diff --git a/src/main/java/org/alfresco/repo/security/authentication/token/AlfrescoBearerTokenRequestAuthenticator.java b/src/main/java/org/alfresco/repo/security/authentication/identityservice/AlfrescoBearerTokenRequestAuthenticator.java similarity index 94% rename from src/main/java/org/alfresco/repo/security/authentication/token/AlfrescoBearerTokenRequestAuthenticator.java rename to src/main/java/org/alfresco/repo/security/authentication/identityservice/AlfrescoBearerTokenRequestAuthenticator.java index 63f9749cf8..6c050bc9c4 100644 --- a/src/main/java/org/alfresco/repo/security/authentication/token/AlfrescoBearerTokenRequestAuthenticator.java +++ b/src/main/java/org/alfresco/repo/security/authentication/identityservice/AlfrescoBearerTokenRequestAuthenticator.java @@ -23,7 +23,7 @@ * along with Alfresco. If not, see . * #L% */ -package org.alfresco.repo.security.authentication.token; +package org.alfresco.repo.security.authentication.identityservice; import org.keycloak.adapters.BearerTokenRequestAuthenticator; import org.keycloak.adapters.KeycloakDeployment; diff --git a/src/main/java/org/alfresco/repo/security/authentication/token/AlfrescoKeycloakAdapterConfig.java b/src/main/java/org/alfresco/repo/security/authentication/identityservice/IdentityServiceConfig.java similarity index 81% rename from src/main/java/org/alfresco/repo/security/authentication/token/AlfrescoKeycloakAdapterConfig.java rename to src/main/java/org/alfresco/repo/security/authentication/identityservice/IdentityServiceConfig.java index f365910a6f..f62326b5fa 100644 --- a/src/main/java/org/alfresco/repo/security/authentication/token/AlfrescoKeycloakAdapterConfig.java +++ b/src/main/java/org/alfresco/repo/security/authentication/identityservice/IdentityServiceConfig.java @@ -23,7 +23,7 @@ * along with Alfresco. If not, see . * #L% */ -package org.alfresco.repo.security.authentication.token; +package org.alfresco.repo.security.authentication.identityservice; import java.util.Map; import java.util.Properties; @@ -34,12 +34,17 @@ import org.apache.commons.logging.LogFactory; import org.keycloak.representations.adapters.config.AdapterConfig; import org.springframework.beans.factory.InitializingBean; -public class AlfrescoKeycloakAdapterConfig extends AdapterConfig implements InitializingBean +/** + * Class to hold configuration for the Identity Service. + * + * @author Gavin Cornwell + */ +public class IdentityServiceConfig extends AdapterConfig implements InitializingBean { - private static Log logger = LogFactory.getLog(AlfrescoKeycloakAdapterConfig.class); + private static Log logger = LogFactory.getLog(IdentityServiceConfig.class); - private static final String CREDENTIALS_SECRET = "keycloak.credentials.secret"; - private static final String CREDENTIALS_PROVIDER = "keycloak.credentials.provider"; + private static final String CREDENTIALS_SECRET = "identity-service.credentials.secret"; + private static final String CREDENTIALS_PROVIDER = "identity-service.credentials.provider"; private Properties globalProperties; diff --git a/src/main/java/org/alfresco/repo/security/authentication/token/AlfrescoKeycloakDeploymentFactoryBean.java b/src/main/java/org/alfresco/repo/security/authentication/identityservice/IdentityServiceDeploymentFactoryBean.java similarity index 75% rename from src/main/java/org/alfresco/repo/security/authentication/token/AlfrescoKeycloakDeploymentFactoryBean.java rename to src/main/java/org/alfresco/repo/security/authentication/identityservice/IdentityServiceDeploymentFactoryBean.java index 4414b0aa0e..eb6760fce4 100644 --- a/src/main/java/org/alfresco/repo/security/authentication/token/AlfrescoKeycloakDeploymentFactoryBean.java +++ b/src/main/java/org/alfresco/repo/security/authentication/identityservice/IdentityServiceDeploymentFactoryBean.java @@ -23,35 +23,34 @@ * along with Alfresco. If not, see . * #L% */ -package org.alfresco.repo.security.authentication.token; +package org.alfresco.repo.security.authentication.identityservice; import org.apache.commons.logging.Log; import org.apache.commons.logging.LogFactory; import org.keycloak.adapters.KeycloakDeployment; import org.keycloak.adapters.KeycloakDeploymentBuilder; -import org.keycloak.representations.adapters.config.AdapterConfig; import org.springframework.beans.factory.FactoryBean; /** - * Creates an instance of a KeycloakDeployment object. + * Creates an instance of a KeycloakDeployment object for communicating with the Identity Service. * * @author Gavin Cornwell */ -public class AlfrescoKeycloakDeploymentFactoryBean implements FactoryBean +public class IdentityServiceDeploymentFactoryBean implements FactoryBean { - private static Log logger = LogFactory.getLog(AlfrescoKeycloakDeploymentFactoryBean.class); + private static Log logger = LogFactory.getLog(IdentityServiceDeploymentFactoryBean.class); - private AdapterConfig keycloakAdapterConfig; + private IdentityServiceConfig identityServiceConfig; - public void setAdapterConfig(AdapterConfig adapterConfig) + public void setIdentityServiceConfig(IdentityServiceConfig config) { - this.keycloakAdapterConfig = adapterConfig; + this.identityServiceConfig = config; } @Override public KeycloakDeployment getObject() throws Exception { - KeycloakDeployment deployment = KeycloakDeploymentBuilder.build(this.keycloakAdapterConfig); + KeycloakDeployment deployment = KeycloakDeploymentBuilder.build(this.identityServiceConfig); if (logger.isInfoEnabled()) { diff --git a/src/main/java/org/alfresco/repo/security/authentication/token/AlfrescoKeycloakHttpFacade.java b/src/main/java/org/alfresco/repo/security/authentication/identityservice/IdentityServiceHttpFacade.java similarity index 87% rename from src/main/java/org/alfresco/repo/security/authentication/token/AlfrescoKeycloakHttpFacade.java rename to src/main/java/org/alfresco/repo/security/authentication/identityservice/IdentityServiceHttpFacade.java index ebdb5050ec..aa0e477a2a 100644 --- a/src/main/java/org/alfresco/repo/security/authentication/token/AlfrescoKeycloakHttpFacade.java +++ b/src/main/java/org/alfresco/repo/security/authentication/identityservice/IdentityServiceHttpFacade.java @@ -23,7 +23,7 @@ * along with Alfresco. If not, see . * #L% */ -package org.alfresco.repo.security.authentication.token; +package org.alfresco.repo.security.authentication.identityservice; import java.io.ByteArrayOutputStream; import java.io.OutputStream; @@ -33,13 +33,13 @@ import javax.servlet.http.HttpServletRequest; import org.keycloak.adapters.servlet.ServletHttpFacade; /** - * Keycloak HttpFacade wrapper so we can re-use Keycloak authenticator classes. + * HttpFacade wrapper so we can re-use Keycloak authenticator classes. * * @author Gavin Cornwell */ -public class AlfrescoKeycloakHttpFacade extends ServletHttpFacade +public class IdentityServiceHttpFacade extends ServletHttpFacade { - public AlfrescoKeycloakHttpFacade(HttpServletRequest request) + public IdentityServiceHttpFacade(HttpServletRequest request) { super(request, null); } diff --git a/src/main/java/org/alfresco/repo/security/authentication/token/TokenRemoteUserMapper.java b/src/main/java/org/alfresco/repo/security/authentication/identityservice/IdentityServiceRemoteUserMapper.java similarity index 91% rename from src/main/java/org/alfresco/repo/security/authentication/token/TokenRemoteUserMapper.java rename to src/main/java/org/alfresco/repo/security/authentication/identityservice/IdentityServiceRemoteUserMapper.java index a636b1247d..37f2319b24 100644 --- a/src/main/java/org/alfresco/repo/security/authentication/token/TokenRemoteUserMapper.java +++ b/src/main/java/org/alfresco/repo/security/authentication/identityservice/IdentityServiceRemoteUserMapper.java @@ -23,7 +23,7 @@ * along with Alfresco. If not, see . * #L% */ -package org.alfresco.repo.security.authentication.token; +package org.alfresco.repo.security.authentication.identityservice; import javax.servlet.http.HttpServletRequest; @@ -41,13 +41,14 @@ import org.keycloak.adapters.spi.AuthOutcome; import org.keycloak.representations.AccessToken; /** - * A {@link RemoteUserMapper} implementation that detects and validates JWTs. + * A {@link RemoteUserMapper} implementation that detects and validates JWTs + * issued by the Alfresco Identity Service. * * @author Gavin Cornwell */ -public class TokenRemoteUserMapper implements RemoteUserMapper, ActivateableBean +public class IdentityServiceRemoteUserMapper implements RemoteUserMapper, ActivateableBean { - private static Log logger = LogFactory.getLog(TokenRemoteUserMapper.class); + private static Log logger = LogFactory.getLog(IdentityServiceRemoteUserMapper.class); /** Is the mapper enabled */ private boolean isEnabled; @@ -92,7 +93,7 @@ public class TokenRemoteUserMapper implements RemoteUserMapper, ActivateableBean this.personService = personService; } - public void setKeycloakDeployment(KeycloakDeployment deployment) + public void setIdentityServiceDeployment(KeycloakDeployment deployment) { this.keycloakDeployment = deployment; } @@ -149,7 +150,7 @@ public class TokenRemoteUserMapper implements RemoteUserMapper, ActivateableBean { String userName = null; - AlfrescoKeycloakHttpFacade facade = new AlfrescoKeycloakHttpFacade(request); + IdentityServiceHttpFacade facade = new IdentityServiceHttpFacade(request); // try authenticating with bearer token first if (logger.isDebugEnabled()) diff --git a/src/main/resources/alfresco/subsystems/Authentication/token/token-authentication-context.xml b/src/main/resources/alfresco/subsystems/Authentication/identity-service/identity-service-authentication-context.xml similarity index 65% rename from src/main/resources/alfresco/subsystems/Authentication/token/token-authentication-context.xml rename to src/main/resources/alfresco/subsystems/Authentication/identity-service/identity-service-authentication-context.xml index afba45e137..de0690b5df 100644 --- a/src/main/resources/alfresco/subsystems/Authentication/token/token-authentication-context.xml +++ b/src/main/resources/alfresco/subsystems/Authentication/identity-service/identity-service-authentication-context.xml @@ -70,139 +70,139 @@ - + - ${keycloak.realm} + ${identity-service.realm} - ${keycloak.realm-public-key:#{null}} + ${identity-service.realm-public-key:#{null}} - ${keycloak.auth-server-url} + ${identity-service.auth-server-url} - ${keycloak.ssl-required:external} + ${identity-service.ssl-required:external} - ${keycloak.confidential-port:0} + ${identity-service.confidential-port:0} - ${keycloak.resource} + ${identity-service.resource} - ${keycloak.use-resource-role-mappings:false} + ${identity-service.use-resource-role-mappings:false} - ${keycloak.enable-cors:false} + ${identity-service.enable-cors:false} - ${keycloak.cors-max-age:-1} + ${identity-service.cors-max-age:-1} - ${keycloak.cors-allowed-headers:#{null}} + ${identity-service.cors-allowed-headers:#{null}} - ${keycloak.cors-allowed-methods:#{null}} + ${identity-service.cors-allowed-methods:#{null}} - ${keycloak.cors-exposed-headers:#{null}} + ${identity-service.cors-exposed-headers:#{null}} - ${keycloak.expose-token:false} + ${identity-service.expose-token:false} - ${keycloak.bearer-only:false} + ${identity-service.bearer-only:false} - ${keycloak.autodetect-bearer-only:false} + ${identity-service.autodetect-bearer-only:false} - ${keycloak.enable-basic-auth:false} + ${identity-service.enable-basic-auth:false} - ${keycloak.public-client:false} + ${identity-service.public-client:false} - ${keycloak.allow-any-hostname:false} + ${identity-service.allow-any-hostname:false} - ${keycloak.disable-trust-manager:false} + ${identity-service.disable-trust-manager:false} - ${keycloak.truststore:#{null}} + ${identity-service.truststore:#{null}} - ${keycloak.truststore-password:#{null}} + ${identity-service.truststore-password:#{null}} - ${keycloak.client-keystore:#{null}} + ${identity-service.client-keystore:#{null}} - ${keycloak.client-keystore-password:#{null}} + ${identity-service.client-keystore-password:#{null}} - ${keycloak.client-key-password:#{null}} + ${identity-service.client-key-password:#{null}} - ${keycloak.connection-pool-size:20} + ${identity-service.connection-pool-size:20} - ${keycloak.always-refresh-token:false} + ${identity-service.always-refresh-token:false} - ${keycloak.register-node-at-startup:false} + ${identity-service.register-node-at-startup:false} - ${keycloak.register-node-period:-1} + ${identity-service.register-node-period:-1} - ${keycloak.token-store:#{null}} + ${identity-service.token-store:#{null}} - ${keycloak.principal-attribute:#{null}} + ${identity-service.principal-attribute:#{null}} - ${keycloak.turn-off-change-session-id-on-login:false} + ${identity-service.turn-off-change-session-id-on-login:false} - ${keycloak.token-minimum-time-to-live:0} + ${identity-service.token-minimum-time-to-live:0} - ${keycloak.min-time-between-jwks-requests:10} + ${identity-service.min-time-between-jwks-requests:10} - ${keycloak.public-key-cache-ttl:86400} + ${identity-service.public-key-cache-ttl:86400} - ${keycloak.enable-pkce:false} + ${identity-service.enable-pkce:false} - ${keycloak.ignore-oauth-query-parameter:false} + ${identity-service.ignore-oauth-query-parameter:false} - - - + + + - + - ${token.authentication.enabled} + ${identity-service.authentication.enabled} - ${token.authentication.validation.failure.silent} + ${identity-service.authentication.validation.failure.silent} - - + + diff --git a/src/main/resources/alfresco/subsystems/Authentication/identity-service/identity-service-authentication.properties b/src/main/resources/alfresco/subsystems/Authentication/identity-service/identity-service-authentication.properties new file mode 100644 index 0000000000..f582b977c3 --- /dev/null +++ b/src/main/resources/alfresco/subsystems/Authentication/identity-service/identity-service-authentication.properties @@ -0,0 +1,10 @@ +identity-service.authentication.enabled=true +identity-service.authentication.validation.failure.silent=true +identity-service.authentication.defaultAdministratorUserNames=admin + +# Identity Service configuration +identity-service.auth-server-url=http://localhost:8180/auth +identity-service.realm=springboot +identity-service.ssl-required=none +identity-service.resource=activiti +identity-service.public-client=true \ No newline at end of file diff --git a/src/main/resources/alfresco/subsystems/Authentication/token/token-authentication.properties b/src/main/resources/alfresco/subsystems/Authentication/token/token-authentication.properties deleted file mode 100644 index 22bd745473..0000000000 --- a/src/main/resources/alfresco/subsystems/Authentication/token/token-authentication.properties +++ /dev/null @@ -1,10 +0,0 @@ -token.authentication.enabled=true -token.authentication.validation.failure.silent=true -token.authentication.defaultAdministratorUserNames=admin - -# Keycloak configuration -keycloak.auth-server-url=http://localhost:8180/auth -keycloak.realm=springboot -keycloak.ssl-required=none -keycloak.resource=activiti -keycloak.public-client=true \ No newline at end of file diff --git a/src/test/java/org/alfresco/repo/security/SecurityTestSuite.java b/src/test/java/org/alfresco/repo/security/SecurityTestSuite.java index de311be4da..8528f923d1 100644 --- a/src/test/java/org/alfresco/repo/security/SecurityTestSuite.java +++ b/src/test/java/org/alfresco/repo/security/SecurityTestSuite.java @@ -37,8 +37,8 @@ import org.alfresco.repo.security.authentication.ResetPasswordServiceImplTest; import org.alfresco.repo.security.authentication.UpgradePasswordHashTest; import org.alfresco.repo.security.authentication.external.DefaultRemoteUserMapperTest; import org.alfresco.repo.security.authentication.external.LocalAuthenticationServiceTest; +import org.alfresco.repo.security.authentication.identityservice.IdentityServiceRemoteUserMapperTest; import org.alfresco.repo.security.authentication.subsystems.SubsystemChainingFtpAuthenticatorTest; -import org.alfresco.repo.security.authentication.token.TokenRemoteUserMapperTest; import org.alfresco.repo.security.authority.AuthorityBridgeTableAsynchronouslyRefreshedCacheTest; import org.alfresco.repo.security.authority.AuthorityServiceTest; import org.alfresco.repo.security.authority.DuplicateAuthorityTest; @@ -101,7 +101,7 @@ public class SecurityTestSuite extends TestSuite suite.addTestSuite(FixedAclUpdaterTest.class); suite.addTestSuite(DefaultRemoteUserMapperTest.class); - suite.addTestSuite(TokenRemoteUserMapperTest.class); + suite.addTestSuite(IdentityServiceRemoteUserMapperTest.class); suite.addTestSuite(SubsystemChainingFtpAuthenticatorTest.class); suite.addTest(new JUnit4TestAdapter(LocalAuthenticationServiceTest.class)); diff --git a/src/test/java/org/alfresco/repo/security/authentication/token/TokenRemoteUserMapperTest.java b/src/test/java/org/alfresco/repo/security/authentication/identityservice/IdentityServiceRemoteUserMapperTest.java similarity index 71% rename from src/test/java/org/alfresco/repo/security/authentication/token/TokenRemoteUserMapperTest.java rename to src/test/java/org/alfresco/repo/security/authentication/identityservice/IdentityServiceRemoteUserMapperTest.java index 6d6bac6062..de1c52d41a 100644 --- a/src/test/java/org/alfresco/repo/security/authentication/token/TokenRemoteUserMapperTest.java +++ b/src/test/java/org/alfresco/repo/security/authentication/identityservice/IdentityServiceRemoteUserMapperTest.java @@ -23,7 +23,7 @@ * along with Alfresco. If not, see . * #L% */ -package org.alfresco.repo.security.authentication.token; +package org.alfresco.repo.security.authentication.identityservice; import static org.mockito.Matchers.any; import static org.mockito.Mockito.mock; @@ -43,6 +43,7 @@ import org.alfresco.repo.management.subsystems.ChildApplicationContextFactory; import org.alfresco.repo.management.subsystems.DefaultChildApplicationContextManager; import org.alfresco.repo.security.authentication.AuthenticationException; import org.alfresco.repo.security.authentication.external.RemoteUserMapper; +import org.alfresco.repo.security.authentication.identityservice.IdentityServiceConfig; import org.alfresco.util.ApplicationContextHelper; import org.apache.http.HttpEntity; import org.apache.http.HttpResponse; @@ -57,14 +58,15 @@ import org.keycloak.representations.AccessToken; import org.springframework.context.ApplicationContext; /** - * Tests the token based authentication subsystem. + * Tests the Identity Service based authentication subsystem. * * @author Gavin Cornwell */ -public class TokenRemoteUserMapperTest extends AbstractChainedSubsystemTest +public class IdentityServiceRemoteUserMapperTest extends AbstractChainedSubsystemTest { private static final String REMOTE_USER_MAPPER_BEAN_NAME = "remoteUserMapper"; - private static final String KEYCLOAK_DEPLOYMENT_BEAN_NAME = "keycloakDeployment"; + private static final String DEPLOYMENT_BEAN_NAME = "identityServiceDeployment"; + private static final String CONFIG_BEAN_NAME = "identityServiceConfig"; private static final String TEST_USER_USERNAME = "testuser"; private static final String TEST_USER_EMAIL = "testuser@mail.com"; @@ -73,7 +75,7 @@ public class TokenRemoteUserMapperTest extends AbstractChainedSubsystemTest private static final String BEARER_PREFIX = "Bearer "; private static final String BASIC_PREFIX = "Basic "; - private static final String CONFIG_SILENT_ERRORS = "token.authentication.validation.failure.silent"; + private static final String CONFIG_SILENT_ERRORS = "identity-service.authentication.validation.failure.silent"; private static final String PASSWORD_GRANT_RESPONSE = "{" + "\"access_token\": \"%s\"," + @@ -89,7 +91,7 @@ public class TokenRemoteUserMapperTest extends AbstractChainedSubsystemTest ChildApplicationContextFactory childApplicationContextFactory; private KeyPair keyPair; - private AlfrescoKeycloakAdapterConfig keycloakAdapterConfig; + private IdentityServiceConfig identityServiceConfig; /* (non-Javadoc) * @see junit.framework.TestCase#setUp() @@ -100,18 +102,18 @@ public class TokenRemoteUserMapperTest extends AbstractChainedSubsystemTest // switch authentication to use token auth childApplicationContextManager = (DefaultChildApplicationContextManager) ctx.getBean("Authentication"); childApplicationContextManager.stop(); - childApplicationContextManager.setProperty("chain", "token1:token"); - childApplicationContextFactory = getChildApplicationContextFactory(childApplicationContextManager, "token1"); + childApplicationContextManager.setProperty("chain", "identity-service1:identity-service"); + childApplicationContextFactory = getChildApplicationContextFactory(childApplicationContextManager, "identity-service1"); // generate keys for test this.keyPair = KeyPairGenerator.getInstance("RSA").generateKeyPair(); - // hardcode the realm public key in the Keycloak deployment bean to stop it fetching keys + // hardcode the realm public key in the deployment bean to stop it fetching keys applyHardcodedPublicKey(this.keyPair.getPublic()); // extract config - this.keycloakAdapterConfig = (AlfrescoKeycloakAdapterConfig)childApplicationContextFactory. - getApplicationContext().getBean("keycloakAdpapterConfig"); + this.identityServiceConfig = (IdentityServiceConfig)childApplicationContextFactory. + getApplicationContext().getBean(CONFIG_BEAN_NAME); } /* (non-Javadoc) @@ -128,13 +130,13 @@ public class TokenRemoteUserMapperTest extends AbstractChainedSubsystemTest public void testKeycloakConfig() throws Exception { // check string overrides - assertEquals("keycloak.auth-server-url", "http://192.168.0.1:8180/auth", - this.keycloakAdapterConfig.getAuthServerUrl()); + assertEquals("identity-service.auth-server-url", "http://192.168.0.1:8180/auth", + this.identityServiceConfig.getAuthServerUrl()); - assertEquals("keycloak.realm", "test", - this.keycloakAdapterConfig.getRealm()); + assertEquals("identity-service.realm", "test", + this.identityServiceConfig.getRealm()); - assertEquals("keycloak.realm-public-key", + assertEquals("identity-service.realm-public-key", "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAvWLQxipXNe6cLnVPGy7l" + "BgyR51bDiK7Jso8Rmh2TB+bmO4fNaMY1ETsxECSM0f6NTV0QHks9+gBe+pB6JNeM" + "uPmaE/M/MsE9KUif9L2ChFq3zor6s2foFv2DTiTkij+1aQF9fuIjDNH4FC6L252W" + @@ -142,117 +144,117 @@ public class TokenRemoteUserMapperTest extends AbstractChainedSubsystemTest "P6W8xMP0PoEJNAAp79anz2jk2HP2PvC2qdjVsphdTk3JG5qQMB0WJUh4Kjgabd4j" + "QJ77U8gTRswKgNHRRPWhruiIcmmkP+zI0ozNW6rxH3PF4L7M9rXmfcmUcBcKf+Yx" + "jwIDAQAB", - this.keycloakAdapterConfig.getRealmKey()); + this.identityServiceConfig.getRealmKey()); - assertEquals("keycloak.ssl-required", "external", - this.keycloakAdapterConfig.getSslRequired()); + assertEquals("identity-service.ssl-required", "external", + this.identityServiceConfig.getSslRequired()); - assertEquals("keycloak.resource", "test", - this.keycloakAdapterConfig.getResource()); + assertEquals("identity-service.resource", "test", + this.identityServiceConfig.getResource()); - assertEquals("keycloak.cors-allowed-headers", "Authorization", - this.keycloakAdapterConfig.getCorsAllowedHeaders()); + assertEquals("identity-service.cors-allowed-headers", "Authorization", + this.identityServiceConfig.getCorsAllowedHeaders()); - assertEquals("keycloak.cors-allowed-methods", "POST, PUT, DELETE, GET", - this.keycloakAdapterConfig.getCorsAllowedMethods()); + assertEquals("identity-service.cors-allowed-methods", "POST, PUT, DELETE, GET", + this.identityServiceConfig.getCorsAllowedMethods()); - assertEquals("keycloak.cors-exposed-headers", "WWW-Authenticate, My-custom-exposed-Header", - this.keycloakAdapterConfig.getCorsExposedHeaders()); + assertEquals("identity-service.cors-exposed-headers", "WWW-Authenticate, My-custom-exposed-Header", + this.identityServiceConfig.getCorsExposedHeaders()); - assertEquals("keycloak.truststore", - "classpath:/alfresco/subsystems/tokenAuthentication/keystore.jks", - this.keycloakAdapterConfig.getTruststore()); + assertEquals("identity-service.truststore", + "classpath:/alfresco/subsystems/identityServiceAuthentication/keystore.jks", + this.identityServiceConfig.getTruststore()); - assertEquals("keycloak.truststore-password", "password", - this.keycloakAdapterConfig.getTruststorePassword()); + assertEquals("identity-service.truststore-password", "password", + this.identityServiceConfig.getTruststorePassword()); - assertEquals("keycloak.client-keystore", - "classpath:/alfresco/subsystems/tokenAuthentication/keystore.jks", - this.keycloakAdapterConfig.getClientKeystore()); + assertEquals("identity-service.client-keystore", + "classpath:/alfresco/subsystems/identityServiceAuthentication/keystore.jks", + this.identityServiceConfig.getClientKeystore()); - assertEquals("keycloak.client-keystore-password", "password", - this.keycloakAdapterConfig.getClientKeystorePassword()); + assertEquals("identity-service.client-keystore-password", "password", + this.identityServiceConfig.getClientKeystorePassword()); - assertEquals("keycloak.client-key-password", "password", - this.keycloakAdapterConfig.getClientKeyPassword()); + assertEquals("identity-service.client-key-password", "password", + this.identityServiceConfig.getClientKeyPassword()); - assertEquals("keycloak.token-store", "SESSION", - this.keycloakAdapterConfig.getTokenStore()); + assertEquals("identity-service.token-store", "SESSION", + this.identityServiceConfig.getTokenStore()); - assertEquals("keycloak.principal-attribute", "preferred_username", - this.keycloakAdapterConfig.getPrincipalAttribute()); + assertEquals("identity-service.principal-attribute", "preferred_username", + this.identityServiceConfig.getPrincipalAttribute()); // check number overrides - assertEquals("keycloak.confidential-port", 100, - this.keycloakAdapterConfig.getConfidentialPort()); + assertEquals("identity-service.confidential-port", 100, + this.identityServiceConfig.getConfidentialPort()); - assertEquals("keycloak.cors-max-age", 1000, - this.keycloakAdapterConfig.getCorsMaxAge()); + assertEquals("identity-service.cors-max-age", 1000, + this.identityServiceConfig.getCorsMaxAge()); - assertEquals("keycloak.connection-pool-size", 5, - this.keycloakAdapterConfig.getConnectionPoolSize()); + assertEquals("identity-service.connection-pool-size", 5, + this.identityServiceConfig.getConnectionPoolSize()); - assertEquals("keycloak.register-node-period", 50, - this.keycloakAdapterConfig.getRegisterNodePeriod()); + assertEquals("identity-service.register-node-period", 50, + this.identityServiceConfig.getRegisterNodePeriod()); - assertEquals("keycloak.token-minimum-time-to-live", 10, - this.keycloakAdapterConfig.getTokenMinimumTimeToLive()); + assertEquals("identity-service.token-minimum-time-to-live", 10, + this.identityServiceConfig.getTokenMinimumTimeToLive()); - assertEquals("keycloak.min-time-between-jwks-requests", 60, - this.keycloakAdapterConfig.getMinTimeBetweenJwksRequests()); + assertEquals("identity-service.min-time-between-jwks-requests", 60, + this.identityServiceConfig.getMinTimeBetweenJwksRequests()); - assertEquals("keycloak.public-key-cache-ttl", 3600, - this.keycloakAdapterConfig.getPublicKeyCacheTtl()); + assertEquals("identity-service.public-key-cache-ttl", 3600, + this.identityServiceConfig.getPublicKeyCacheTtl()); // check boolean overrides - assertFalse("keycloak.public-client", - this.keycloakAdapterConfig.isPublicClient()); + assertFalse("identity-service.public-client", + this.identityServiceConfig.isPublicClient()); - assertTrue("keycloak.use-resource-role-mappings", - this.keycloakAdapterConfig.isUseResourceRoleMappings()); + assertTrue("identity-service.use-resource-role-mappings", + this.identityServiceConfig.isUseResourceRoleMappings()); - assertTrue("keycloak.enable-cors", - this.keycloakAdapterConfig.isCors()); + assertTrue("identity-service.enable-cors", + this.identityServiceConfig.isCors()); - assertTrue("keycloak.expose-token", - this.keycloakAdapterConfig.isExposeToken()); + assertTrue("identity-service.expose-token", + this.identityServiceConfig.isExposeToken()); - assertTrue("keycloak.bearer-only", - this.keycloakAdapterConfig.isBearerOnly()); + assertTrue("identity-service.bearer-only", + this.identityServiceConfig.isBearerOnly()); - assertTrue("keycloak.autodetect-bearer-only", - this.keycloakAdapterConfig.isAutodetectBearerOnly()); + assertTrue("identity-service.autodetect-bearer-only", + this.identityServiceConfig.isAutodetectBearerOnly()); - assertTrue("keycloak.enable-basic-auth", - this.keycloakAdapterConfig.isEnableBasicAuth()); + assertTrue("identity-service.enable-basic-auth", + this.identityServiceConfig.isEnableBasicAuth()); - assertTrue("keycloak.allow-any-hostname", - this.keycloakAdapterConfig.isAllowAnyHostname()); + assertTrue("identity-service.allow-any-hostname", + this.identityServiceConfig.isAllowAnyHostname()); - assertTrue("keycloak.disable-trust-manager", - this.keycloakAdapterConfig.isDisableTrustManager()); + assertTrue("identity-service.disable-trust-manager", + this.identityServiceConfig.isDisableTrustManager()); - assertTrue("keycloak.always-refresh-token", - this.keycloakAdapterConfig.isAlwaysRefreshToken()); + assertTrue("identity-service.always-refresh-token", + this.identityServiceConfig.isAlwaysRefreshToken()); - assertTrue("keycloak.register-node-at-startup", - this.keycloakAdapterConfig.isRegisterNodeAtStartup()); + assertTrue("identity-service.register-node-at-startup", + this.identityServiceConfig.isRegisterNodeAtStartup()); - assertTrue("keycloak.enable-pkce", - this.keycloakAdapterConfig.isPkce()); + assertTrue("identity-service.enable-pkce", + this.identityServiceConfig.isPkce()); - assertTrue("keycloak.ignore-oauth-query-parameter", - this.keycloakAdapterConfig.isIgnoreOAuthQueryParameter()); + assertTrue("identity-service.ignore-oauth-query-parameter", + this.identityServiceConfig.isIgnoreOAuthQueryParameter()); - assertTrue("keycloak.turn-off-change-session-id-on-login", - this.keycloakAdapterConfig.getTurnOffChangeSessionIdOnLogin()); + assertTrue("identity-service.turn-off-change-session-id-on-login", + this.identityServiceConfig.getTurnOffChangeSessionIdOnLogin()); // check credentials overrides - Map credentials = this.keycloakAdapterConfig.getCredentials(); + Map credentials = this.identityServiceConfig.getCredentials(); assertNotNull("Expected a credentials map", credentials); assertFalse("Expected to retrieve a populated credentials map", credentials.isEmpty()); - assertEquals("keycloak.credentials.secret", "11111", credentials.get("secret")); - assertEquals("keycloak.credentials.provider", "secret", credentials.get("provider")); + assertEquals("identity-service.credentials.secret", "11111", credentials.get("secret")); + assertEquals("identity-service.credentials.provider", "secret", credentials.get("provider")); } public void testValidToken() throws Exception @@ -390,7 +392,7 @@ public class TokenRemoteUserMapperTest extends AbstractChainedSubsystemTest // override the http client on the keycloak deployment KeycloakDeployment deployment = (KeycloakDeployment)childApplicationContextFactory.getApplicationContext(). - getBean(KEYCLOAK_DEPLOYMENT_BEAN_NAME); + getBean(DEPLOYMENT_BEAN_NAME); deployment.setClient(mockHttpClient); // validate correct user was found @@ -474,7 +476,7 @@ public class TokenRemoteUserMapperTest extends AbstractChainedSubsystemTest */ private String generateToken(boolean expired) throws Exception { - String issuerUrl = this.keycloakAdapterConfig.getAuthServerUrl() + "/realms/" + this.keycloakAdapterConfig.getRealm(); + String issuerUrl = this.identityServiceConfig.getAuthServerUrl() + "/realms/" + this.identityServiceConfig.getRealm(); AccessToken token = new AccessToken(); token.type("Bearer"); @@ -505,7 +507,7 @@ public class TokenRemoteUserMapperTest extends AbstractChainedSubsystemTest private void applyHardcodedPublicKey(PublicKey publicKey) { KeycloakDeployment deployment = (KeycloakDeployment)childApplicationContextFactory.getApplicationContext(). - getBean(KEYCLOAK_DEPLOYMENT_BEAN_NAME); + getBean(DEPLOYMENT_BEAN_NAME); HardcodedPublicKeyLocator publicKeyLocator = new HardcodedPublicKeyLocator(publicKey); deployment.setPublicKeyLocator(publicKeyLocator); } diff --git a/src/test/resources/alfresco-global.properties b/src/test/resources/alfresco-global.properties index 68878bf0aa..5db5e87f2d 100644 --- a/src/test/resources/alfresco-global.properties +++ b/src/test/resources/alfresco-global.properties @@ -1,45 +1,45 @@ -# Test token authentication overrides -keycloak.auth-server-url=http://192.168.0.1:8180/auth -keycloak.realm=test -keycloak.realm-public-key=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAvWLQxipXNe6cLnVPGy7l\ +# Test identity service authentication overrides +identity-service.auth-server-url=http://192.168.0.1:8180/auth +identity-service.realm=test +identity-service.realm-public-key=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAvWLQxipXNe6cLnVPGy7l\ BgyR51bDiK7Jso8Rmh2TB+bmO4fNaMY1ETsxECSM0f6NTV0QHks9+gBe+pB6JNeM\ uPmaE/M/MsE9KUif9L2ChFq3zor6s2foFv2DTiTkij+1aQF9fuIjDNH4FC6L252W\ ydZzh+f73Xuy5evdPj+wrPYqWyP7sKd+4Q9EIILWAuTDvKEjwyZmIyfM/nUn6ltD\ P6W8xMP0PoEJNAAp79anz2jk2HP2PvC2qdjVsphdTk3JG5qQMB0WJUh4Kjgabd4j\ QJ77U8gTRswKgNHRRPWhruiIcmmkP+zI0ozNW6rxH3PF4L7M9rXmfcmUcBcKf+Yx\ jwIDAQAB -keycloak.ssl-required=external -keycloak.resource=test -keycloak.public-client=false -keycloak.confidential-port=100 -keycloak.use-resource-role-mappings=true -keycloak.enable-cors=true -keycloak.cors-max-age=1000 -keycloak.cors-allowed-headers=Authorization -keycloak.cors-allowed-methods=POST, PUT, DELETE, GET -keycloak.cors-exposed-headers=WWW-Authenticate, My-custom-exposed-Header -keycloak.expose-token=true -keycloak.bearer-only=true -keycloak.autodetect-bearer-only=true -keycloak.enable-basic-auth=true -keycloak.allow-any-hostname=true -keycloak.disable-trust-manager=true -keycloak.truststore=classpath:/alfresco/subsystems/tokenAuthentication/keystore.jks -keycloak.truststore-password=password -keycloak.client-keystore=classpath:/alfresco/subsystems/tokenAuthentication/keystore.jks -keycloak.client-keystore-password=password -keycloak.client-key-password=password -keycloak.connection-pool-size=5 -keycloak.always-refresh-token=true -keycloak.register-node-at-startup=true -keycloak.register-node-period=50 -keycloak.token-store=SESSION -keycloak.principal-attribute=preferred_username -keycloak.turn-off-change-session-id-on-login=true -keycloak.token-minimum-time-to-live=10 -keycloak.min-time-between-jwks-requests=60 -keycloak.public-key-cache-ttl=3600 -keycloak.enable-pkce=true -keycloak.ignore-oauth-query-parameter=true -keycloak.credentials.secret=11111 -keycloak.credentials.provider=secret \ No newline at end of file +identity-service.ssl-required=external +identity-service.resource=test +identity-service.public-client=false +identity-service.confidential-port=100 +identity-service.use-resource-role-mappings=true +identity-service.enable-cors=true +identity-service.cors-max-age=1000 +identity-service.cors-allowed-headers=Authorization +identity-service.cors-allowed-methods=POST, PUT, DELETE, GET +identity-service.cors-exposed-headers=WWW-Authenticate, My-custom-exposed-Header +identity-service.expose-token=true +identity-service.bearer-only=true +identity-service.autodetect-bearer-only=true +identity-service.enable-basic-auth=true +identity-service.allow-any-hostname=true +identity-service.disable-trust-manager=true +identity-service.truststore=classpath:/alfresco/subsystems/identityServiceAuthentication/keystore.jks +identity-service.truststore-password=password +identity-service.client-keystore=classpath:/alfresco/subsystems/identityServiceAuthentication/keystore.jks +identity-service.client-keystore-password=password +identity-service.client-key-password=password +identity-service.connection-pool-size=5 +identity-service.always-refresh-token=true +identity-service.register-node-at-startup=true +identity-service.register-node-period=50 +identity-service.token-store=SESSION +identity-service.principal-attribute=preferred_username +identity-service.turn-off-change-session-id-on-login=true +identity-service.token-minimum-time-to-live=10 +identity-service.min-time-between-jwks-requests=60 +identity-service.public-key-cache-ttl=3600 +identity-service.enable-pkce=true +identity-service.ignore-oauth-query-parameter=true +identity-service.credentials.secret=11111 +identity-service.credentials.provider=secret \ No newline at end of file diff --git a/src/test/resources/alfresco/subsystems/tokenAuthentication/keystore.jks b/src/test/resources/alfresco/subsystems/identityServiceAuthentication/keystore.jks similarity index 100% rename from src/test/resources/alfresco/subsystems/tokenAuthentication/keystore.jks rename to src/test/resources/alfresco/subsystems/identityServiceAuthentication/keystore.jks diff --git a/src/test/resources/log4j.properties b/src/test/resources/log4j.properties index 0e6c8e9dbd..75821cfaa3 100644 --- a/src/test/resources/log4j.properties +++ b/src/test/resources/log4j.properties @@ -255,6 +255,6 @@ log4j.logger.org.alfresco.repo.site.SiteServiceImpl=DEBUG log4j.logger.org.alfresco.repo.action.ActionServiceImpl=DEBUG log4j.logger.org.alfresco.repo.security.person.PersonServiceImpl=DEBUG -# token authentication -log4j.logger.org.alfresco.repo.security.authentication.token=debug +# identity service authentication +log4j.logger.org.alfresco.repo.security.authentication.identityservice=debug log4j.logger.org.keycloak=debug \ No newline at end of file