Skip to content

Switch JWT library implementations from cxf to nimbus#3421

Merged
DarshitChanpura merged 37 commits intoopensearch-project:mainfrom
MaciejMierzwa:nimbus-jose-jwt
Oct 24, 2023
Merged

Switch JWT library implementations from cxf to nimbus#3421
DarshitChanpura merged 37 commits intoopensearch-project:mainfrom
MaciejMierzwa:nimbus-jose-jwt

Conversation

@MaciejMierzwa
Copy link
Copy Markdown
Contributor

@MaciejMierzwa MaciejMierzwa commented Sep 28, 2023 •
edited by RyanL1997
Loading

Description

Switch from org.apache.cxf.rs.security.jose to com.nimbusds.jose.jwk.

Issues Resolved

#3267

Is this a backport? If so, please add backport PR # and/or commits #

Testing

[Please provide details of testing done: unit testing, integration testing and manual testing]

Check List

  • New functionality includes testing
  • New functionality has been documented
  • Commits are signed per the DCO using --signoff
  • Add a checkstyle rule to detect including references to org.apache.cxf.rs.security.jose
  • Remove all references to org.apache.cxf.rs.security.jose [15] files impacted
  • Replace all unfulfilled references with com.nimbusds.jose.* components
  • Add backwards combability tests for any features that have previously shipped

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.
For more information on following Developer Certificate of Origin and signing off your commits, please check here.

peternied and others added 4 commits August 29, 2023 22:27
@peternied
Replace JWT library with Nimbus Jose + JWT
1c75b4a 
Looking into an alternative library implementation for the JWT provider

Signed-off-by: Peter Nied <petern@amazon.com>
@MaciejMierzwa
Merge remote-tracking branch 'peternied/nimbus-jose-jwt'
e9e5457
@MaciejMierzwa
test jwt content
68fb56c 
Signed-off-by: Maciej Mierzwa <dev.maciej.mierzwa@gmail.com>
@MaciejMierzwa
swap cxf jwt to nimbus jwt
48658dd 
Signed-off-by: Maciej Mierzwa <dev.maciej.mierzwa@gmail.com>
@MaciejMierzwa MaciejMierzwa mentioned this pull request Sep 28, 2023
Closed
4 tasks
peternied
peternied reviewed Sep 28, 2023
View reviewed changes
@MaciejMierzwa
remove all usages of cxf.rs.security.jose
93c1bce 
Signed-off-by: Maciej Mierzwa <dev.maciej.mierzwa@gmail.com>
@codecov
Copy link
Copy Markdown

codecov bot commented Sep 29, 2023 •
edited
Loading

Codecov Report

Merging #3421 (9c667e4) into main (23359f6) will decrease coverage by 0.07%.
Report is 25 commits behind head on main.
The diff coverage is 78.26%.

Impacted file tree graph

@@             Coverage Diff              @@
##               main    #3421      +/-   ##
============================================
- Coverage     64.97%   64.90%   -0.07%     
+ Complexity     3638     3637       -1     
============================================
  Files           281      284       +3     
  Lines         20581    20618      +37     
  Branches       3398     3390       -8     
============================================
+ Hits          13372    13383      +11     
- Misses         5520     5553      +33     
+ Partials       1689     1682       -7
Files Coverage Δ
...ic/auth/http/jwt/AbstractHTTPJwtAuthenticator.java 59.77% <100.00%> (ø)
...zon/dlic/auth/http/saml/HTTPSamlAuthenticator.java 67.36% <ø> (-1.09%) ⬇️
.../dlic/auth/http/jwt/keybyoidc/KeySetRetriever.java 79.04% <33.33%> (-1.54%) ⬇️
...azon/dlic/auth/http/jwt/keybyoidc/JwtVerifier.java 79.62% <85.71%> (-9.05%) ⬇️
...nsearch/security/authtoken/jwt/KeyPaddingUtil.java 57.14% <57.14%> (ø)
.../auth/http/jwt/keybyoidc/SelfRefreshingKeySet.java 57.74% <58.33%> (-8.46%) ⬇️
...g/opensearch/security/authtoken/jwt/JwtVendor.java 88.13% <87.17%> (-8.84%) ⬇️
...dlic/auth/http/saml/AuthTokenProcessorHandler.java 50.28% <75.00%> (+3.87%) ⬆️

... and 31 files with indirect coverage changes

DarshitChanpura
DarshitChanpura reviewed Oct 2, 2023
View reviewed changes
@MaciejMierzwa
tests, encoding fixes
5fc3b8b 
Signed-off-by: Maciej Mierzwa <dev.maciej.mierzwa@gmail.com>
RyanL1997
RyanL1997 reviewed Oct 3, 2023
View reviewed changes
Copy link
Copy Markdown
Collaborator

@RyanL1997 RyanL1997 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hi @MaciejMierzwa, thanks for working on this. I know the pr is still in draft, and I just left some comment for now.

@MaciejMierzwa
naming, add padding to JwtVendor secret
1eb397c 
Signed-off-by: Maciej Mierzwa <dev.maciej.mierzwa@gmail.com>
@MaciejMierzwa
small refactor, spotless, tests, use raw settings to create jwk
9a2ef33 
Signed-off-by: Maciej Mierzwa <dev.maciej.mierzwa@gmail.com>
@MaciejMierzwa MaciejMierzwa marked this pull request as ready for review October 3, 2023 13:30
@MaciejMierzwa
Merge remote-tracking branch 'origin/main' into nimbus-jose-jwt
0ee2de6 
Signed-off-by: Maciej Mierzwa <dev.maciej.mierzwa@gmail.com>

# Conflicts:
#	src/main/java/org/opensearch/security/authtoken/jwt/JwtVendor.java
@MaciejMierzwa
Merge remote-tracking branch 'origin/main' into nimbus-jose-jwt
f52ca23 
# Conflicts:
#	src/main/java/com/amazon/dlic/auth/http/saml/AuthTokenProcessorHandler.java
@MaciejMierzwa
test build after merge
46eb723 
Signed-off-by: Maciej Mierzwa <dev.maciej.mierzwa@gmail.com>
@MaciejMierzwa
revert misc changes
10fe305 
Signed-off-by: Maciej Mierzwa <dev.maciej.mierzwa@gmail.com>
willyborankin
willyborankin reviewed Oct 4, 2023
View reviewed changes
Copy link
Copy Markdown
Collaborator

@willyborankin willyborankin left a comment •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Overall LGTM except some comments I left.
I think we need use LocalDateTime or DateTime or TimeUnit or ChronoUnit. To calculate expiration time for tokens.

@MaciejMierzwa
correct HMAC padding, escape chars in tests
da51bec 
Signed-off-by: Maciej Mierzwa <dev.maciej.mierzwa@gmail.com>
@MaciejMierzwa
PR changes, style
c151696 
Signed-off-by: Maciej Mierzwa <dev.maciej.mierzwa@gmail.com>
@MaciejMierzwa
remove org.apache.cxf:cxf-rt-rs-security-jose import, add rule forbid…
a597cf5 
…ding import

Signed-off-by: Maciej Mierzwa <dev.maciej.mierzwa@gmail.com>
@MaciejMierzwa
PR suggestions, null checks, java.util.Date
7e2c6ca 
Signed-off-by: Maciej Mierzwa <dev.maciej.mierzwa@gmail.com>
@RyanL1997
Refactor the matcher library
c899710 
Signed-off-by: Ryan Liang <jiallian@amazon.com>
@RyanL1997
Fix saml authenticator test
1d5fcb4 
Signed-off-by: Ryan Liang <jiallian@amazon.com>
@RyanL1997
Copy link
Copy Markdown
Collaborator

RyanL1997 commented Oct 20, 2023

Everything has been fixed.

RyanL1997 and others added 2 commits October 23, 2023 10:59
@RyanL1997
Add padding back but not for obo
2848560 
Signed-off-by: Ryan Liang <jiallian@amazon.com>
@MaciejMierzwa
test cxf, nimbus compability
c9fd75f 
Signed-off-by: Maciej Mierzwa <dev.maciej.mierzwa@gmail.com>
MaciejMierzwa and others added 5 commits October 24, 2023 16:27
@MaciejMierzwa
default encoding fix
4402b14 
Signed-off-by: Maciej Mierzwa <dev.maciej.mierzwa@gmail.com>
@MaciejMierzwa
default encoding fix
de31e00 
Signed-off-by: Maciej Mierzwa <dev.maciej.mierzwa@gmail.com>
@RyanL1997
Add tests and relocate KeyPaddingUtil
2bdd1de 
Signed-off-by: Ryan Liang <jiallian@amazon.com>
@RyanL1997
Add comment for cxf code generation
85d7eaa 
Signed-off-by: Ryan Liang <jiallian@amazon.com>
@RyanL1997
Reloacate the comment for cxf lib
2c2560b 
Signed-off-by: Ryan Liang <jiallian@amazon.com>
@RyanL1997
Copy link
Copy Markdown
Collaborator

RyanL1997 commented Oct 24, 2023 •
edited
Loading

looking into the failure of ci fixed

@RyanL1997
Fix testParsePrevGeneratedJwt()
78e94fa 
Signed-off-by: Ryan Liang <jiallian@amazon.com>
@RyanL1997
Fix the comment description
1004595 
Signed-off-by: Ryan Liang <jiallian@amazon.com>
peternied
peternied suggested changes Oct 24, 2023
View reviewed changes
@RyanL1997
Revert the changes for padding test config
9c667e4 
Signed-off-by: Ryan Liang <jiallian@amazon.com>
peternied
peternied approved these changes Oct 24, 2023
View reviewed changes
Copy link
Copy Markdown
Member

@peternied peternied left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for the answers, looks great @RyanL1997 & @MaciejMierzwa

DarshitChanpura
DarshitChanpura approved these changes Oct 24, 2023
View reviewed changes
Copy link
Copy Markdown
Member

@DarshitChanpura DarshitChanpura left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM!

@DarshitChanpura DarshitChanpura merged commit 4f89b4a into opensearch-project:main Oct 24, 2023
@opensearch-trigger-bot
Copy link
Copy Markdown
Contributor

opensearch-trigger-bot bot commented Oct 24, 2023

The backport to 2.x failed:

The process '/usr/bin/git' failed with exit code 128

To backport manually, run these commands in your terminal:

# Navigate to the root of your repository
cd $(git rev-parse --show-toplevel)
# Fetch latest updates from GitHub
git fetch
# Create a new working tree
git worktree add ../.worktrees/security/backport-2.x 2.x
# Navigate to the new working tree
pushd ../.worktrees/security/backport-2.x
# Create a new branch
git switch --create backport/backport-3421-to-2.x
# Cherry-pick the merged commit of this pull request and resolve the conflicts
git cherry-pick -x --mainline 1 4f89b4a782aee54a1c69460a30903b0d0d6b7565
# Push it to GitHub
git push --set-upstream origin backport/backport-3421-to-2.x
# Go back to the original working tree
popd
# Delete the working tree
git worktree remove ../.worktrees/security/backport-2.x

Then, create a pull request where the base branch is 2.x and the compare/head branch is backport/backport-3421-to-2.x.

RyanL1997 added a commit to RyanL1997/security that referenced this pull request Oct 24, 2023
@MaciejMierzwa @peternied @RyanL1997
Switch JWT library implementations from cxf to nimbus (opensearch-pro…
d83450d 
…ject#3421)

Switch from org.apache.cxf.rs.security.jose to com.nimbusds.jose.jwk.

Signed-off-by: Peter Nied <petern@amazon.com>
Signed-off-by: Maciej Mierzwa <dev.maciej.mierzwa@gmail.com>
Signed-off-by: Ryan Liang <jiallian@amazon.com>
Co-authored-by: Peter Nied <petern@amazon.com>
Co-authored-by: Ryan Liang <jiallian@amazon.com>
@RyanL1997
Copy link
Copy Markdown
Collaborator

RyanL1997 commented Oct 24, 2023

Manual backport has been created: #3595

@shikharj05 shikharj05 mentioned this pull request Jul 18, 2024
Closed
5 tasks
@cwperks cwperks mentioned this pull request Jul 18, 2024
Merged
5 tasks
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@RyanL1997 RyanL1997 RyanL1997 left review comments

@DarshitChanpura DarshitChanpura DarshitChanpura approved these changes

@willyborankin willyborankin willyborankin left review comments

@cwperks cwperks cwperks left review comments

@cliu123 cliu123 Awaiting requested review from cliu123

@davidlago davidlago Awaiting requested review from davidlago

@stephen-crawford stephen-crawford Awaiting requested review from stephen-crawford

@reta reta Awaiting requested review from reta reta is a code owner

+1 more reviewer

@peternied peternied peternied approved these changes

Reviewers whose approvals may not affect merge requirements

Assignees

@RyanL1997 RyanL1997

Labels

v2.12.0 Items targeting 2.12.0

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

6 participants

@MaciejMierzwa @peternied @RyanL1997 @willyborankin @cwperks @DarshitChanpura