Introduce Server Security JWT Support #322

brianwyka · 2021-02-22T17:37:29Z

Main Changes

Introduce new grpc-server-security-jwt module
Add latest Micronaut Security version
Supports role based security, however does not support @Secured annotation at this point

I've added a serverSecurity.adoc to document its usage.

Other Changes

Update to latest Micronaut version
Parameterize Micronaut Discovery Client version

Closes #164

brianwyka · 2021-02-22T17:40:01Z

grpc-server-security-jwt/build.gradle

+    api "com.nimbusds:nimbus-jose-jwt:9.4.2"
+
+    implementation("io.micronaut.security:micronaut-security-jwt:$micronautSecurityVersion") {
+        exclude group: 'io.micronaut', module: 'micronaut-http'


Decided to exclude the http dependencies since they are not used and might not be necessary on the classpath of consumers.

brianwyka · 2021-02-22T17:40:57Z

...java/io/micronaut/grpc/server/security/jwt/interceptor/GrpcServerSecurityJwtInterceptor.java

+        if (!jwtOptional.isPresent()) {
+            final String message = "JWT validation failed";
+            LOG.error(message);
+            throw Status.PERMISSION_DENIED.withDescription(message).asRuntimeException();


I'm open to also return Status.UNAUTHENTICATED here.

I made this configurable, but we can still discuss the default.

brianwyka · 2021-02-22T17:44:08Z

...java/io/micronaut/grpc/server/security/jwt/interceptor/GrpcServerSecurityJwtInterceptor.java

+            LOG.error(message);
+            throw Status.PERMISSION_DENIED.withDescription(message).asRuntimeException();
+        }
+        return new ForwardingServerCallListener.SimpleForwardingServerCallListener<T>(listener) { };


Should we add any additional metadata to denote that the user is authenticated?

gradle.properties

grpc-server-security-jwt/build.gradle

gradle.properties

brianwyka · 2021-03-02T19:19:34Z

Any feedback on this @jameskleeh @ilopmar @graemerocher ?

.../src/main/java/io/micronaut/grpc/server/security/jwt/GrpcServerSecurityJwtConfiguration.java

jameskleeh · 2021-03-02T19:24:56Z

...java/io/micronaut/grpc/server/security/jwt/interceptor/GrpcServerSecurityJwtInterceptor.java

+     */
+    @Override
+    public <T, S> ServerCall.Listener<T> interceptCall(final ServerCall<T, S> call, final Metadata metadata, final ServerCallHandler<T, S> next) {
+        final List<String> requiredAccesses = getRequiredAccesses(config, call);


Why is this not also using the SecurityRule API?

SecurityRule implies knowledge of HttpRequest and RouteMatch:
https://github.com/micronaut-projects/micronaut-security/blob/master/security/src/main/java/io/micronaut/security/rules/SecurityRule.java#L57

I don't have either of those in this context.

I was attempting to use the @Secured annotation, but failed since I didn't have RouteMatch accessible...

The SecurityRule API is also using ANT style patch matching, which wouldn't sync up with the GRPC method names. I'm using regex in this case.

@brianwyka OK makes sense. In that case I think a new API to support the same use cases should be created. It should in general work the same as the existing logic

Alright, I'll take a look into that. @jameskleeh should that new API live in this repository or in micronaut-security?

That is what I was thinking, @jameskleeh maybe there should be some MethodSecurityRule interface

Is there any way to get access to the potential @Secured annotation on the method as well?

I think I can model after the SecurityFilter approach. Create one high-level GrpcServerSecurityInterceptor and have all the method rules collected there and interrogated. Sound reasonable?

@graemerocher , @jameskleeh, I'm realizing there will be a fair amount of duplication due to coupling with HttpRequest unless there is some level of abstraction in micronaut-security, which would require breaking changes and a 3.0 release of that module.

Here is what I am thinking (demonstration of subset of changes):
https://github.com/micronaut-projects/micronaut-security/compare/master...brianwyka:security-abstraction?expand=1

Obviously, this does not encompass all changes, but just parameterizing some of the main interfaces and abstract classes can add a ton of reusability to this module. It may be even useful to have micronaut-security and micronaut-security-http separation...

Let me know if you would like me to move forward with a lot of duplication here or begin working on some abstractions and breaking changes in the security module.

I started to do some of the duplication in this repository... Here is the start of it: 7c676d0. I bypassed creating the generic token stuff and focused on just JWT for now. Thoughts?

…ality from micronaut-security

StephanePaulus · 2021-05-20T12:09:53Z

@brianwyka Any updates on this?

brianwyka · 2021-06-04T16:03:43Z

@StephanePaulus, waiting for feedback on design direction from Micronaut team. After that, happy to move forward with changes.

@jameskleeh, @graemerocher let me know if you have any recommendations based on my latest comments in this thread...

jameskleeh · 2021-06-04T16:23:30Z

@brianwyka I haven't forgot about this. I'll try to make it a priority next week

brianwyka · 2021-06-04T16:28:02Z

Thanks @jameskleeh. Let me know what you need from me. Happy to do the implementation as much as possible.

donbeave · 2022-11-03T09:12:14Z

@graemerocher @sdelamo @brianwyka This looks very useful feature, I have an interest in it for one of my projects. I think it can be nice to have it in the next major release. If needs any help with this PR, I can help to finish all work here.

graemerocher · 2022-11-03T10:59:09Z

@donbeave this would be a great contribution, from my understanding it requires changes on the Micronaut Security side. /cc @sdelamo

sdelamo · 2022-11-03T11:00:34Z

@donbeave this would be a great contribution, from my understanding it requires changes on the Micronaut Security side. /cc @sdelamo

We plan to decouple micronaut security from HttpRequest as much as possible in the next mayor version of Micronaut Security.

donbeave · 2022-11-03T11:43:51Z

@donbeave this would be a great contribution, from my understanding it requires changes on the Micronaut Security side. /cc @sdelamo

We plan to decouple micronaut security from HttpRequest as much as possible in the next mayor version of Micronaut Security.

@sdelamo maybe it's better for me to help you with decoupling first, as I'm using micronaut-security in GraphQL API, and it's not enough flexible, because it was designed around REST use cases. So if you need any help there, please let me know how you see that refactoring.

CLAassistant · 2024-02-07T21:34:13Z

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

CLAassistant · 2024-02-07T21:46:12Z

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

sdelamo · 2024-02-13T08:04:38Z

@donbeave this would be a great contribution, from my understanding it requires changes on the Micronaut Security side. /cc @sdelamo

We plan to decouple micronaut security from HttpRequest as much as possible in the next mayor version of Micronaut Security.

@sdelamo maybe it's better for me to help you with decoupling first, as I'm using micronaut-security in GraphQL API, and it's not enough flexible, because it was designed around REST use cases. So if you need any help there, please let me know how you see that refactoring.

@donbeave
Any help is welcome. We decoupled Micronaut Security almost completely from HTTP request. It is just the oauth2 module which is pending.

Initial server security JWT implementation

a291890

brianwyka mentioned this pull request Feb 22, 2021

Feature Request: Server Side JWT Security Support #164

Open

brianwyka commented Feb 22, 2021

View reviewed changes

brianwyka added 4 commits February 22, 2021 13:39

Fix spotless checks

6fdb743

Add more configurability and add documentation

f7a61b8

Add support for intercept method patterns

f344ddc

Checkstyle javadoc fix

8da6b58

graemerocher requested a review from jameskleeh February 23, 2021 08:20

ilopmar reviewed Feb 23, 2021

View reviewed changes

gradle.properties Outdated Show resolved Hide resolved

Add test protos and integration tests, fix gradle.properties SNAPSHOT

9483b80

brianwyka commented Feb 23, 2021

View reviewed changes

grpc-server-security-jwt/build.gradle Show resolved Hide resolved

graemerocher reviewed Feb 24, 2021

View reviewed changes

gradle.properties Outdated Show resolved Hide resolved

brianwyka added 2 commits February 24, 2021 11:26

Add role based security validation

3f1ea40

Spotless fixes

a065692

jameskleeh suggested changes Mar 2, 2021

View reviewed changes

brianwyka added 4 commits March 2, 2021 18:16

Update @requires to reference corresponding configurations

695fcdc

Reuse intercept-url-map from SecurityConfiguration

1143ca8

Cleanup imports

8cfb489

Add grpc-server-security module and duplicate some classes / function…

7c676d0

…ality from micronaut-security

timyates mentioned this pull request Nov 3, 2022

Introduce Server Security JWT Support #611

Draft

sdelamo assigned jeremyg484 Feb 28, 2024

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Introduce Server Security JWT Support #322

Introduce Server Security JWT Support #322

brianwyka commented Feb 22, 2021 •

edited

Loading

brianwyka Feb 22, 2021

brianwyka Feb 22, 2021

brianwyka Feb 23, 2021

brianwyka Feb 22, 2021

brianwyka commented Mar 2, 2021

jameskleeh Mar 2, 2021

brianwyka Mar 2, 2021

brianwyka Mar 2, 2021

jameskleeh Mar 2, 2021

brianwyka Mar 3, 2021 •

edited

Loading

graemerocher Mar 3, 2021

brianwyka Mar 3, 2021

brianwyka Mar 4, 2021

brianwyka Mar 4, 2021 •

edited

Loading

brianwyka Mar 5, 2021

StephanePaulus commented May 20, 2021

brianwyka commented Jun 4, 2021

jameskleeh commented Jun 4, 2021

brianwyka commented Jun 4, 2021

donbeave commented Nov 3, 2022

graemerocher commented Nov 3, 2022

sdelamo commented Nov 3, 2022

donbeave commented Nov 3, 2022

CLAassistant commented Feb 7, 2024

CLAassistant commented Feb 7, 2024

sdelamo commented Feb 13, 2024 •

edited

Loading

Introduce Server Security JWT Support #322

Are you sure you want to change the base?

Introduce Server Security JWT Support #322

Conversation

brianwyka commented Feb 22, 2021 • edited Loading

Main Changes

Other Changes

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

brianwyka commented Mar 2, 2021

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

brianwyka Mar 3, 2021 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

brianwyka Mar 4, 2021 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

StephanePaulus commented May 20, 2021

brianwyka commented Jun 4, 2021

jameskleeh commented Jun 4, 2021

brianwyka commented Jun 4, 2021

donbeave commented Nov 3, 2022

graemerocher commented Nov 3, 2022

sdelamo commented Nov 3, 2022

donbeave commented Nov 3, 2022

CLAassistant commented Feb 7, 2024

CLAassistant commented Feb 7, 2024

sdelamo commented Feb 13, 2024 • edited Loading

brianwyka commented Feb 22, 2021 •

edited

Loading

brianwyka Mar 3, 2021 •

edited

Loading

brianwyka Mar 4, 2021 •

edited

Loading

sdelamo commented Feb 13, 2024 •

edited

Loading