Cb 4389 convert reverse proxy

server/bundles/io.cloudbeaver.service.auth/plugin.xml

@@ -7,6 +7,9 @@
         <service id="auth" label="User authentication" description="User authentication services" class="io.cloudbeaver.service.auth.WebServiceBindingAuth">
 
         </service>
+        <service id="reverse.configurator" label="Reverse Proxy Configurator" description="Reverse proxy configurator"
+                 class="io.cloudbeaver.service.auth.ReverseProxyConfigurator">
+        </service>
     </extension>
     <extension point="io.cloudbeaver.handler">
         <sessionHandler id="RPSessionHandler" class="io.cloudbeaver.service.auth.RPSessionHandler"/>

server/bundles/io.cloudbeaver.service.auth/src/io/cloudbeaver/service/auth/RPConstants.java

@@ -0,0 +1,10 @@
+package io.cloudbeaver.service.auth;
+
+interface RPConstants {
+    String PARAM_LOGOUT_URL = "logout-url-header";
+    String PARAM_USER = "user-header";
+    String PARAM_TEAM = "team-header";
+    String PARAM_FIRST_NAME = "first-name-header";
+    String PARAM_LAST_NAME = "last-name-header";
+    String PARAM_ROLE_NAME = "role-header";
+}

server/bundles/io.cloudbeaver.service.auth/src/io/cloudbeaver/service/auth/RPSessionHandler.java

@@ -31,6 +31,7 @@
 import org.jkiss.dbeaver.DBException;
 import org.jkiss.dbeaver.Log;
 import org.jkiss.dbeaver.model.auth.SMAuthInfo;
+import org.jkiss.dbeaver.model.security.SMAuthProviderCustomConfiguration;
 import org.jkiss.dbeaver.model.security.SMConstants;
 import org.jkiss.dbeaver.model.security.SMController;
 import org.jkiss.dbeaver.model.security.SMStandardMeta;
@@ -62,22 +63,38 @@
         return false;
     }
 
-    public void reverseProxyAuthentication(@NotNull HttpServletRequest request, @NotNull WebSession webSession) throws DBWebException {
+    public void reverseProxyAuthentication(@NotNull HttpServletRequest request, @NotNull WebSession webSession) throws DBException {
         SMController securityController = webSession.getSecurityController();
         WebAuthProviderDescriptor authProvider = WebAuthProviderRegistry.getInstance().getAuthProvider(RPAuthProvider.AUTH_PROVIDER);
         if (authProvider == null) {
             throw new DBWebException("Auth provider " + RPAuthProvider.AUTH_PROVIDER + " not found");
         }
         SMAuthProviderExternal<?> authProviderExternal = (SMAuthProviderExternal<?>) authProvider.getInstance();
-        String userName = request.getHeader(RPAuthProvider.X_USER);
-        String teams = request.getHeader(RPAuthProvider.X_TEAM);
+        SMAuthProviderCustomConfiguration configuration = WebAppUtils.getWebAuthApplication()
+            .getAuthConfiguration()
+            .getAuthCustomConfigurations()
+            .stream()
+            .filter(p -> p.getProvider().equals(authProvider.toString()))
+            .findFirst()
+            .orElse(null);
+        Map<String, Object> paramConfigMap = new HashMap<>();
+        if (configuration != null) {
+            authProvider.getConfigurationParameters().forEach(p ->
+                paramConfigMap.put(p.getId(), configuration.getParameters().get(p.getId())
+                ));
+        }
+        String userName = request.getHeader(
+            resolveParam(paramConfigMap.get(RPConstants.PARAM_USER), RPAuthProvider.X_USER)
+        );
+        String teams = request.getHeader(resolveParam(paramConfigMap.get(RPConstants.PARAM_TEAM), RPAuthProvider.X_TEAM));
         if (CommonUtils.isEmpty(teams)) {
             // backward compatibility
             teams = request.getHeader(RPAuthProvider.X_ROLE);
         }
-        String role = request.getHeader(RPAuthProvider.X_ROLE_TE);
-        String firstName = request.getHeader(RPAuthProvider.X_FIRST_NAME);
-        String lastName = request.getHeader(RPAuthProvider.X_LAST_NAME);
+        String role = request.getHeader(resolveParam(paramConfigMap.get(RPConstants.PARAM_ROLE_NAME), RPAuthProvider.X_ROLE_TE));
+        String firstName = request.getHeader(resolveParam(paramConfigMap.get(RPConstants.PARAM_FIRST_NAME), RPAuthProvider.X_FIRST_NAME));
+        String lastName = request.getHeader(resolveParam(paramConfigMap.get(RPConstants.PARAM_LAST_NAME), RPAuthProvider.X_LAST_NAME));
+        String logoutUrl = request.getHeader(resolveParam(paramConfigMap.get(RPConstants.PARAM_LOGOUT_URL), RPAuthProvider.X_LOGOUT_URL));
         List<String> userTeams = teams == null ? Collections.emptyList() : List.of(teams.split("\\|"));
         if (userName != null) {
             try {
@@ -92,6 +109,7 @@
                 Map<String, Object> sessionParameters = webSession.getSessionParameters();
                 sessionParameters.put(SMConstants.SESSION_PARAM_TRUSTED_USER_TEAMS, userTeams);
                 sessionParameters.put(SMConstants.SESSION_PARAM_TRUSTED_USER_ROLE, role);
+                sessionParameters.put(SMConstants.SESSION_PARAM_LOGOUT_URL, logoutUrl);
                 Map<String, Object> userCredentials = authProviderExternal.authExternalUser(
                     webSession.getProgressMonitor(), null, credentials);
                 String currentSmSessionId = webSession.getUser() == null ? null : webSession.getUserContext().getSmSessionId();
@@ -120,4 +138,11 @@
     public boolean handleSessionClose(WebSession webSession) throws DBException, IOException {
         return false;
     }
+
+    private String resolveParam(Object value, String defaultValue) {
+        if (value != null && !value.toString().isEmpty()) {
+            return value.toString();
+        }
+        return defaultValue;
+    }
 }

server/bundles/io.cloudbeaver.service.auth/src/io/cloudbeaver/service/auth/ReverseProxyConfigurator.java

@@ -0,0 +1,96 @@
+package io.cloudbeaver.service.auth;
+
+import io.cloudbeaver.auth.provider.rp.RPAuthProvider;
+import io.cloudbeaver.model.app.WebAppConfiguration;
+import io.cloudbeaver.model.app.WebApplication;
+import io.cloudbeaver.model.app.WebAuthApplication;
+import io.cloudbeaver.model.session.WebSession;
+import io.cloudbeaver.service.DBWServiceServerConfigurator;
+import org.jkiss.code.NotNull;
+import org.jkiss.code.Nullable;
+import org.jkiss.dbeaver.DBException;
+import org.jkiss.dbeaver.Log;
+import org.jkiss.dbeaver.model.security.SMAuthProviderCustomConfiguration;
+
+import java.util.HashMap;
+import java.util.Map;
+
+public class ReverseProxyConfigurator implements DBWServiceServerConfigurator {
+    private static final Log log = Log.getLog(ReverseProxyConfigurator.class);
+
+    @Override
+    public void configureServer(
+        @NotNull WebApplication application,
+        @Nullable WebSession session,
+        @NotNull WebAppConfiguration appConfig
+    ) throws DBException {
+    }
+
+    @Override
+    public void migrateConfigurationIfNeeded(@NotNull WebApplication application) throws DBException {
+        if (migrationNotNeeded(application)) {
+            return;
+        }
+        migrateConfiguration(application);
+    }
+
+    @Override
+    public void reloadConfiguration(@NotNull WebAppConfiguration appConfig) throws DBException {
+
+    }
+
+    private void migrateConfiguration(
+        @NotNull WebApplication application
+    ) {
+        if (!(application instanceof WebAuthApplication authApplication)) {
+            return;
+        }
+
+        SMAuthProviderCustomConfiguration smReverseProxyhProviderConfiguration =
+            authApplication.getAuthConfiguration().getAuthProviderConfiguration(RPAuthProvider.AUTH_PROVIDER);
+        boolean createNew = false;
+        if (smReverseProxyhProviderConfiguration == null) {
+            createNew = true;
+            smReverseProxyhProviderConfiguration = new SMAuthProviderCustomConfiguration(RPAuthProvider.AUTH_PROVIDER);
+            smReverseProxyhProviderConfiguration.setProvider(RPAuthProvider.AUTH_PROVIDER);
+            smReverseProxyhProviderConfiguration.setDisplayName("Reverse Proxy");
+            smReverseProxyhProviderConfiguration.setDescription(
+                "Automatically created provider after changing Reverse Proxy configuration way in 23.3.3 version"
+            );
+            smReverseProxyhProviderConfiguration.setIconURL("");
+            Map<String, Object> parameters = new HashMap<>();
+            parameters.put(RPConstants.PARAM_USER, RPAuthProvider.X_USER);
+            parameters.put(RPConstants.PARAM_LOGOUT_URL, RPAuthProvider.X_LOGOUT_URL);
+            parameters.put(RPConstants.PARAM_TEAM, RPAuthProvider.X_LOGOUT_URL);
+            parameters.put(RPConstants.PARAM_FIRST_NAME, RPAuthProvider.X_FIRST_NAME);
+            parameters.put(RPConstants.PARAM_LAST_NAME, RPAuthProvider.X_LAST_NAME);
+            smReverseProxyhProviderConfiguration.setParameters(parameters);
+        }
+
+        if (createNew) {
+            authApplication.getAuthConfiguration().addAuthProviderConfiguration(smReverseProxyhProviderConfiguration);
+            try {
+                authApplication.flushConfiguration();
+            } catch (Exception e) {
+                log.error("Failed to save server configuration", e);
+            }
+        }
+    }
+
+    private boolean migrationNotNeeded(@NotNull WebApplication application) {
+        if (!(application instanceof WebAuthApplication authApplication)) {
+            return true;
+        }
+
+        if (!authApplication.getAuthConfiguration().isAuthProviderEnabled(RPAuthProvider.AUTH_PROVIDER)) {
+            log.debug("Reverse proxy provider disabled, migration not needed");
+            return true;
+        }
+
+        if (authApplication.getAuthConfiguration().getAuthProviderConfiguration(RPAuthProvider.AUTH_PROVIDER) != null) {
+            log.debug("Reverse proxy provider already exist, migration not needed");
+            return true;
+        }
+        return false;
+    }
+}

server/bundles/io.cloudbeaver.service.security/plugin.xml

@@ -18,13 +18,24 @@
         <authProvider id="reverseProxy" label="Reverse proxy"
                       description="Reverse proxy header based authentication"
                       trusted="true"
+                      configurable="true"
                       class="io.cloudbeaver.auth.provider.rp.RPAuthProvider"
                       icon="platform:/plugin/org.jkiss.dbeaver.model/icons/tree/key.png">
             <credentials>
                 <propertyGroup label="General">
                     <property id="user" label="User name" type="string" description="User name" admin="true" user="true" identifying="true"/>
                 </propertyGroup>
             </credentials>
+            <configuration>
+                <propertyGroup label="Configuration">
+                    <property id="logout-url-header" label="Logout url" type="string" description="Logout url"/>
+                    <property id="user-header" label="User header name" type="string" description="User header name"/>
+                    <property id="team-header" label="Team name" type="string" description="Team header name"/>
+                    <property id="first-name-header" label="First name header" type="string" description="First name header name"/>
+                    <property id="last-name-header" label="Last name header" type="string" description="Last name header name"/>
+                    <property id="role-header" label="Role header" type="string" description="Role header name" features="distributed"/>
+                </propertyGroup>
+            </configuration>
         </authProvider>
     </extension>
 </plugin>

server/bundles/io.cloudbeaver.service.security/src/io/cloudbeaver/auth/provider/rp/RPAuthProvider.java

@@ -48,6 +48,7 @@ public class RPAuthProvider implements SMAuthProviderExternal<SMSession> {
     public static final String X_ROLE_TE = "X-Role-TE";
     public static final String X_FIRST_NAME = "X-First-name";
     public static final String X_LAST_NAME = "X-Last-name";
+    public static final String X_LOGOUT_URL = "X-logout-url";
     public static final String AUTH_PROVIDER = "reverseProxy";
 
     @NotNull