Skip to content

Commit 4f6bf0d

Browse files
tomas-langertomas-langer
authored
4.x: Support for disabling security providers through configuration. (#8521)
* Support for disabling security providers through configuration. Test added. * Documentation update * Add null check. * Checkstyle fix.
1 parent f144e44 commit 4f6bf0d

File tree

9 files changed

+259
-1
lines changed

9 files changed

+259
-1
lines changed

‎docs/src/main/asciidoc/se/security/introduction.adoc

+9
Original file line numberDiff line numberDiff line change
@@ -56,6 +56,8 @@ Helidon Security provides authentication, authorization, and auditing for your H
5656
logger called "AUDIT" (may be overridden through configuration). AuditProvider
5757
SPI may be implemented to support other auditing options.
5858
59+
Each feature is implemented with the help of "xref:providers.adoc[Security Providers]".
60+
5961
Security module is quite HTTP centric (as most common use cases are related to
6062
HTTP REST), though it is not HTTP specific (the security module may be used to
6163
secure even other transports, such as JMS, Kafka messages etc. if an appropriate
@@ -116,6 +118,13 @@ include::{sourcedir}/se/security/IntroductionSnippets.java[tag=snippet_3, indent
116118
----
117119
<1> Uses `io.helidon.Config`
118120
121+
As mentioned above, security features are implemented through providers, which are configured under key
122+
`security.providers`. Each element of the list is one security provider. The key of the provider must match
123+
its config key (as documented in xref:providers.adoc[Security Providers] for each supported provider).
124+
125+
A key `enabled` can be used for each provider to provide fine control of which providers are enabled/disabled, for example
126+
to support different setup in testing and in production environments.
127+
119128
[source,yaml]
120129
.Security from configuration - application.yaml
121130
----

‎security/security/src/main/java/io/helidon/security/Security.java

+36-1
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright (c) 2018, 2023 Oracle and/or its affiliates.
2+
* Copyright (c) 2018, 2024 Oracle and/or its affiliates.
33
*
44
* Licensed under the Apache License, Version 2.0 (the "License");
55
* you may not use this file except in compliance with the License.
@@ -1082,6 +1082,22 @@ private void providerFromConfig(Map<String, SecurityProviderService> configKeyTo
10821082
Map<String, SecurityProviderService> classNameToService,
10831083
String knownKeys,
10841084
Config pConf) {
1085+
boolean enabled = pConf.get("enabled").asBoolean().orElse(true);
1086+
if (!enabled) {
1087+
// this provider is marked as disabled, we will ignore it
1088+
// this is checking the top level provider configuration (see below check for provider specific)
1089+
// this section check (example):
1090+
/*
1091+
security.providers:
1092+
- type: "some-type
1093+
enabled: false
1094+
*/
1095+
if (LOGGER.isLoggable(System.Logger.Level.TRACE)) {
1096+
LOGGER.log(System.Logger.Level.TRACE, "Provider with key: " + pConf.key() + " is disabled");
1097+
}
1098+
return;
1099+
}
1100+
10851101
AtomicReference<SecurityProviderService> service = new AtomicReference<>();
10861102
AtomicReference<Config> providerSpecific = new AtomicReference<>();
10871103

@@ -1111,6 +1127,25 @@ private void providerFromConfig(Map<String, SecurityProviderService> configKeyTo
11111127
}
11121128

11131129
String name = resolveProviderName(pConf, className, providerSpecificConfig, providerService);
1130+
1131+
if (providerSpecificConfig != null && !providerSpecificConfig.get("enabled")
1132+
.asBoolean()
1133+
.orElse(true)) {
1134+
// this provider is marked as disabled, we will ignore it
1135+
// this is within the provider specific configuration, to support both simple lists (checked above)
1136+
// and nested provider configuration; this section check (example):
1137+
/*
1138+
security.providers:
1139+
- oidc:
1140+
enabled: false
1141+
*/
1142+
1143+
if (LOGGER.isLoggable(System.Logger.Level.TRACE)) {
1144+
LOGGER.log(System.Logger.Level.TRACE, "Provider: " + name + " is disabled");
1145+
}
1146+
return;
1147+
}
1148+
11141149
boolean isAuthn = pConf.get("is-authentication-provider").asBoolean().orElse(true);
11151150
boolean isAuthz = pConf.get("is-authorization-provider").asBoolean().orElse(true);
11161151
boolean isClientSec = pConf.get("is-client-security-provider").asBoolean().orElse(true);

‎tests/integration/mp-gh-8495/pom.xml

+68
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,68 @@
1+
<?xml version="1.0" encoding="UTF-8"?>
2+
<!--
3+
4+
Copyright (c) 2024 Oracle and/or its affiliates.
5+
6+
Licensed under the Apache License, Version 2.0 (the "License");
7+
you may not use this file except in compliance with the License.
8+
You may obtain a copy of the License at
9+
10+
http://www.apache.org/licenses/LICENSE-2.0
11+
12+
Unless required by applicable law or agreed to in writing, software
13+
distributed under the License is distributed on an "AS IS" BASIS,
14+
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
15+
See the License for the specific language governing permissions and
16+
limitations under the License.
17+
18+
-->
19+
<project xmlns="http://maven.apache.org/POM/4.0.0"
20+
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
21+
xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 https://maven.apache.org/xsd/maven-4.0.0.xsd">
22+
<parent>
23+
<groupId>io.helidon.tests.integration</groupId>
24+
<artifactId>helidon-tests-integration</artifactId>
25+
<version>4.0.0-SNAPSHOT</version>
26+
</parent>
27+
<modelVersion>4.0.0</modelVersion>
28+
29+
<artifactId>helidon-tests-integration-mp-gh-8495</artifactId>
30+
<name>Helidon Tests Integration MP GH 8495</name>
31+
<description>Reproducer for Github issue #8495 - SecurityCdiExtension fails with Oidc</description>
32+
33+
<dependencies>
34+
<dependency>
35+
<groupId>io.helidon.microprofile.server</groupId>
36+
<artifactId>helidon-microprofile-server</artifactId>
37+
</dependency>
38+
<dependency>
39+
<groupId>io.helidon.microprofile</groupId>
40+
<artifactId>helidon-microprofile-oidc</artifactId>
41+
</dependency>
42+
<dependency>
43+
<groupId>io.helidon.microprofile</groupId>
44+
<artifactId>helidon-microprofile-security</artifactId>
45+
</dependency>
46+
<dependency>
47+
<groupId>io.helidon.logging</groupId>
48+
<artifactId>helidon-logging-jul</artifactId>
49+
<scope>runtime</scope>
50+
</dependency>
51+
52+
<dependency>
53+
<groupId>org.junit.jupiter</groupId>
54+
<artifactId>junit-jupiter-api</artifactId>
55+
<scope>test</scope>
56+
</dependency>
57+
<dependency>
58+
<groupId>org.hamcrest</groupId>
59+
<artifactId>hamcrest-all</artifactId>
60+
<scope>test</scope>
61+
</dependency>
62+
<dependency>
63+
<groupId>io.helidon.microprofile.testing</groupId>
64+
<artifactId>helidon-microprofile-testing-junit5</artifactId>
65+
<scope>test</scope>
66+
</dependency>
67+
</dependencies>
68+
</project>

‎tests/integration/mp-gh-8495/src/main/java/io/helidon/tests/integration/gh8495/Gh8495Resource.java

+31
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
/*
2+
* Copyright (c) 2024 Oracle and/or its affiliates.
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* http://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*/
16+
17+
package io.helidon.tests.integration.gh8495;
18+
19+
import jakarta.ws.rs.GET;
20+
import jakarta.ws.rs.Path;
21+
import jakarta.ws.rs.Produces;
22+
import jakarta.ws.rs.core.MediaType;
23+
24+
@Path("/greet")
25+
public class Gh8495Resource {
26+
@GET
27+
@Produces(MediaType.TEXT_PLAIN)
28+
public String getDefaultMessage() {
29+
return "Hello World!";
30+
}
31+
}

‎tests/integration/mp-gh-8495/src/main/resources/META-INF/beans.xml

+25
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
<?xml version="1.0" encoding="UTF-8"?>
2+
<!--
3+
4+
Copyright (c) 2024 Oracle and/or its affiliates.
5+
6+
Licensed under the Apache License, Version 2.0 (the "License");
7+
you may not use this file except in compliance with the License.
8+
You may obtain a copy of the License at
9+
10+
http://www.apache.org/licenses/LICENSE-2.0
11+
12+
Unless required by applicable law or agreed to in writing, software
13+
distributed under the License is distributed on an "AS IS" BASIS,
14+
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
15+
See the License for the specific language governing permissions and
16+
limitations under the License.
17+
18+
-->
19+
<beans xmlns="https://jakarta.ee/xml/ns/jakartaee"
20+
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
21+
xsi:schemaLocation="https://jakarta.ee/xml/ns/jakartaee
22+
https://jakarta.ee/xml/ns/jakartaee/beans_4_0.xsd"
23+
version="4.0"
24+
bean-discovery-mode="annotated">
25+
</beans>

‎tests/integration/mp-gh-8495/src/main/resources/application.yaml

+20
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
#
2+
# Copyright (c) 2024 Oracle and/or its affiliates.
3+
#
4+
# Licensed under the Apache License, Version 2.0 (the "License");
5+
# you may not use this file except in compliance with the License.
6+
# You may obtain a copy of the License at
7+
#
8+
# http://www.apache.org/licenses/LICENSE-2.0
9+
#
10+
# Unless required by applicable law or agreed to in writing, software
11+
# distributed under the License is distributed on an "AS IS" BASIS,
12+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
# See the License for the specific language governing permissions and
14+
# limitations under the License.
15+
#
16+
17+
security:
18+
providers:
19+
- oidc:
20+
enabled: false

‎tests/integration/mp-gh-8495/src/main/resources/logging.properties

+23
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
#
2+
# Copyright (c) 2024 Oracle and/or its affiliates.
3+
#
4+
# Licensed under the Apache License, Version 2.0 (the "License");
5+
# you may not use this file except in compliance with the License.
6+
# You may obtain a copy of the License at
7+
#
8+
# http://www.apache.org/licenses/LICENSE-2.0
9+
#
10+
# Unless required by applicable law or agreed to in writing, software
11+
# distributed under the License is distributed on an "AS IS" BASIS,
12+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
# See the License for the specific language governing permissions and
14+
# limitations under the License.
15+
#
16+
17+
handlers=io.helidon.logging.jul.HelidonConsoleHandler
18+
java.util.logging.SimpleFormatter.format=%1$tY.%1$tm.%1$td %1$tH:%1$tM:%1$tS %4$s %3$s !thread!: %5$s%6$s%n
19+
20+
.level=WARNING
21+
22+
io.helidon.level=INFO
23+
io.helidon.security.level=FINEST

‎tests/integration/mp-gh-8495/src/test/java/io/helidon/tests/integration/gh8495/Gh8495Test.java

+46
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,46 @@
1+
/*
2+
* Copyright (c) 2024 Oracle and/or its affiliates.
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* http://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*/
16+
17+
package io.helidon.tests.integration.gh8495;
18+
19+
import io.helidon.microprofile.testing.junit5.HelidonTest;
20+
21+
import jakarta.inject.Inject;
22+
import jakarta.ws.rs.client.WebTarget;
23+
import org.junit.jupiter.api.Test;
24+
25+
import static org.hamcrest.CoreMatchers.is;
26+
import static org.hamcrest.MatcherAssert.assertThat;
27+
28+
@HelidonTest
29+
public class Gh8495Test {
30+
private final WebTarget target;
31+
32+
@Inject
33+
public Gh8495Test(WebTarget target) {
34+
this.target = target;
35+
}
36+
37+
@Test
38+
public void testServerStarted() {
39+
String response = target
40+
.path("/greet")
41+
.request()
42+
.get(String.class);
43+
44+
assertThat(response, is("Hello World!"));
45+
}
46+
}

‎tests/integration/pom.xml

+1
Original file line numberDiff line numberDiff line change
@@ -54,6 +54,7 @@
5454
<module>mp-gh-4654</module>
5555
<module>mp-gh-5328</module>
5656
<module>mp-gh-8478</module>
57+
<module>mp-gh-8495</module>
5758
<module>mp-graphql</module>
5859
<module>mp-security-client</module>
5960
<module>mp-ws-services</module>

0 commit comments

Comments
 (0)