to update the Janssen User Store from an external authoritative Keycloak data sources |  |
-| **[Jans Cedarling](jans-cedaring)** | Cedarling binding for Python and WASM. In simple terms, the Cedarling returns the answer: should the application allow this action on this resource given these JWT tokens.. |  |
+| **[Jans Cedarling](jans-cedarling)** | Cedarling is an embeddable stateful Policy Decision Point for authorization requests. In simple terms, the Cedarling returns the answer: should the application allow this action on this resource given these JWT tokens. It is written in Rust with bindings to WASM, iOS, Android, and Python. |  |
| **[Jans Lock](jans-lock)** | An enterprise authorization solution featuring the Cedarling, a stateless PDP and the Lock Server which centralizes audit logs and configuration. |  |
| **[Jans Tarp](demos/jans-tarp)** | An OpenID Connect RP test website that runs as a browser plugin in Chrome or Firefox. |  |
| **[Jans Chip](demos/jans-chip)** | Sample iOS and Android mobile applications that implement the full OAuth and FIDO security stack for app integrity, client constrained access tokens, and user presence. |  |
-| **[Jans Tent](demos/jans-tent)** | A test Relying Party ("RP") built using Python and Flask. Enables you to send different requests by quickly modifying just one configuration file. |  |
## Installation
You can install the Janssen federation stack in a Kubernetes cluster or as a
-single VM. Check out the [Janssen Documentation](https://docs.jans.io/head/admin/install/)
+single VM. Check out the
+[Janssen Documentation](https://docs.jans.io/head/janssen-server/install/)
for details.
## Community
diff --git a/agama/misc/json_template.ftlh b/agama/misc/json_template.ftl
similarity index 100%
rename from agama/misc/json_template.ftlh
rename to agama/misc/json_template.ftl
diff --git a/charts/janssen-all-in-one/README.md b/charts/janssen-all-in-one/README.md
index b02f1bcf0ef..e331b0a1b71 100644
--- a/charts/janssen-all-in-one/README.md
+++ b/charts/janssen-all-in-one/README.md
@@ -134,6 +134,8 @@ Kubernetes: `>=v1.22.0-0`
| cnConfiguratorCustomSchema | object | `{"secretName":""}` | Use custom configuration schema in existing secrets. Note, the secrets has to contain the key configuration.json or any basename as specified in cnConfiguratorConfigurationFile. |
| cnConfiguratorCustomSchema.secretName | string | `""` | The name of the secrets used for storing custom configuration schema. |
| cnConfiguratorDumpFile | string | `"/etc/jans/conf/configuration.out.json"` | Path to dumped configuration schema file |
+| cnConfiguratorKey | string | `""` | Key to encrypt/decrypt configuration schema file using AES-256 CBC mode. Set the value to empty string to disable encryption/decryption, or 32 alphanumeric characters to enable it. |
+| cnConfiguratorKeyFile | string | `"/etc/jans/conf/configuration.key"` | Path to file contains key to encrypt/decrypt configuration schema file. |
| cnDocumentStoreType | string | `"DB"` | Document store type to use for shibboleth files DB. |
| cnGoogleApplicationCredentials | string | `"/etc/jans/conf/google-credentials.json"` | Base64 encoded service account. The sa must have roles/secretmanager.admin to use Google secrets. Leave as this is a sensible default. |
| cnPersistenceType | string | `"sql"` | Persistence backend to run Janssen with hybrid|sql. |
diff --git a/charts/janssen-all-in-one/templates/_helpers.tpl b/charts/janssen-all-in-one/templates/_helpers.tpl
index d30466ae7f9..135d37cbb03 100644
--- a/charts/janssen-all-in-one/templates/_helpers.tpl
+++ b/charts/janssen-all-in-one/templates/_helpers.tpl
@@ -73,10 +73,10 @@ Create optional scopes list
{{- define "janssen-all-in-one.optionalScopes"}}
{{ $newList := list }}
{{- if eq .Values.configmap.cnCacheType "REDIS" }}
-{{ $newList = append $newList ("redis" | quote ) }}
+{{ $newList = append $newList "redis" }}
{{- end}}
{{ if eq .Values.cnPersistenceType "sql" }}
-{{ $newList = append $newList ("sql" | quote) }}
+{{ $newList = append $newList "sql" }}
{{- end }}
{{ toJson $newList }}
{{- end }}
@@ -178,12 +178,78 @@ Create configuration schema-related objects.
{{- define "janssen-all-in-one.config.schema" -}}
{{- $commonName := (printf "%s-configuration-file" .Release.Name) -}}
{{- $secretName := .Values.cnConfiguratorCustomSchema.secretName | default $commonName -}}
+{{- $keyName := (printf "%s-configuration-key-file" .Release.Name) -}}
volumes:
- name: {{ $commonName }}
secret:
secretName: {{ $secretName }}
+{{- if .Values.cnConfiguratorKey }}
+ - name: {{ $keyName }}
+ secret:
+ secretName: {{ $keyName }}
+{{- end }}
volumeMounts:
- name: {{ $commonName }}
mountPath: {{ .Values.cnConfiguratorConfigurationFile }}
subPath: {{ .Values.cnConfiguratorConfigurationFile | base }}
-{{- end -}}
+{{- if .Values.cnConfiguratorKey }}
+ - name: {{ $keyName }}
+ mountPath: {{ .Values.cnConfiguratorKeyFile }}
+ subPath: {{ .Values.cnConfiguratorKeyFile | base }}
+{{- end }}
+{{- end }}
+
+{{/*
+Obfuscate configuration schema (only if configuration key is available)
+*/}}
+{{- define "janssen-all-in-one.config.prepareSchema" }}
+
+{{- $configmapSchema := dict }}
+{{- $_ := set $configmapSchema "hostname" .Values.fqdn }}
+{{- $_ := set $configmapSchema "country_code" .Values.countryCode }}
+{{- $_ := set $configmapSchema "state" .Values.state }}
+{{- $_ := set $configmapSchema "city" .Values.city }}
+{{- $_ := set $configmapSchema "admin_email" .Values.email }}
+{{- $_ := set $configmapSchema "orgName" .Values.orgName }}
+{{- $_ := set $configmapSchema "auth_sig_keys" (index .Values "auth-server" "authSigKeys") }}
+{{- $_ := set $configmapSchema "auth_enc_keys" (index .Values "auth-server" "authEncKeys") }}
+{{- $_ := set $configmapSchema "optional_scopes" (include "janssen-all-in-one.optionalScopes" . | trim) }}
+{{- if .Values.saml.enabled }}
+{{- $_ := set $configmapSchema "kc_admin_username" .Values.configmap.kcAdminUsername }}
+{{- end }}
+{{- $_ := set $configmapSchema "init_keys_exp" (index .Values "auth-server-key-rotation" "initKeysLife") }}
+
+{{- $secretSchema := dict }}
+{{- $_ := set $secretSchema "admin_password" .Values.adminPassword }}
+{{- $_ := set $secretSchema "redis_password" .Values.redisPassword }}
+{{- if or ( eq .Values.cnPersistenceType "sql" ) ( eq .Values.cnPersistenceType "hybrid" ) }}
+{{- $_ := set $secretSchema "sql_password" .Values.configmap.cnSqldbUserPassword }}
+{{- end }}
+{{- if eq .Values.configSecretAdapter "vault" }}
+{{- $_ := set $secretSchema "vault_role_id" .Values.configmap.cnVaultRoleId }}
+{{- $_ := set $secretSchema "vault_secret_id" .Values.configmap.cnVaultSecretId }}
+{{- end }}
+{{- if or (eq .Values.configSecretAdapter "google") (eq .Values.configAdapterName "google") }}
+{{- $_ := set $secretSchema "google_credentials" .Values.configmap.cnGoogleSecretManagerServiceAccount }}
+{{- end }}
+{{- if or (eq .Values.configAdapterName "aws") (eq .Values.configSecretAdapter "aws") }}
+{{- $_ := set $secretSchema "aws_credentials" (include "config.aws-shared-credentials" . | b64enc) }}
+{{- $_ := set $secretSchema "aws_config" (include "config.aws-config" . | b64enc) }}
+{{- $_ := set $secretSchema "aws_replica_regions" (toJson .Values.configmap.cnAwsSecretsReplicaRegions | b64enc) }}
+{{- end }}
+{{- if .Values.saml.enabled }}
+{{- $_ := set $secretSchema "kc_db_password" .Values.configmap.kcDbPassword }}
+{{- $_ := set $secretSchema "kc_admin_password" .Values.configmap.kcAdminPassword }}
+{{- end }}
+{{- $_ := set $secretSchema "encoded_salt" .Values.salt }}
+
+{{- $schema := dict "_configmap" $configmapSchema "_secret" $secretSchema }}
+
+{{- if .Values.cnConfiguratorKey }}
+{{- printf "%s" (encryptAES .Values.cnConfiguratorKey (toPrettyJson $schema)) }}
+{{- else -}}
+{{- toPrettyJson $schema }}
+{{- end }}
+
+{{/* end of helpers */}}
+{{- end }}
diff --git a/charts/janssen-all-in-one/templates/secret.yaml b/charts/janssen-all-in-one/templates/secret.yaml
index 9964d04a533..bcc2b62f50f 100644
--- a/charts/janssen-all-in-one/templates/secret.yaml
+++ b/charts/janssen-all-in-one/templates/secret.yaml
@@ -22,45 +22,33 @@ metadata:
type: Opaque
stringData:
{{ .Values.cnConfiguratorConfigurationFile | base }}: |-
- {
- "_configmap": {
- "hostname": {{ .Values.fqdn | quote }},
- "country_code": {{ .Values.countryCode | quote }},
- "state": {{ .Values.state | quote }},
- "city": {{ .Values.city | quote }},
- "admin_email": {{ .Values.email | quote }},
- "orgName": {{ .Values.orgName | quote }},
- "auth_sig_keys": {{ index .Values "auth-server" "authSigKeys" | quote }},
- "auth_enc_keys": {{ index .Values "auth-server" "authEncKeys" | quote }},
- "optional_scopes": {{ list (include "janssen-all-in-one.optionalScopes" . | fromJsonArray | join ",") | quote }},
- {{- if .Values.saml.enabled }}
- "kc_admin_username": {{ .Values.configmap.kcAdminUsername | quote }},
- {{- end }}
- "init_keys_exp": {{ index .Values "auth-server-key-rotation" "initKeysLife" }}
- },
- "_secret": {
- "admin_password": {{ .Values.adminPassword | quote }},
- "redis_password": {{ .Values.redisPassword | quote }},
- {{ if or ( eq .Values.cnPersistenceType "sql" ) ( eq .Values.cnPersistenceType "hybrid" ) }}
- "sql_password": {{ .Values.configmap.cnSqldbUserPassword | quote }},
- {{- end }}
- {{ if eq .Values.configSecretAdapter "vault" }}
- "vault_role_id": {{ .Values.configmap.cnVaultRoleId | quote }},
- "vault_secret_id": {{ .Values.configmap.cnVaultSecretId | quote }},
- {{- end }}
- {{ if or (eq .Values.configSecretAdapter "google") (eq .Values.configAdapterName "google") }}
- "google_credentials": {{ .Values.configmap.cnGoogleSecretManagerServiceAccount | quote }},
- {{- end }}
- {{ if or (eq .Values.configAdapterName "aws") (eq .Values.configSecretAdapter "aws") }}
- "aws_credentials": {{ include "janssen-all-in-one.aws-shared-credentials" . | b64enc | quote }},
- "aws_config": {{ include "janssen-all-in-one.aws-config" . | b64enc | quote }},
- "aws_replica_regions": {{ .Values.configmap.cnAwsSecretsReplicaRegions | toJson | b64enc | quote }},
- {{- end }}
- {{- if .Values.saml.enabled }}
- "kc_db_password": {{ .Values.configmap.kcDbPassword | quote }},
- "kc_admin_password": {{ .Values.configmap.kcAdminPassword | quote }},
- {{- end }}
- "encoded_salt": {{ .Values.salt | quote }}
- }
- }
+{{ include "janssen-all-in-one.config.prepareSchema" . | indent 4 }}
+{{- end }}
+
+---
+
+{{- if .Values.cnConfiguratorKey -}}
+apiVersion: v1
+kind: Secret
+metadata:
+ name: {{ .Release.Name }}-configuration-key-file
+ namespace: {{ .Release.Namespace }}
+ labels:
+ app: {{ .Release.Name }}-{{ include "janssen-all-in-one.name" . }}-aio
+{{ include "janssen-all-in-one.labels" . | indent 4 }}
+{{- if .Values.additionalLabels }}
+{{ toYaml .Values.additionalLabels | indent 4 }}
+{{- end }}
+{{- if or (.Values.additionalAnnotations) (.Values.customAnnotations.secret) }}
+ annotations:
+{{- if .Values.additionalAnnotations }}
+{{ toYaml .Values.additionalAnnotations | indent 4 }}
+{{- end }}
+{{- if .Values.customAnnotations.secret }}
+{{ toYaml .Values.customAnnotations.secret | indent 4 }}
+{{- end }}
+{{- end }}
+type: Opaque
+data:
+ {{ .Values.cnConfiguratorKeyFile | base }}: {{ .Values.cnConfiguratorKey | b64enc }}
{{- end }}
diff --git a/charts/janssen-all-in-one/values.yaml b/charts/janssen-all-in-one/values.yaml
index f446a4c50f4..616bd10f675 100644
--- a/charts/janssen-all-in-one/values.yaml
+++ b/charts/janssen-all-in-one/values.yaml
@@ -573,6 +573,10 @@ cnConfiguratorDumpFile: /etc/jans/conf/configuration.out.json
cnConfiguratorCustomSchema:
# -- The name of the secrets used for storing custom configuration schema.
secretName: ""
+# -- Key to encrypt/decrypt configuration schema file using AES-256 CBC mode. Set the value to empty string to disable encryption/decryption, or 32 alphanumeric characters to enable it.
+cnConfiguratorKey: ""
+# -- Path to file contains key to encrypt/decrypt configuration schema file.
+cnConfiguratorKeyFile: /etc/jans/conf/configuration.key
# ingress properties
istio:
diff --git a/charts/janssen/README.md b/charts/janssen/README.md
index 56dace93960..4f015ece23e 100644
--- a/charts/janssen/README.md
+++ b/charts/janssen/README.md
@@ -265,7 +265,7 @@ Kubernetes: `>=v1.22.0-0`
| fido2.usrEnvs.secret | object | `{}` | Add custom secret envs to the service variable1: value1 |
| fido2.volumeMounts | list | `[]` | Configure any additional volumesMounts that need to be attached to the containers |
| fido2.volumes | list | `[]` | Configure any additional volumes that need to be attached to the pod |
-| global | object | `{"alb":{"ingress":false},"auth-server":{"appLoggers":{"auditStatsLogLevel":"INFO","auditStatsLogTarget":"FILE","authLogLevel":"INFO","authLogTarget":"STDOUT","enableStdoutLogPrefix":"true","httpLogLevel":"INFO","httpLogTarget":"FILE","persistenceDurationLogLevel":"INFO","persistenceDurationLogTarget":"FILE","persistenceLogLevel":"INFO","persistenceLogTarget":"FILE","scriptLogLevel":"INFO","scriptLogTarget":"FILE"},"authEncKeys":"RSA1_5 RSA-OAEP","authServerServiceName":"auth-server","authSigKeys":"RS256 RS384 RS512 ES256 ES384 ES512 PS256 PS384 PS512","cnCustomJavaOptions":"","customAnnotations":{"deployment":{},"destinationRule":{},"horizontalPodAutoscaler":{},"pod":{},"podDisruptionBudget":{},"secret":{},"service":{},"virtualService":{}},"enabled":true,"ingress":{"authServerAdditionalAnnotations":{},"authServerEnabled":true,"authServerLabels":{},"authzenAdditionalAnnotations":{},"authzenConfigEnabled":true,"authzenConfigLabels":{},"deviceCodeAdditionalAnnotations":{},"deviceCodeEnabled":true,"deviceCodeLabels":{},"firebaseMessagingAdditionalAnnotations":{},"firebaseMessagingEnabled":true,"firebaseMessagingLabels":{},"lockAdditionalAnnotations":{},"lockConfigAdditionalAnnotations":{},"lockConfigEnabled":false,"lockConfigLabels":{},"lockEnabled":false,"lockLabels":{},"openidAdditionalAnnotations":{},"openidConfigEnabled":true,"openidConfigLabels":{},"u2fAdditionalAnnotations":{},"u2fConfigEnabled":true,"u2fConfigLabels":{},"uma2AdditionalAnnotations":{},"uma2ConfigEnabled":true,"uma2ConfigLabels":{},"webdiscoveryAdditionalAnnotations":{},"webdiscoveryEnabled":true,"webdiscoveryLabels":{},"webfingerAdditionalAnnotations":{},"webfingerEnabled":true,"webfingerLabels":{}},"lockEnabled":false},"auth-server-key-rotation":{"customAnnotations":{"cronjob":{},"secret":{},"service":{}},"enabled":true,"initKeysLife":48},"awsStorageType":"io1","azureStorageAccountType":"Standard_LRS","azureStorageKind":"Managed","casa":{"appLoggers":{"casaLogLevel":"INFO","casaLogTarget":"STDOUT","enableStdoutLogPrefix":"true","timerLogLevel":"INFO","timerLogTarget":"FILE"},"casaServiceName":"casa","cnCustomJavaOptions":"","customAnnotations":{"deployment":{},"destinationRule":{},"horizontalPodAutoscaler":{},"pod":{},"podDisruptionBudget":{},"secret":{},"service":{},"virtualService":{}},"enabled":true,"ingress":{"casaAdditionalAnnotations":{},"casaEnabled":false,"casaLabels":{}}},"cloud":{"testEnviroment":false},"cnAwsConfigFile":"/etc/jans/conf/aws_config_file","cnAwsSecretsReplicaRegionsFile":"/etc/jans/conf/aws_secrets_replica_regions","cnAwsSharedCredentialsFile":"/etc/jans/conf/aws_shared_credential_file","cnConfiguratorConfigurationFile":"/etc/jans/conf/configuration.json","cnConfiguratorCustomSchema":{"secretName":""},"cnConfiguratorDumpFile":"/etc/jans/conf/configuration.out.json","cnDocumentStoreType":"DB","cnGoogleApplicationCredentials":"/etc/jans/conf/google-credentials.json","cnPersistenceType":"sql","cnPrometheusPort":"","cnSqlPasswordFile":"/etc/jans/conf/sql_password","config":{"customAnnotations":{"clusterRoleBinding":{},"configMap":{},"job":{},"role":{},"roleBinding":{},"secret":{},"service":{},"serviceAccount":{}},"enabled":true},"config-api":{"appLoggers":{"configApiLogLevel":"INFO","configApiLogTarget":"STDOUT","enableStdoutLogPrefix":"true","persistenceDurationLogLevel":"INFO","persistenceDurationLogTarget":"FILE","persistenceLogLevel":"INFO","persistenceLogTarget":"FILE","scriptLogLevel":"INFO","scriptLogTarget":"FILE"},"cnCustomJavaOptions":"","configApiServerServiceName":"config-api","customAnnotations":{"deployment":{},"destinationRule":{},"horizontalPodAutoscaler":{},"pod":{},"podDisruptionBudget":{},"service":{},"virtualService":{}},"enabled":true,"ingress":{"configApiAdditionalAnnotations":{},"configApiEnabled":true,"configApiLabels":{}},"plugins":"fido2,scim,user-mgt"},"configAdapterName":"kubernetes","configSecretAdapter":"kubernetes","fido2":{"appLoggers":{"enableStdoutLogPrefix":"true","fido2LogLevel":"INFO","fido2LogTarget":"STDOUT","persistenceDurationLogLevel":"INFO","persistenceDurationLogTarget":"FILE","persistenceLogLevel":"INFO","persistenceLogTarget":"FILE","scriptLogLevel":"INFO","scriptLogTarget":"FILE"},"cnCustomJavaOptions":"","customAnnotations":{"deployment":{},"destinationRule":{},"horizontalPodAutoscaler":{},"pod":{},"podDisruptionBudget":{},"secret":{},"service":{},"virtualService":{}},"enabled":true,"fido2ServiceName":"fido2","ingress":{"fido2AdditionalAnnotations":{},"fido2ConfigAdditionalAnnotations":{},"fido2ConfigEnabled":false,"fido2ConfigLabels":{},"fido2Enabled":false,"fido2Labels":{},"fido2WebauthnAdditionalAnnotations":{},"fido2WebauthnEnabled":false,"fido2WebauthnLabels":{}}},"fqdn":"demoexample.jans.io","gcePdStorageType":"pd-standard","isFqdnRegistered":false,"istio":{"additionalAnnotations":{},"additionalLabels":{},"enabled":false,"gateways":[],"ingress":false,"namespace":"istio-system"},"jobTtlSecondsAfterFinished":300,"kc-scheduler":{"enabled":false},"lbIp":"22.22.22.22","link":{"appLoggers":{"enableStdoutLogPrefix":"true","linkLogLevel":"INFO","linkLogTarget":"STDOUT","persistenceDurationLogLevel":"INFO","persistenceDurationLogTarget":"FILE","persistenceLogLevel":"INFO","persistenceLogTarget":"FILE","scriptLogLevel":"INFO","scriptLogTarget":"FILE"},"cnCustomJavaOptions":"","customAnnotations":{"deployment":{},"destinationRule":{},"horizontalPodAutoscaler":{},"pod":{},"podDisruptionBudget":{},"service":{},"virtualService":{}},"enabled":false,"ingress":{"linkAdditionalAnnotations":{},"linkEnabled":true,"linkLabels":{}},"linkServiceName":"link"},"nginx-ingress":{"enabled":true},"persistence":{"customAnnotations":{"job":{},"secret":{},"service":{}},"enabled":true},"saml":{"cnCustomJavaOptions":"","customAnnotations":{"deployment":{},"destinationRule":{},"horizontalPodAutoscaler":{},"pod":{},"podDisruptionBudget":{},"secret":{},"service":{},"virtualService":{}},"enabled":false,"ingress":{"samlAdditionalAnnotations":{},"samlEnabled":false,"samlLabels":{}},"samlServiceName":"saml"},"scim":{"appLoggers":{"enableStdoutLogPrefix":"true","persistenceDurationLogLevel":"INFO","persistenceDurationLogTarget":"FILE","persistenceLogLevel":"INFO","persistenceLogTarget":"FILE","scimLogLevel":"INFO","scimLogTarget":"STDOUT","scriptLogLevel":"INFO","scriptLogTarget":"FILE"},"cnCustomJavaOptions":"","customAnnotations":{"deployment":{},"destinationRule":{},"horizontalPodAutoscaler":{},"pod":{},"podDisruptionBudget":{},"secret":{},"service":{},"virtualService":{}},"enabled":true,"ingress":{"scimAdditionalAnnotations":{},"scimConfigAdditionalAnnotations":{},"scimConfigEnabled":false,"scimConfigLabels":{},"scimEnabled":false,"scimLabels":{}},"scimServiceName":"scim"},"serviceAccountName":"default","storageClass":{"allowVolumeExpansion":true,"allowedTopologies":[],"mountOptions":["debug"],"parameters":{},"provisioner":"microk8s.io/hostpath","reclaimPolicy":"Retain","volumeBindingMode":"WaitForFirstConsumer"},"usrEnvs":{"normal":{},"secret":{}}}` | Parameters used globally across all services helm charts. |
+| global | object | `{"alb":{"ingress":false},"auth-server":{"appLoggers":{"auditStatsLogLevel":"INFO","auditStatsLogTarget":"FILE","authLogLevel":"INFO","authLogTarget":"STDOUT","enableStdoutLogPrefix":"true","httpLogLevel":"INFO","httpLogTarget":"FILE","persistenceDurationLogLevel":"INFO","persistenceDurationLogTarget":"FILE","persistenceLogLevel":"INFO","persistenceLogTarget":"FILE","scriptLogLevel":"INFO","scriptLogTarget":"FILE"},"authEncKeys":"RSA1_5 RSA-OAEP","authServerServiceName":"auth-server","authSigKeys":"RS256 RS384 RS512 ES256 ES384 ES512 PS256 PS384 PS512","cnCustomJavaOptions":"","customAnnotations":{"deployment":{},"destinationRule":{},"horizontalPodAutoscaler":{},"pod":{},"podDisruptionBudget":{},"secret":{},"service":{},"virtualService":{}},"enabled":true,"ingress":{"authServerAdditionalAnnotations":{},"authServerEnabled":true,"authServerLabels":{},"authzenAdditionalAnnotations":{},"authzenConfigEnabled":true,"authzenConfigLabels":{},"deviceCodeAdditionalAnnotations":{},"deviceCodeEnabled":true,"deviceCodeLabels":{},"firebaseMessagingAdditionalAnnotations":{},"firebaseMessagingEnabled":true,"firebaseMessagingLabels":{},"lockAdditionalAnnotations":{},"lockConfigAdditionalAnnotations":{},"lockConfigEnabled":false,"lockConfigLabels":{},"lockEnabled":false,"lockLabels":{},"openidAdditionalAnnotations":{},"openidConfigEnabled":true,"openidConfigLabels":{},"u2fAdditionalAnnotations":{},"u2fConfigEnabled":true,"u2fConfigLabels":{},"uma2AdditionalAnnotations":{},"uma2ConfigEnabled":true,"uma2ConfigLabels":{},"webdiscoveryAdditionalAnnotations":{},"webdiscoveryEnabled":true,"webdiscoveryLabels":{},"webfingerAdditionalAnnotations":{},"webfingerEnabled":true,"webfingerLabels":{}},"lockEnabled":false},"auth-server-key-rotation":{"customAnnotations":{"cronjob":{},"secret":{},"service":{}},"enabled":true,"initKeysLife":48},"awsStorageType":"io1","azureStorageAccountType":"Standard_LRS","azureStorageKind":"Managed","casa":{"appLoggers":{"casaLogLevel":"INFO","casaLogTarget":"STDOUT","enableStdoutLogPrefix":"true","timerLogLevel":"INFO","timerLogTarget":"FILE"},"casaServiceName":"casa","cnCustomJavaOptions":"","customAnnotations":{"deployment":{},"destinationRule":{},"horizontalPodAutoscaler":{},"pod":{},"podDisruptionBudget":{},"secret":{},"service":{},"virtualService":{}},"enabled":true,"ingress":{"casaAdditionalAnnotations":{},"casaEnabled":false,"casaLabels":{}}},"cloud":{"testEnviroment":false},"cnAwsConfigFile":"/etc/jans/conf/aws_config_file","cnAwsSecretsReplicaRegionsFile":"/etc/jans/conf/aws_secrets_replica_regions","cnAwsSharedCredentialsFile":"/etc/jans/conf/aws_shared_credential_file","cnConfiguratorConfigurationFile":"/etc/jans/conf/configuration.json","cnConfiguratorCustomSchema":{"secretName":""},"cnConfiguratorDumpFile":"/etc/jans/conf/configuration.out.json","cnConfiguratorKey":"","cnConfiguratorKeyFile":"/etc/jans/conf/configuration.key","cnDocumentStoreType":"DB","cnGoogleApplicationCredentials":"/etc/jans/conf/google-credentials.json","cnPersistenceType":"sql","cnPrometheusPort":"","cnSqlPasswordFile":"/etc/jans/conf/sql_password","config":{"customAnnotations":{"clusterRoleBinding":{},"configMap":{},"job":{},"role":{},"roleBinding":{},"secret":{},"service":{},"serviceAccount":{}},"enabled":true},"config-api":{"appLoggers":{"configApiLogLevel":"INFO","configApiLogTarget":"STDOUT","enableStdoutLogPrefix":"true","persistenceDurationLogLevel":"INFO","persistenceDurationLogTarget":"FILE","persistenceLogLevel":"INFO","persistenceLogTarget":"FILE","scriptLogLevel":"INFO","scriptLogTarget":"FILE"},"cnCustomJavaOptions":"","configApiServerServiceName":"config-api","customAnnotations":{"deployment":{},"destinationRule":{},"horizontalPodAutoscaler":{},"pod":{},"podDisruptionBudget":{},"service":{},"virtualService":{}},"enabled":true,"ingress":{"configApiAdditionalAnnotations":{},"configApiEnabled":true,"configApiLabels":{}},"plugins":"fido2,scim,user-mgt"},"configAdapterName":"kubernetes","configSecretAdapter":"kubernetes","fido2":{"appLoggers":{"enableStdoutLogPrefix":"true","fido2LogLevel":"INFO","fido2LogTarget":"STDOUT","persistenceDurationLogLevel":"INFO","persistenceDurationLogTarget":"FILE","persistenceLogLevel":"INFO","persistenceLogTarget":"FILE","scriptLogLevel":"INFO","scriptLogTarget":"FILE"},"cnCustomJavaOptions":"","customAnnotations":{"deployment":{},"destinationRule":{},"horizontalPodAutoscaler":{},"pod":{},"podDisruptionBudget":{},"secret":{},"service":{},"virtualService":{}},"enabled":true,"fido2ServiceName":"fido2","ingress":{"fido2AdditionalAnnotations":{},"fido2ConfigAdditionalAnnotations":{},"fido2ConfigEnabled":false,"fido2ConfigLabels":{},"fido2Enabled":false,"fido2Labels":{},"fido2WebauthnAdditionalAnnotations":{},"fido2WebauthnEnabled":false,"fido2WebauthnLabels":{}}},"fqdn":"demoexample.jans.io","gcePdStorageType":"pd-standard","isFqdnRegistered":false,"istio":{"additionalAnnotations":{},"additionalLabels":{},"enabled":false,"gateways":[],"ingress":false,"namespace":"istio-system"},"jobTtlSecondsAfterFinished":300,"kc-scheduler":{"enabled":false},"lbIp":"22.22.22.22","link":{"appLoggers":{"enableStdoutLogPrefix":"true","linkLogLevel":"INFO","linkLogTarget":"STDOUT","persistenceDurationLogLevel":"INFO","persistenceDurationLogTarget":"FILE","persistenceLogLevel":"INFO","persistenceLogTarget":"FILE","scriptLogLevel":"INFO","scriptLogTarget":"FILE"},"cnCustomJavaOptions":"","customAnnotations":{"deployment":{},"destinationRule":{},"horizontalPodAutoscaler":{},"pod":{},"podDisruptionBudget":{},"service":{},"virtualService":{}},"enabled":false,"ingress":{"linkAdditionalAnnotations":{},"linkEnabled":true,"linkLabels":{}},"linkServiceName":"link"},"nginx-ingress":{"enabled":true},"persistence":{"customAnnotations":{"job":{},"secret":{},"service":{}},"enabled":true},"saml":{"cnCustomJavaOptions":"","customAnnotations":{"deployment":{},"destinationRule":{},"horizontalPodAutoscaler":{},"pod":{},"podDisruptionBudget":{},"secret":{},"service":{},"virtualService":{}},"enabled":false,"ingress":{"samlAdditionalAnnotations":{},"samlEnabled":false,"samlLabels":{}},"samlServiceName":"saml"},"scim":{"appLoggers":{"enableStdoutLogPrefix":"true","persistenceDurationLogLevel":"INFO","persistenceDurationLogTarget":"FILE","persistenceLogLevel":"INFO","persistenceLogTarget":"FILE","scimLogLevel":"INFO","scimLogTarget":"STDOUT","scriptLogLevel":"INFO","scriptLogTarget":"FILE"},"cnCustomJavaOptions":"","customAnnotations":{"deployment":{},"destinationRule":{},"horizontalPodAutoscaler":{},"pod":{},"podDisruptionBudget":{},"secret":{},"service":{},"virtualService":{}},"enabled":true,"ingress":{"scimAdditionalAnnotations":{},"scimConfigAdditionalAnnotations":{},"scimConfigEnabled":false,"scimConfigLabels":{},"scimEnabled":false,"scimLabels":{}},"scimServiceName":"scim"},"serviceAccountName":"default","storageClass":{"allowVolumeExpansion":true,"allowedTopologies":[],"mountOptions":["debug"],"parameters":{},"provisioner":"microk8s.io/hostpath","reclaimPolicy":"Retain","volumeBindingMode":"WaitForFirstConsumer"},"usrEnvs":{"normal":{},"secret":{}}}` | Parameters used globally across all services helm charts. |
| global.alb.ingress | bool | `false` | Activates ALB ingress |
| global.auth-server-key-rotation.enabled | bool | `true` | Boolean flag to enable/disable the auth-server-key rotation cronjob chart. |
| global.auth-server-key-rotation.initKeysLife | int | `48` | The initial auth server key rotation keys life in hours |
@@ -344,6 +344,8 @@ Kubernetes: `>=v1.22.0-0`
| global.cnConfiguratorCustomSchema | object | `{"secretName":""}` | Use custom configuration schema in existing secrets. Note, the secrets has to contain the key configuration.json or any basename as specified in cnConfiguratorConfigurationFile. |
| global.cnConfiguratorCustomSchema.secretName | string | `""` | The name of the secrets used for storing custom configuration schema. |
| global.cnConfiguratorDumpFile | string | `"/etc/jans/conf/configuration.out.json"` | Path to dumped configuration schema file |
+| global.cnConfiguratorKey | string | `""` | Key to encrypt/decrypt configuration schema file using AES-256 CBC mode. Set the value to empty string to disable encryption/decryption, or 32 alphanumeric characters to enable it. |
+| global.cnConfiguratorKeyFile | string | `"/etc/jans/conf/configuration.key"` | Path to file contains key to encrypt/decrypt configuration schema file. |
| global.cnDocumentStoreType | string | `"DB"` | Document store type to use for shibboleth files DB. |
| global.cnGoogleApplicationCredentials | string | `"/etc/jans/conf/google-credentials.json"` | Base64 encoded service account. The sa must have roles/secretmanager.admin to use Google secrets. Leave as this is a sensible default. |
| global.cnPersistenceType | string | `"sql"` | Persistence backend to run Janssen with hybrid|sql |
diff --git a/charts/janssen/charts/config/templates/_helpers.tpl b/charts/janssen/charts/config/templates/_helpers.tpl
index c10074117bf..e03aae53613 100644
--- a/charts/janssen/charts/config/templates/_helpers.tpl
+++ b/charts/janssen/charts/config/templates/_helpers.tpl
@@ -73,10 +73,10 @@ Create optional scopes list
{{- define "config.optionalScopes"}}
{{ $newList := list }}
{{- if eq .Values.configmap.cnCacheType "REDIS" }}
-{{ $newList = append $newList ("redis" | quote ) }}
+{{ $newList = append $newList "redis" }}
{{- end}}
{{ if eq .Values.global.cnPersistenceType "sql" }}
-{{ $newList = append $newList ("sql" | quote) }}
+{{ $newList = append $newList "sql" }}
{{- end }}
{{ toJson $newList }}
{{- end }}
@@ -105,3 +105,58 @@ Create AWS config.
{{- end }}
{{- printf "[%s]\nregion = %s\n" $profile .Values.configmap.cnAwsDefaultRegion }}
{{- end }}
+
+{{/*
+Obfuscate configuration schema (only if configuration key is available)
+*/}}
+{{- define "config.prepareSchema" }}
+
+{{- $configmapSchema := dict }}
+{{- $_ := set $configmapSchema "hostname" .Values.global.fqdn }}
+{{- $_ := set $configmapSchema "country_code" .Values.countryCode }}
+{{- $_ := set $configmapSchema "state" .Values.state }}
+{{- $_ := set $configmapSchema "city" .Values.city }}
+{{- $_ := set $configmapSchema "admin_email" .Values.email }}
+{{- $_ := set $configmapSchema "orgName" .Values.orgName }}
+{{- $_ := set $configmapSchema "auth_sig_keys" (index .Values "global" "auth-server" "authSigKeys") }}
+{{- $_ := set $configmapSchema "auth_enc_keys" (index .Values "global" "auth-server" "authEncKeys") }}
+{{- $_ := set $configmapSchema "optional_scopes" (include "config.optionalScopes" . | trim) }}
+{{- if .Values.global.saml.enabled }}
+{{- $_ := set $configmapSchema "kc_admin_username" .Values.configmap.kcAdminUsername }}
+{{- end }}
+{{- $_ := set $configmapSchema "init_keys_exp" (index .Values "global" "auth-server-key-rotation" "initKeysLife") }}
+
+{{- $secretSchema := dict }}
+{{- $_ := set $secretSchema "admin_password" .Values.adminPassword }}
+{{- $_ := set $secretSchema "redis_password" .Values.redisPassword }}
+{{- if or ( eq .Values.global.cnPersistenceType "sql" ) ( eq .Values.global.cnPersistenceType "hybrid" ) }}
+{{- $_ := set $secretSchema "sql_password" .Values.configmap.cnSqldbUserPassword }}
+{{- end }}
+{{- if eq .Values.global.configSecretAdapter "vault" }}
+{{- $_ := set $secretSchema "vault_role_id" .Values.configmap.cnVaultRoleId }}
+{{- $_ := set $secretSchema "vault_secret_id" .Values.configmap.cnVaultSecretId }}
+{{- end }}
+{{- if or (eq .Values.global.configSecretAdapter "google") (eq .Values.global.configAdapterName "google") }}
+{{- $_ := set $secretSchema "google_credentials" .Values.configmap.cnGoogleSecretManagerServiceAccount }}
+{{- end }}
+{{- if or (eq .Values.global.configAdapterName "aws") (eq .Values.global.configSecretAdapter "aws") }}
+{{- $_ := set $secretSchema "aws_credentials" (include "config.aws-shared-credentials" . | b64enc) }}
+{{- $_ := set $secretSchema "aws_config" (include "config.aws-config" . | b64enc) }}
+{{- $_ := set $secretSchema "aws_replica_regions" (toJson .Values.configmap.cnAwsSecretsReplicaRegions | b64enc) }}
+{{- end }}
+{{- if .Values.global.saml.enabled }}
+{{- $_ := set $secretSchema "kc_db_password" .Values.configmap.kcDbPassword }}
+{{- $_ := set $secretSchema "kc_admin_password" .Values.configmap.kcAdminPassword }}
+{{- end }}
+{{- $_ := set $secretSchema "encoded_salt" .Values.salt }}
+
+{{- $schema := dict "_configmap" $configmapSchema "_secret" $secretSchema }}
+
+{{- if .Values.global.cnConfiguratorKey }}
+{{- printf "%s" (encryptAES .Values.global.cnConfiguratorKey (toPrettyJson $schema)) }}
+{{- else -}}
+{{- toPrettyJson $schema }}
+{{- end }}
+
+{{/* end of helpers */}}
+{{- end }}
diff --git a/charts/janssen/charts/config/templates/secrets.yaml b/charts/janssen/charts/config/templates/secrets.yaml
index 3bc6dfee66d..dfca599dae0 100644
--- a/charts/janssen/charts/config/templates/secrets.yaml
+++ b/charts/janssen/charts/config/templates/secrets.yaml
@@ -22,45 +22,33 @@ metadata:
type: Opaque
stringData:
{{ .Values.global.cnConfiguratorConfigurationFile | base }}: |-
- {
- "_configmap": {
- "hostname": {{ .Values.global.fqdn | quote }},
- "country_code": {{ .Values.countryCode | quote }},
- "state": {{ .Values.state | quote }},
- "city": {{ .Values.city | quote }},
- "admin_email": {{ .Values.email | quote }},
- "orgName": {{ .Values.orgName | quote }},
- "auth_sig_keys": {{ index .Values "global" "auth-server" "authSigKeys" | quote }},
- "auth_enc_keys": {{ index .Values "global" "auth-server" "authEncKeys" | quote }},
- "optional_scopes": {{ list (include "config.optionalScopes" . | fromJsonArray | join ",") | quote }},
- {{- if .Values.global.saml.enabled }}
- "kc_admin_username": {{ .Values.configmap.kcAdminUsername | quote }},
- {{- end }}
- "init_keys_exp": {{ index .Values "global" "auth-server-key-rotation" "initKeysLife" }}
- },
- "_secret": {
- "admin_password": {{ .Values.adminPassword | quote }},
- "redis_password": {{ .Values.redisPassword | quote }},
- {{ if or ( eq .Values.global.cnPersistenceType "sql" ) ( eq .Values.global.cnPersistenceType "hybrid" ) }}
- "sql_password": {{ .Values.configmap.cnSqldbUserPassword | quote }},
- {{- end }}
- {{ if eq .Values.global.configSecretAdapter "vault" }}
- "vault_role_id": {{ .Values.configmap.cnVaultRoleId | quote }},
- "vault_secret_id": {{ .Values.configmap.cnVaultSecretId | quote }},
- {{- end }}
- {{ if or (eq .Values.global.configSecretAdapter "google") (eq .Values.global.configAdapterName "google") }}
- "google_credentials": {{ .Values.configmap.cnGoogleSecretManagerServiceAccount | quote }},
- {{- end }}
- {{ if or (eq .Values.global.configAdapterName "aws") (eq .Values.global.configSecretAdapter "aws") }}
- "aws_credentials": {{ include "config.aws-shared-credentials" . | b64enc | quote }},
- "aws_config": {{ include "config.aws-config" . | b64enc | quote }},
- "aws_replica_regions": {{ .Values.configmap.cnAwsSecretsReplicaRegions | toJson | b64enc | quote }},
- {{- end }}
- {{- if .Values.global.saml.enabled }}
- "kc_db_password": {{ .Values.configmap.kcDbPassword | quote }},
- "kc_admin_password": {{ .Values.configmap.kcAdminPassword | quote }},
- {{- end }}
- "encoded_salt": {{ .Values.salt | quote }}
- }
- }
-{{- end -}}
+{{ include "config.prepareSchema" . | indent 4 }}
+{{- end }}
+
+---
+
+{{- if .Values.global.cnConfiguratorKey -}}
+apiVersion: v1
+kind: Secret
+metadata:
+ name: {{ .Release.Name }}-configuration-key-file
+ namespace: {{ .Release.Namespace }}
+ labels:
+ APP_NAME: configurator
+{{ include "config.labels" . | indent 4 }}
+{{- if .Values.additionalLabels }}
+{{ toYaml .Values.additionalLabels | indent 4 }}
+{{- end }}
+{{- if or (.Values.additionalAnnotations) (.Values.global.config.customAnnotations.secret) }}
+ annotations:
+{{- if .Values.additionalAnnotations }}
+{{ toYaml .Values.additionalAnnotations | indent 4 }}
+{{- end }}
+{{- if .Values.global.config.customAnnotations.secret }}
+{{ toYaml .Values.global.config.customAnnotations.secret | indent 4 }}
+{{- end }}
+{{- end }}
+type: Opaque
+data:
+ {{ .Values.global.cnConfiguratorKeyFile | base }}: {{ .Values.global.cnConfiguratorKey | b64enc }}
+{{- end }}
diff --git a/charts/janssen/templates/_helpers.tpl b/charts/janssen/templates/_helpers.tpl
index c284b5db6b0..8e2cc761e0c 100644
--- a/charts/janssen/templates/_helpers.tpl
+++ b/charts/janssen/templates/_helpers.tpl
@@ -37,12 +37,23 @@ Create configuration schema-related objects.
{{- define "cn.config.schema" -}}
{{- $commonName := (printf "%s-configuration-file" .Release.Name) -}}
{{- $secretName := .Values.global.cnConfiguratorCustomSchema.secretName | default $commonName -}}
+{{- $keyName := (printf "%s-configuration-key-file" .Release.Name) -}}
volumes:
- name: {{ $commonName }}
secret:
secretName: {{ $secretName }}
+{{- if .Values.global.cnConfiguratorKey }}
+ - name: {{ $keyName }}
+ secret:
+ secretName: {{ $keyName }}
+{{- end }}
volumeMounts:
- name: {{ $commonName }}
mountPath: {{ .Values.global.cnConfiguratorConfigurationFile }}
subPath: {{ .Values.global.cnConfiguratorConfigurationFile | base }}
-{{- end -}}
+{{- if .Values.global.cnConfiguratorKey }}
+ - name: {{ $keyName }}
+ mountPath: {{ .Values.global.cnConfiguratorKeyFile }}
+ subPath: {{ .Values.global.cnConfiguratorKeyFile | base }}
+{{- end }}
+{{- end }}
diff --git a/charts/janssen/values.schema.json b/charts/janssen/values.schema.json
index ea4fc5db7a8..2b571dd738f 100644
--- a/charts/janssen/values.schema.json
+++ b/charts/janssen/values.schema.json
@@ -1254,6 +1254,11 @@
"description": "The location of file contains password for the SQL user config.configmap.cnSqlDbUser. The file path must end with sql_password.",
"type": "string",
"pattern": ".*sql_password\\b.*"
+ },
+ "cnConfiguratorKey": {
+ "description": "Key to encrypt/decrypt configuration schema file using AES-256 CBC mode. Set the value to empty string to disable encryption/decryption, or 32 alphanumeric characters to enable it.",
+ "type": "string",
+ "pattern": "^(?:[a-zA-Z0-9]{32})?$"
}
}
},
@@ -2643,4 +2648,4 @@
"else": true
}
}
-}
\ No newline at end of file
+}
diff --git a/charts/janssen/values.yaml b/charts/janssen/values.yaml
index 6f6ee66f33c..edecfe88d4f 100644
--- a/charts/janssen/values.yaml
+++ b/charts/janssen/values.yaml
@@ -249,9 +249,9 @@ config:
cnVaultAddr: http://localhost:8200
# -- Verify connection to Vault.
cnVaultVerify: false
- # -- Path to file contains Vault AppRole role ID.
+ # -- Path to the file that contains Vault AppRole role ID.
cnVaultRoleIdFile: /etc/certs/vault_role_id
- # -- Path to file contains Vault AppRole secret ID.
+ # -- Path to the file that contains Vault AppRole secret ID.
cnVaultSecretIdFile: /etc/certs/vault_secret_id
# -- Vault namespace used to access the secrets.
cnVaultNamespace: ""
@@ -259,7 +259,7 @@ config:
cnVaultKvPath: secret
# -- Base prefix name used to access secrets.
cnVaultPrefix: jans
- # -- Path to Vault AppRole.
+ # -- Path to the Vault AppRole.
cnVaultAppRolePath: approle
# [vault_envs] END
# -- Value passed to Java option -XX:MaxRAMPercentage
@@ -1190,19 +1190,23 @@ global:
samlAdditionalAnnotations: { }
# -- passing custom java options to saml. DO NOT PASS JAVA_OPTIONS in envs.
cnCustomJavaOptions: ""
- # -- Path to SQL password file
+ # -- Path to the SQL password file
cnSqlPasswordFile: /etc/jans/conf/sql_password
kc-scheduler:
# -- Boolean flag to enable/disable the kc-scheduler cronjob chart.
enabled: false
- # -- Path to configuration schema file
+ # -- Path to the configuration schema file
cnConfiguratorConfigurationFile: /etc/jans/conf/configuration.json
- # -- Path to dumped configuration schema file
+ # -- Path to the dumped configuration schema file
cnConfiguratorDumpFile: /etc/jans/conf/configuration.out.json
- # -- Use custom configuration schema in existing secrets. Note, the secrets has to contain the key configuration.json or any basename as specified in cnConfiguratorConfigurationFile.
+ # -- Use custom configuration schema in existing Kubernetes secret. Note that the secret has to contain the configuration.json key or any basename as specified in cnConfiguratorConfigurationFile.
cnConfiguratorCustomSchema:
- # -- The name of the secrets used for storing custom configuration schema.
+ # -- The name of the Kubernetes secret used for storing custom configuration schema.
secretName: ""
+ # -- Key to encrypt/decrypt configuration schema file using AES-256 CBC mode. Set the value to empty string to disable encryption/decryption, or 32 alphanumeric characters to enable it.
+ cnConfiguratorKey: ""
+ # -- Path to the file that contains the key to encrypt/decrypt the configuration schema file.
+ cnConfiguratorKeyFile: /etc/jans/conf/configuration.key
# -- Nginx ingress definitions chart
nginx-ingress:
diff --git a/demos/README.md b/demos/README.md
index d16501ccf25..66b93674826 100644
--- a/demos/README.md
+++ b/demos/README.md
@@ -4,6 +4,10 @@ This folder holds different demos for different applications with janssen author
## [Benchmarking](benchmarking)
Holds a docker load test image packaging for Janssen. This image can load test users to a janssen environment and can execute jmeter tests.
-## [Jans-tent](jans-tent)
-Reliable OpenID client to be used in auth testing.
+## [Janssen Chip](jans-chip)
+- A first party android mobile application that leverages dynamic client registration (DCR), DPoP access tokens.
+- Passkey authentication
+
+## [Janssen Tarp](jans-tarp)
+A Relying Party tool in form of a Browser Extension for convenient testing of authentication flows on a browser.
diff --git a/demos/benchmarking/docker-jans-loadtesting-jmeter/Dockerfile b/demos/benchmarking/docker-jans-loadtesting-jmeter/Dockerfile
index 00dbd0b23bd..ac11e837321 100644
--- a/demos/benchmarking/docker-jans-loadtesting-jmeter/Dockerfile
+++ b/demos/benchmarking/docker-jans-loadtesting-jmeter/Dockerfile
@@ -1,5 +1,5 @@
# FROM blazemeter/taurus:master-f96971fa-2022-12-12
-FROM blazemeter/taurus:1.16.35@sha256:e4232d0b0fcf16f22cce5420d8286d89b96f8ff1490ed4d141c435d12db0a731
+FROM blazemeter/taurus:1.16.38@sha256:5bb39436180f7c769e00140b781bb1054a1eb4592dd9b82f76dcde470811bf39
# ===============
# Ubuntu packages
diff --git a/demos/jans-tent/.flaskenv b/demos/jans-tent/.flaskenv
deleted file mode 100644
index bc1b2cf6e71..00000000000
--- a/demos/jans-tent/.flaskenv
+++ /dev/null
@@ -1,2 +0,0 @@
-#.flaskenv
-FLASK_APP=clientapp
diff --git a/demos/jans-tent/.gitignore b/demos/jans-tent/.gitignore
deleted file mode 100644
index 6b3dc1fcd19..00000000000
--- a/demos/jans-tent/.gitignore
+++ /dev/null
@@ -1,146 +0,0 @@
-#jans-tent-specific
-client_info.json
-*.log.*
-
-# Byte-compiled / optimized / DLL files
-__pycache__/
-*.py[cod]
-*$py.class
-
-# C extensions
-*.so
-
-# Distribution / packaging
-.Python
-build/
-develop-eggs/
-dist/
-downloads/
-eggs/
-.eggs/
-lib/
-lib64/
-parts/
-sdist/
-var/
-wheels/
-share/python-wheels/
-*.egg-info/
-.installed.cfg
-*.egg
-MANIFEST
-
-# PyInstaller
-# Usually these files are written by a python script from a template
-# before PyInstaller builds the exe, so as to inject date/other infos into it.
-*.manifest
-*.spec
-
-# Installer logs
-pip-log.txt
-pip-delete-this-directory.txt
-
-# Unit test / coverage reports
-htmlcov/
-.tox/
-.nox/
-.coverage
-.coverage.*
-.cache
-nosetests.xml
-coverage.xml
-*.cover
-*.py,cover
-.hypothesis/
-.pytest_cache/
-cover/
-
-# Translations
-*.mo
-*.pot
-
-# Django stuff:
-*.log
-local_settings.py
-db.sqlite3
-db.sqlite3-journal
-
-# Flask stuff:
-instance/
-.webassets-cache
-
-# Scrapy stuff:
-.scrapy
-
-# Sphinx documentation
-docs/_build/
-
-# PyBuilder
-.pybuilder/
-target/
-
-# Jupyter Notebook
-.ipynb_checkpoints
-
-# IPython
-profile_default/
-ipython_config.py
-
-# pyenv
-# For a library or package, you might want to ignore these files since the code is
-# intended to run in multiple environments; otherwise, check them in:
-# .python-version
-
-# pipenv
-# According to pypa/pipenv#598, it is recommended to include Pipfile.lock in version control.
-# However, in case of collaboration, if having platform-specific dependencies or dependencies
-# having no cross-platform support, pipenv may install dependencies that don't work, or not
-# install all needed dependencies.
-#Pipfile.lock
-
-# PEP 582; used by e.g. github.com/David-OConnor/pyflow
-__pypackages__/
-
-# Celery stuff
-celerybeat-schedule
-celerybeat.pid
-
-# SageMath parsed files
-*.sage.py
-
-# Environments
-.env
-.venv
-env/
-venv/
-ENV/
-env.bak/
-venv.bak/
-
-# Spyder project settings
-.spyderproject
-.spyproject
-
-# Rope project settings
-.ropeproject
-
-# mkdocs documentation
-/site
-
-# mypy
-.mypy_cache/
-.dmypy.json
-dmypy.json
-
-# Pyre type checker
-.pyre/
-
-# pytype static type analyzer
-.pytype/
-
-# Cython debug symbols
-cython_debug/
-
-.vscode/
-.scannerwork
-
diff --git a/demos/jans-tent/LICENSE b/demos/jans-tent/LICENSE
deleted file mode 100644
index 6912a5f93c9..00000000000
--- a/demos/jans-tent/LICENSE
+++ /dev/null
@@ -1,201 +0,0 @@
- Apache License
- Version 2.0, January 2004
- http://www.apache.org/licenses/
-
- TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
-
- 1. Definitions.
-
- "License" shall mean the terms and conditions for use, reproduction,
- and distribution as defined by Sections 1 through 9 of this document.
-
- "Licensor" shall mean the copyright owner or entity authorized by
- the copyright owner that is granting the License.
-
- "Legal Entity" shall mean the union of the acting entity and all
- other entities that control, are controlled by, or are under common
- control with that entity. For the purposes of this definition,
- "control" means (i) the power, direct or indirect, to cause the
- direction or management of such entity, whether by contract or
- otherwise, or (ii) ownership of fifty percent (50%) or more of the
- outstanding shares, or (iii) beneficial ownership of such entity.
-
- "You" (or "Your") shall mean an individual or Legal Entity
- exercising permissions granted by this License.
-
- "Source" form shall mean the preferred form for making modifications,
- including but not limited to software source code, documentation
- source, and configuration files.
-
- "Object" form shall mean any form resulting from mechanical
- transformation or translation of a Source form, including but
- not limited to compiled object code, generated documentation,
- and conversions to other media types.
-
- "Work" shall mean the work of authorship, whether in Source or
- Object form, made available under the License, as indicated by a
- copyright notice that is included in or attached to the work
- (an example is provided in the Appendix below).
-
- "Derivative Works" shall mean any work, whether in Source or Object
- form, that is based on (or derived from) the Work and for which the
- editorial revisions, annotations, elaborations, or other modifications
- represent, as a whole, an original work of authorship. For the purposes
- of this License, Derivative Works shall not include works that remain
- separable from, or merely link (or bind by name) to the interfaces of,
- the Work and Derivative Works thereof.
-
- "Contribution" shall mean any work of authorship, including
- the original version of the Work and any modifications or additions
- to that Work or Derivative Works thereof, that is intentionally
- submitted to Licensor for inclusion in the Work by the copyright owner
- or by an individual or Legal Entity authorized to submit on behalf of
- the copyright owner. For the purposes of this definition, "submitted"
- means any form of electronic, verbal, or written communication sent
- to the Licensor or its representatives, including but not limited to
- communication on electronic mailing lists, source code control systems,
- and issue tracking systems that are managed by, or on behalf of, the
- Licensor for the purpose of discussing and improving the Work, but
- excluding communication that is conspicuously marked or otherwise
- designated in writing by the copyright owner as "Not a Contribution."
-
- "Contributor" shall mean Licensor and any individual or Legal Entity
- on behalf of whom a Contribution has been received by Licensor and
- subsequently incorporated within the Work.
-
- 2. Grant of Copyright License. Subject to the terms and conditions of
- this License, each Contributor hereby grants to You a perpetual,
- worldwide, non-exclusive, no-charge, royalty-free, irrevocable
- copyright license to reproduce, prepare Derivative Works of,
- publicly display, publicly perform, sublicense, and distribute the
- Work and such Derivative Works in Source or Object form.
-
- 3. Grant of Patent License. Subject to the terms and conditions of
- this License, each Contributor hereby grants to You a perpetual,
- worldwide, non-exclusive, no-charge, royalty-free, irrevocable
- (except as stated in this section) patent license to make, have made,
- use, offer to sell, sell, import, and otherwise transfer the Work,
- where such license applies only to those patent claims licensable
- by such Contributor that are necessarily infringed by their
- Contribution(s) alone or by combination of their Contribution(s)
- with the Work to which such Contribution(s) was submitted. If You
- institute patent litigation against any entity (including a
- cross-claim or counterclaim in a lawsuit) alleging that the Work
- or a Contribution incorporated within the Work constitutes direct
- or contributory patent infringement, then any patent licenses
- granted to You under this License for that Work shall terminate
- as of the date such litigation is filed.
-
- 4. Redistribution. You may reproduce and distribute copies of the
- Work or Derivative Works thereof in any medium, with or without
- modifications, and in Source or Object form, provided that You
- meet the following conditions:
-
- (a) You must give any other recipients of the Work or
- Derivative Works a copy of this License; and
-
- (b) You must cause any modified files to carry prominent notices
- stating that You changed the files; and
-
- (c) You must retain, in the Source form of any Derivative Works
- that You distribute, all copyright, patent, trademark, and
- attribution notices from the Source form of the Work,
- excluding those notices that do not pertain to any part of
- the Derivative Works; and
-
- (d) If the Work includes a "NOTICE" text file as part of its
- distribution, then any Derivative Works that You distribute must
- include a readable copy of the attribution notices contained
- within such NOTICE file, excluding those notices that do not
- pertain to any part of the Derivative Works, in at least one
- of the following places: within a NOTICE text file distributed
- as part of the Derivative Works; within the Source form or
- documentation, if provided along with the Derivative Works; or,
- within a display generated by the Derivative Works, if and
- wherever such third-party notices normally appear. The contents
- of the NOTICE file are for informational purposes only and
- do not modify the License. You may add Your own attribution
- notices within Derivative Works that You distribute, alongside
- or as an addendum to the NOTICE text from the Work, provided
- that such additional attribution notices cannot be construed
- as modifying the License.
-
- You may add Your own copyright statement to Your modifications and
- may provide additional or different license terms and conditions
- for use, reproduction, or distribution of Your modifications, or
- for any such Derivative Works as a whole, provided Your use,
- reproduction, and distribution of the Work otherwise complies with
- the conditions stated in this License.
-
- 5. Submission of Contributions. Unless You explicitly state otherwise,
- any Contribution intentionally submitted for inclusion in the Work
- by You to the Licensor shall be under the terms and conditions of
- this License, without any additional terms or conditions.
- Notwithstanding the above, nothing herein shall supersede or modify
- the terms of any separate license agreement you may have executed
- with Licensor regarding such Contributions.
-
- 6. Trademarks. This License does not grant permission to use the trade
- names, trademarks, service marks, or product names of the Licensor,
- except as required for reasonable and customary use in describing the
- origin of the Work and reproducing the content of the NOTICE file.
-
- 7. Disclaimer of Warranty. Unless required by applicable law or
- agreed to in writing, Licensor provides the Work (and each
- Contributor provides its Contributions) on an "AS IS" BASIS,
- WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
- implied, including, without limitation, any warranties or conditions
- of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
- PARTICULAR PURPOSE. You are solely responsible for determining the
- appropriateness of using or redistributing the Work and assume any
- risks associated with Your exercise of permissions under this License.
-
- 8. Limitation of Liability. In no event and under no legal theory,
- whether in tort (including negligence), contract, or otherwise,
- unless required by applicable law (such as deliberate and grossly
- negligent acts) or agreed to in writing, shall any Contributor be
- liable to You for damages, including any direct, indirect, special,
- incidental, or consequential damages of any character arising as a
- result of this License or out of the use or inability to use the
- Work (including but not limited to damages for loss of goodwill,
- work stoppage, computer failure or malfunction, or any and all
- other commercial damages or losses), even if such Contributor
- has been advised of the possibility of such damages.
-
- 9. Accepting Warranty or Additional Liability. While redistributing
- the Work or Derivative Works thereof, You may choose to offer,
- and charge a fee for, acceptance of support, warranty, indemnity,
- or other liability obligations and/or rights consistent with this
- License. However, in accepting such obligations, You may act only
- on Your own behalf and on Your sole responsibility, not on behalf
- of any other Contributor, and only if You agree to indemnify,
- defend, and hold each Contributor harmless for any liability
- incurred by, or claims asserted against, such Contributor by reason
- of your accepting any such warranty or additional liability.
-
- END OF TERMS AND CONDITIONS
-
- APPENDIX: How to apply the Apache License to your work.
-
- To apply the Apache License to your work, attach the following
- boilerplate notice, with the fields enclosed by brackets "[]"
- replaced with your own identifying information. (Don't include
- the brackets!) The text should be enclosed in the appropriate
- comment syntax for the file format. We also recommend that a
- file or class name and description of purpose be included on the
- same "printed page" as the copyright notice for easier
- identification within third-party archives.
-
- Copyright 2023 Christian Eland
-
- Licensed under the Apache License, Version 2.0 (the "License");
- you may not use this file except in compliance with the License.
- You may obtain a copy of the License at
-
- http://www.apache.org/licenses/LICENSE-2.0
-
- Unless required by applicable law or agreed to in writing, software
- distributed under the License is distributed on an "AS IS" BASIS,
- WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- See the License for the specific language governing permissions and
- limitations under the License.
\ No newline at end of file
diff --git a/demos/jans-tent/README.md b/demos/jans-tent/README.md
deleted file mode 100644
index 3f6c6c1ff87..00000000000
--- a/demos/jans-tent/README.md
+++ /dev/null
@@ -1,144 +0,0 @@
-# Jans Tent
-
-To test an OpenID Provider ("OP"), you need a test Relying Party ("RP"). Jans
-Tent is easy to configure RP which enables you to send different requests by
-quickly modifying one file (`config.py`). It's a Python Flask application,
-so it's easy to hack for other testing requirements.
-
-By default, it uses `localhost` as the `redirect_uri`, so if you run it on your
-laptop, all you need to do is specify the OP hostname to run it. Tent uses
-dynamic client registration to obtain client credentials. But you can also use
-an existing client_id if you like.
-
-## Installation
-
-**Important**: Ensure you have `Python >= 3.11`
-
-**Mac Users**: We recommend using [pyenv - simple python version management](https://github.com/pyenv/pyenv) instead of Os x native python.
-
-1. Navigate to the project root folder `jans/demos/jans-tent`
-2. Create virtual environment
-```bash
-python3 -m venv venv
-````
-3. Activate the virtual virtual environment
-```bash
-source venv/bin/activate
-```
-4. Install dependencies
-```bash
-pip install -r requirements.txt
-```
-
-## Setup
-
-### 1. Edit configuration file `clientapp/config.py` according to your needs:
- * Set `ISSUER`, replace `op_hostname` (required)
- * Set any other desired configuration
-
-### 2. Generate test RP server self signed certs
-
-Generate `key.pem` and `cert.pem` at `jans-tent` project root folder (`jans/demos/jans-tent`). i.e:
-```bash
-openssl req -x509 -newkey rsa:4096 -keyout key.pem -out cert.pem -sha256 -days 365 -nodes
-```
-
-### 3. Import your OP TLS certificate
-
-(remember to be inside your virtual environment)
-
-Supply the hostname of the ISSUER after the `=`
-
-```bash
-export OP_HOSTNAME=
-```
-
-```bash
-echo | openssl s_client -servername $OP_HOSTNAME -connect $OP_HOSTNAME:443 | sed -ne '/-BEGIN CERTIFICATE-/,/-END CERTIFICATE-/p' > op_web_cert.cer
-```
-
-```bash
-export CERT_PATH=$(python3 -m certifi)
-```
-
-```bash
-export SSL_CERT_FILE=${CERT_PATH}
-```
-
-```bash
-export REQUESTS_CA_BUNDLE=${CERT_PATH} && mv op_web_cert.cer $CERT_PATH
-```
-
-## Using the server
-
-### Start the server
-
-Please notice that your client will be automatically registered once the server
-starts. If your client was already registered, when you start the server again,
-it won't register. Remember to be inside your virtual environment!
-
-```bash
-python main.py
-```
-
-### Login!
-
-Navigate your browser to `https://localhost:9090` and click the link to start.
-
-## Manual client configuration
-
-In case your OP doesn't support dynamic registration, manually configure your
-client by creating a file caled `client_info.json` in the `jans-tent` folder
-with the following claims:
-
-```json
-{
- "op_metadata_url": "https://op_hostname/.well-known/openid-configuration",
- "client_id": "e4f2c3a9-0797-4c6c-9268-35c5546fb3e9",
- "client_secret": "a3e71cf1-b9b4-44c5-a9e6-4c7b5c660a5d"
-}
-```
-
-## Updating Tent to use a different OP
-
-If you want to test a different OP, do the following:
-
-1. Remove `op_web_cert` from the tent folder, and follow the procedure above
-to download and install a new OP TLS certificate
-2. Remove `client_info.json` from the tent folder
-3. Update the value of `ISSUER` in `./clientapp/config.py`
-4. Run `./register_new_client.py`
-
-## Other Tent endpoints
-
-### Auto-register endpoint
-
-Sending a `POST` request to Jans Tent `/register` endpoint containing a `JSON`
-with the OP/AS url and client url, like this:
-
-```json
-{
- "op_url": "https://OP_HOSTNAME",
- "client_url": "https://localhost:9090",
- "additional_params": {
- "scope": "openid mail profile"
- }
-}
-```
-Please notice that `additional_params` is not required by endpoint.
-
-The response will return the registered client id and client secret
-
-### Auto-config endpoint
-
-Sending a `POST` request to the Tent `/configuration` endpoint, containing the
-client id, client secret, and metadata endpoint will fetch data from OP metadata
-url and override the `config.py` settings during runtime.
-
-```json
-{
- "client_id": "e4f2c3a9-0797-4c6c-9268-35c5546fb3e9",
- "client_secret": "5c9e4775-0f1d-4a56-87c9-a629e1f88b9b",
- "op_metadata_url": "https://OP_HOSTNAME/.well-known/openid-configuration"
-}
-```
diff --git a/demos/jans-tent/behave.ini b/demos/jans-tent/behave.ini
deleted file mode 100644
index cbb1bc67a71..00000000000
--- a/demos/jans-tent/behave.ini
+++ /dev/null
@@ -1,3 +0,0 @@
-[behave]
-stderr_capture=False
-stdout_capture=False
diff --git a/demos/jans-tent/clientapp/__init__.py b/demos/jans-tent/clientapp/__init__.py
deleted file mode 100644
index a7429e815a5..00000000000
--- a/demos/jans-tent/clientapp/__init__.py
+++ /dev/null
@@ -1,251 +0,0 @@
-'''
-Project: Test Auth Client
-Author: Christian Hawk
-
-
-Licensed under the Apache License, Version 2.0 (the 'License');
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
- http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an 'AS IS' BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-'''
-import base64
-import urllib
-import json
-import os
-from urllib.parse import urlparse
-from authlib.integrations.flask_client import OAuth
-from flask import (Flask, jsonify, redirect, render_template, request, session,
- url_for)
-from . import config as cfg
-from .helpers.client_handler import ClientHandler
-from .helpers.cgf_checker import register_client_if_no_client_info
-from .utils.logger import setup_logger
-
-setup_logger()
-
-oauth = OAuth()
-
-
-def add_config_from_json():
- with open('client_info.json', 'r') as openfile:
- client_info = json.load(openfile)
- cfg.SERVER_META_URL = client_info['op_metadata_url']
- cfg.CLIENT_ID = client_info['client_id']
- cfg.CLIENT_SECRET = client_info['client_secret']
- cfg.END_SESSION_ENDPOINT = client_info['end_session_endpoint'] # separate later
-
-
-def get_preselected_provider():
- provider_id_string = cfg.PRE_SELECTED_PROVIDER_ID
- provider_object = '{ "provider" : "%s" }' % provider_id_string
- provider_object_bytes = provider_object.encode()
- base64url_bytes = base64.urlsafe_b64encode(provider_object_bytes)
- base64url_value = base64url_bytes.decode()
- # if base64url_value.endswith('='):
- # base64url_value_unpad = base64url_value.replace('=', '')
- # return base64url_value_unpad
- return base64url_value
-
-
-def get_provider_host():
- provider_host_string = cfg.PROVIDER_HOST_STRING
- provider_object = '{ "providerHost" : "%s" }' % provider_host_string
- provider_object_bytes = provider_object.encode()
- base64url_bytes = base64.urlsafe_b64encode(provider_object_bytes)
- base64url_value = base64url_bytes.decode()
- # if base64url_value.endswith('='):
- # base64url_value_unpad = base64url_value.replace('=', '')
- # return base64url_value_unpad
- return base64url_value
-
-
-def ssl_verify(ssl_verify=cfg.SSL_VERIFY):
- if ssl_verify is False:
- os.environ['CURL_CA_BUNDLE'] = ""
-
-
-class BaseClientErrors(Exception):
- status_code = 500
-
-
-def create_app():
- register_client_if_no_client_info()
- add_config_from_json()
- ssl_verify()
-
- app = Flask(__name__)
-
- app.secret_key = b'fasfafpj3rasdaasfglaksdgags331s'
- app.config['OP_CLIENT_ID'] = cfg.CLIENT_ID
- app.config['OP_CLIENT_SECRET'] = cfg.CLIENT_SECRET
- oauth.init_app(app)
- oauth.register(
- 'op',
- server_metadata_url=cfg.SERVER_META_URL,
- client_kwargs={
- 'scope': cfg.SCOPE
- },
- token_endpoint_auth_method=cfg.SERVER_TOKEN_AUTH_METHOD
- )
-
- @app.route('/')
- def index():
- user = session.get('user')
- id_token = session.get('id_token')
- return render_template("home.html", user=user, id_token=id_token)
-
- @app.route('/logout')
- def logout():
- app.logger.info('Called /logout')
- if 'id_token' in session.keys():
- app.logger.info('Cleaning session credentials')
- token_hint = session.get('id_token')
- session.pop('id_token')
- session.pop('user')
- parsed_redirect_uri = urllib.parse.urlparse(cfg.REDIRECT_URIS[0])
- post_logout_redirect_uri = '%s://%s' % (parsed_redirect_uri.scheme, parsed_redirect_uri.netloc)
- return redirect(
- '%s?post_logout_redirect_uri=%s&token_hint=%s' % (
- cfg.END_SESSION_ENDPOINT, post_logout_redirect_uri, token_hint
- )
- )
-
- app.logger.info('Not authorized to logout, redirecting to index')
- return redirect(url_for('index'))
-
- @app.route('/register', methods=['POST'])
- def register():
- app.logger.info('/register called')
- content = request.json
- app.logger.debug('data = %s' % content)
- status = 0
- data = ''
- if content is None:
- status = 400
- # message = 'No json data posted'
- elif 'op_url' and 'redirect_uris' not in content:
- status = 400
- # message = 'Not needed keys found in json'
- else:
- app.logger.info('Trying to register client %s on %s' %
- (content['redirect_uris'], content['op_url']))
- op_url = content['op_url']
- redirect_uris = content['redirect_uris']
-
- op_parsed_url = urlparse(op_url)
- client_parsed_redirect_uri = urlparse(redirect_uris[0])
-
- if op_parsed_url.scheme != 'https' or client_parsed_redirect_uri.scheme != 'https':
- status = 400
-
- elif (((
- op_parsed_url.path != '' or op_parsed_url.query != '') or client_parsed_redirect_uri.path == '') or client_parsed_redirect_uri.query != ''):
- status = 400
-
- else:
- additional_metadata = {}
- if 'additional_params' in content.keys():
- additional_metadata = content['additional_params']
- client_handler = ClientHandler(
- content['op_url'], content['redirect_uris'], additional_metadata
- )
- data = client_handler.get_client_dict()
- status = 200
- return jsonify(data), status
-
- @app.route('/protected-content', methods=['GET'])
- def protected_content():
- app.logger.debug('/protected-content - cookies = %s' % request.cookies)
- app.logger.debug('/protected-content - session = %s' % session)
- if 'user' in session:
- return session['user']
-
- return redirect(url_for('login'))
-
- @app.route('/login')
- def login():
- app.logger.info('/login requested')
- redirect_uri = cfg.REDIRECT_URIS[0]
- app.logger.debug('/login redirect_uri = %s' % redirect_uri)
- # response = oauth.op.authorize_redirect()
- query_args = {
- 'redirect_uri': redirect_uri,
- }
-
- if cfg.ACR_VALUES is not None:
- query_args['acr_values'] = cfg.ACR_VALUES
-
- # used for inbound-saml, uncomment and set config.py to use it
- # if cfg.PRE_SELECTED_PROVIDER is True:
- # query_args[
- # 'preselectedExternalProvider'] = get_preselected_provider()
-
- # used for gluu-passport, , uncomment and set config.py to use it
- # if cfg.PROVIDER_HOST_STRING is not None:
- # query_args["providerHost"] = get_provider_host()
-
- if cfg.ADDITIONAL_PARAMS is not None:
- query_args |= cfg.ADDITIONAL_PARAMS
-
- response = oauth.op.authorize_redirect(**query_args)
-
- app.logger.debug('/login authorize_redirect(redirect_uri) url = %s' %
- (response.location))
-
- return response
-
- @app.route('/oidc_callback')
- @app.route('/callback')
- def callback():
- try:
- if not request.args['code']:
- return {}, 400
-
- app.logger.info('/callback - received %s - %s' %
- (request.method, request.query_string))
- token = oauth.op.authorize_access_token()
- app.logger.debug('/callback - token = %s' % token)
- user = oauth.op.userinfo()
- app.logger.debug('/callback - user = %s' % user)
- session['user'] = user
- session['id_token'] = token['userinfo']
- app.logger.debug('/callback - cookies = %s' % request.cookies)
- app.logger.debug('/callback - session = %s' % session)
-
- return redirect('/')
-
- except Exception as error:
- app.logger.error(str(error))
- return {'error': str(error)}, 400
-
- @app.route("/configuration", methods=["POST"])
- def configuration():
- # Receives client configuration via API
- app.logger.info('/configuration called')
- content = request.json
- app.logger.debug("content = %s" % content)
- if content is not None:
- if 'provider_id' in content:
- cfg.PRE_SELECTED_PROVIDER_ID = content['provider_id']
- cfg.PRE_SELECTED_PROVIDER = True
- app.logger.debug('/configuration: provider_id = %s' %
- content['provider_id'])
-
- return jsonify({"provider_id": content['provider_id']}), 200
-
- if "client_id" in content and "client_secret" in content:
- # Setup client_id and client_secret
- oauth.op.client_id = content['client_id']
- oauth.op.client_secret = content['client_secret']
- return {}, 200
- else:
- return {}, 400
-
- return app
diff --git a/demos/jans-tent/clientapp/config.py b/demos/jans-tent/clientapp/config.py
deleted file mode 100644
index 04bcb8df3b9..00000000000
--- a/demos/jans-tent/clientapp/config.py
+++ /dev/null
@@ -1,36 +0,0 @@
-# REQUIRED
-# Replace op_hostname
-ISSUER = 'https://op_hostname'
-
-# Tent redirect uri
-REDIRECT_URIS = [
- 'https://localhost:9090/oidc_callback'
-]
-
-# OPTIONAL: Use at your own risk
-
-# Token authentication method can be
-# client_secret_basic
-# client_secret_post
-# none
-SERVER_TOKEN_AUTH_METHOD = 'client_secret_post'
-
-# ACR VALUES
-# Examples:
-# ACR_VALUES = "agama"
-# ACR_VALUES = 'simple_password_auth'
-ACR_VALUES = None
-
-# ADDITIONAL PARAMS TO CALL AUTHORIZE ENDPOINT, WITHOUT BASE64 ENCODING. USE DICT {'param': 'value'}
-# ADDITIONAL_PARAMS = {'paramOne': 'valueOne', 'paramTwo': 'valueTwo'}
-ADDITIONAL_PARAMS = None
-
-# SYSTEM SETTINGS
-# use with caution, unsecure requests, for development environments
-SSL_VERIFY = False
-
-# SCOPES
-# Only scope "openid" is required for a pairwise identifier from the OP.
-# OP can provision additional optional scopes as needed.
-# SCOPE = 'openid email profile'
-SCOPE = 'openid'
diff --git a/demos/jans-tent/clientapp/helpers/__init__.py b/demos/jans-tent/clientapp/helpers/__init__.py
deleted file mode 100644
index e69de29bb2d..00000000000
diff --git a/demos/jans-tent/clientapp/helpers/cgf_checker.py b/demos/jans-tent/clientapp/helpers/cgf_checker.py
deleted file mode 100644
index e5ade597adf..00000000000
--- a/demos/jans-tent/clientapp/helpers/cgf_checker.py
+++ /dev/null
@@ -1,17 +0,0 @@
-from os.path import exists
-import logging
-from clientapp.utils.dcr_from_config import register
-
-logger = logging.getLogger(__name__)
-
-
-def configuration_exists() -> bool:
- return exists('client_info.json')
-
-
-def register_client_if_no_client_info() -> None:
- if configuration_exists() :
- logger.info('Found configuration file client_info.json, skipping auto-register')
- else:
- logger.info('Client configuration not found, trying to auto-register through DCR')
- register()
diff --git a/demos/jans-tent/clientapp/helpers/client_handler.py b/demos/jans-tent/clientapp/helpers/client_handler.py
deleted file mode 100644
index 7e5f8f12e2a..00000000000
--- a/demos/jans-tent/clientapp/helpers/client_handler.py
+++ /dev/null
@@ -1,117 +0,0 @@
-'''
-Project: Test Auth Client
-Author: Christian Hawk
-
-
-Licensed under the Apache License, Version 2.0 (the 'License');
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
- http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an 'AS IS' BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-'''
-import logging
-import json
-from httplib2 import RelativeURIError
-from typing import Optional, Dict, Any
-
-from oic.oauth2 import ASConfigurationResponse
-from oic.oic import Client
-from oic.utils.authn.client import CLIENT_AUTHN_METHOD
-from .custom_msg_factory import CustomMessageFactory
-
-
-logger = logging.getLogger(__name__)
-
-
-class ClientHandler:
- __redirect_uris = None
- __client_id = None
- __client_secret = None
- __metadata_url = None
- __op_url = None
- __additional_metadata = None
- __end_session_endpoint = None
- op_data = None
-
- def __init__(self, op_url: str, redirect_uris: list[str], additional_metadata: dict):
- """[initializes]
-
- :param op_url: [url from oidc provider starting with https]
- :type op_url: str
- :param redirect_uris: [url from client starting with https]
- :type redirect_uris: list
- :param additional_metadata: additional client metadata
- :type additional_metadata: dict
- """
- self.__additional_metadata = additional_metadata
- self.clientAdapter = Client(client_authn_method=CLIENT_AUTHN_METHOD, message_factory=CustomMessageFactory)
- self.__op_url = op_url
- self.__redirect_uris = redirect_uris
- self.__metadata_url = '%s/.well-known/openid-configuration' % op_url
- self.op_data = self.discover(op_url)
- self.reg_info = self.register_client(op_data=self.op_data, redirect_uris=redirect_uris)
- self.__end_session_endpoint = self.op_data['end_session_endpoint']
- self.__client_id = self.reg_info['client_id']
- self.__client_secret = self.reg_info['client_secret']
-
- def get_client_dict(self) -> dict:
- r = {
- 'op_metadata_url': self.__metadata_url,
- 'client_id': self.__client_id,
- 'client_secret': self.__client_secret,
- 'end_session_endpoint': self.__end_session_endpoint
- }
-
- return r
-
- def register_client(self, op_data: ASConfigurationResponse = op_data, redirect_uris: Optional[list[str]] = __redirect_uris) -> dict:
- """[register client and returns client information]
-
- :param op_data: [description]
- :type op_data: dict
- :param redirect_uris: [description]
- :type redirect_uris: list[str]
- :return: [client information including client-id and secret]
- :rtype: dict
- """
- logger.debug('called ClientHandler´s register_client method')
- registration_args = {'redirect_uris': redirect_uris,
- 'response_types': ['code'],
- 'grant_types': ['authorization_code'],
- 'application_type': 'web',
- 'client_name': 'Jans Tent',
- 'token_endpoint_auth_method': 'client_secret_post',
- **self.__additional_metadata
- }
- logger.info('calling register with registration_args: %s', json.dumps(registration_args, indent=2))
- reg_info = self.clientAdapter.register(op_data['registration_endpoint'], **registration_args)
- logger.info('register_client - reg_info = %s', json.dumps(reg_info.to_dict(), indent=2))
- return reg_info
-
- def discover(self, op_url: Optional[str] = __op_url) -> ASConfigurationResponse:
- """Discover op information on .well-known/open-id-configuration
- :param op_url: [description], defaults to __op_url
- :type op_url: str, optional
- :return: [data retrieved from OP url]
- :rtype: ASConfigurationResponse
- """
- logger.debug('called discover')
- try:
- op_data = self.clientAdapter.provider_config(op_url)
- return op_data
-
- except json.JSONDecodeError as err:
- logger.error('Error trying to decode JSON: %s' % err)
-
- except RelativeURIError as err:
- logger.error(err)
-
- except Exception as e:
- logging.error('An unexpected ocurred: %s' % e)
-
diff --git a/demos/jans-tent/clientapp/helpers/custom_msg_factory.py b/demos/jans-tent/clientapp/helpers/custom_msg_factory.py
deleted file mode 100644
index 11f0ae09a60..00000000000
--- a/demos/jans-tent/clientapp/helpers/custom_msg_factory.py
+++ /dev/null
@@ -1,59 +0,0 @@
-"""
-Custom message factory required by pyoic to add scope param
-Overrides RegistrationRequest, RegistrationResponse
-and use them to create CustomMessageFactory
-"""
-
-from oic.oic.message import OIDCMessageFactory, RegistrationRequest, RegistrationResponse, MessageTuple, OPTIONAL_LOGICAL
-from oic.oauth2.message import OPTIONAL_LIST_OF_STRINGS, REQUIRED_LIST_OF_STRINGS, SINGLE_OPTIONAL_STRING, SINGLE_OPTIONAL_INT
-
-
-class MyRegistrationRequest(RegistrationRequest):
- c_param = {
- "redirect_uris": REQUIRED_LIST_OF_STRINGS,
- "response_types": OPTIONAL_LIST_OF_STRINGS,
- "grant_types": OPTIONAL_LIST_OF_STRINGS,
- "application_type": SINGLE_OPTIONAL_STRING,
- "contacts": OPTIONAL_LIST_OF_STRINGS,
- "client_name": SINGLE_OPTIONAL_STRING,
- "logo_uri": SINGLE_OPTIONAL_STRING,
- "client_uri": SINGLE_OPTIONAL_STRING,
- "policy_uri": SINGLE_OPTIONAL_STRING,
- "tos_uri": SINGLE_OPTIONAL_STRING,
- "jwks": SINGLE_OPTIONAL_STRING,
- "jwks_uri": SINGLE_OPTIONAL_STRING,
- "sector_identifier_uri": SINGLE_OPTIONAL_STRING,
- "subject_type": SINGLE_OPTIONAL_STRING,
- "id_token_signed_response_alg": SINGLE_OPTIONAL_STRING,
- "id_token_encrypted_response_alg": SINGLE_OPTIONAL_STRING,
- "id_token_encrypted_response_enc": SINGLE_OPTIONAL_STRING,
- "userinfo_signed_response_alg": SINGLE_OPTIONAL_STRING,
- "userinfo_encrypted_response_alg": SINGLE_OPTIONAL_STRING,
- "userinfo_encrypted_response_enc": SINGLE_OPTIONAL_STRING,
- "request_object_signing_alg": SINGLE_OPTIONAL_STRING,
- "request_object_encryption_alg": SINGLE_OPTIONAL_STRING,
- "request_object_encryption_enc": SINGLE_OPTIONAL_STRING,
- "token_endpoint_auth_method": SINGLE_OPTIONAL_STRING,
- "token_endpoint_auth_signing_alg": SINGLE_OPTIONAL_STRING,
- "default_max_age": SINGLE_OPTIONAL_INT,
- "require_auth_time": OPTIONAL_LOGICAL,
- "default_acr_values": OPTIONAL_LIST_OF_STRINGS,
- "initiate_login_uri": SINGLE_OPTIONAL_STRING,
- "request_uris": OPTIONAL_LIST_OF_STRINGS,
- "post_logout_redirect_uris": OPTIONAL_LIST_OF_STRINGS,
- "frontchannel_logout_uri": SINGLE_OPTIONAL_STRING,
- "frontchannel_logout_session_required": OPTIONAL_LOGICAL,
- "backchannel_logout_uri": SINGLE_OPTIONAL_STRING,
- "backchannel_logout_session_required": OPTIONAL_LOGICAL,
- "scope": OPTIONAL_LIST_OF_STRINGS, # added
- }
- c_default = {"application_type": "web", "response_types": ["code"]}
- c_allowed_values = {
- "application_type": ["native", "web"],
- "subject_type": ["public", "pairwise"],
- }
-
-
-class CustomMessageFactory(OIDCMessageFactory):
- registration_endpoint = MessageTuple(MyRegistrationRequest, RegistrationResponse)
-
diff --git a/demos/jans-tent/clientapp/templates/home.html b/demos/jans-tent/clientapp/templates/home.html
deleted file mode 100644
index 021c6fcfaac..00000000000
--- a/demos/jans-tent/clientapp/templates/home.html
+++ /dev/null
@@ -1,21 +0,0 @@
-
- Index Test
-
-
+
+
+
+
+
\ No newline at end of file
diff --git a/jans-cedarling/bindings/cedarling_wasm/src/lib.rs b/jans-cedarling/bindings/cedarling_wasm/src/lib.rs
new file mode 100644
index 00000000000..5fb8c52eaf7
--- /dev/null
+++ b/jans-cedarling/bindings/cedarling_wasm/src/lib.rs
@@ -0,0 +1,323 @@
+// This software is available under the Apache-2.0 license.
+// See https://www.apache.org/licenses/LICENSE-2.0.txt for full text.
+//
+// Copyright (c) 2024, Gluu, Inc.
+
+use cedarling::bindings::cedar_policy;
+use cedarling::{BootstrapConfig, BootstrapConfigRaw, LogStorage, Request};
+use serde::ser::{Serialize, SerializeStruct, Serializer};
+use serde_json::json;
+use serde_wasm_bindgen::Error;
+use std::rc::Rc;
+use wasm_bindgen::prelude::*;
+use wasm_bindgen_futures::js_sys::{Array, Map, Object, Reflect};
+
+#[cfg(test)]
+mod tests;
+
+/// The instance of the Cedarling application.
+#[wasm_bindgen]
+#[derive(Clone)]
+pub struct Cedarling {
+ instance: cedarling::Cedarling,
+}
+
+/// Create a new instance of the Cedarling application.
+/// This function can take as config parameter the eather `Map` other `Object`
+#[wasm_bindgen]
+pub async fn init(config: JsValue) -> Result {
+ if config.is_instance_of::