-
Notifications
You must be signed in to change notification settings - Fork 2
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
bugfix/skjermingsregister_proxy_401_merged (#3377)
Azure-autentisering mot tjeneste skjermede-personer.
- Loading branch information
Showing
12 changed files
with
272 additions
and
76 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
22 changes: 22 additions & 0 deletions
22
...egister-proxy/src/main/java/no/nav/testnav/proxies/skjermingsregisterproxy/Consumers.java
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,22 @@ | ||
| package no.nav.testnav.proxies.skjermingsregisterproxy; | ||
|
|
||
| import lombok.Getter; | ||
| import lombok.NoArgsConstructor; | ||
| import lombok.Setter; | ||
| import org.springframework.boot.context.properties.ConfigurationProperties; | ||
| import org.springframework.context.annotation.Configuration; | ||
|
|
||
| import no.nav.testnav.libs.securitycore.domain.ServerProperties; | ||
|
|
||
| import static lombok.AccessLevel.PACKAGE; | ||
|
|
||
| @Configuration | ||
| @ConfigurationProperties(prefix = "consumers") | ||
| @NoArgsConstructor(access = PACKAGE) | ||
| @Getter | ||
| @Setter(PACKAGE) | ||
| public class Consumers { | ||
|
|
||
| private ServerProperties skjermingsregister; | ||
|
|
||
| } |
42 changes: 42 additions & 0 deletions
42
...-proxy/src/main/java/no/nav/testnav/proxies/skjermingsregisterproxy/LocalVaultConfig.java
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,42 @@ | ||
| package no.nav.testnav.proxies.skjermingsregisterproxy; | ||
|
|
||
| import io.micrometer.common.lang.NonNullApi; | ||
| import no.nav.testnav.libs.reactiveproxy.config.DevConfig; | ||
| import org.springframework.context.annotation.Configuration; | ||
| import org.springframework.context.annotation.Import; | ||
| import org.springframework.context.annotation.Profile; | ||
| import org.springframework.vault.annotation.VaultPropertySource; | ||
| import org.springframework.vault.authentication.ClientAuthentication; | ||
| import org.springframework.vault.authentication.TokenAuthentication; | ||
| import org.springframework.vault.client.VaultEndpoint; | ||
| import org.springframework.vault.config.AbstractVaultConfiguration; | ||
|
|
||
| import static io.micrometer.common.util.StringUtils.isBlank; | ||
|
|
||
| @Profile("local") | ||
| @Import(DevConfig.class) | ||
| @Configuration | ||
| @VaultPropertySource(value = "kv/preprod/fss/testnav-skjermingsregister-proxy/dev", ignoreSecretNotFound = false) | ||
| @NonNullApi | ||
| public class LocalVaultConfig extends AbstractVaultConfiguration { | ||
|
|
||
| static final String TOKEN_PROPERTY_NAME = "spring.cloud.vault.token"; | ||
|
|
||
| @Override | ||
| public VaultEndpoint vaultEndpoint() { | ||
| return VaultEndpoint.create("vault.adeo.no", 443); | ||
| } | ||
|
|
||
| @Override | ||
| public ClientAuthentication clientAuthentication() { | ||
| if (System.getenv().containsKey("VAULT_TOKEN")) { | ||
| System.setProperty(TOKEN_PROPERTY_NAME, System.getenv("VAULT_TOKEN")); | ||
| } | ||
| var token = System.getProperty(TOKEN_PROPERTY_NAME); | ||
| if (isBlank(token)) { | ||
| throw new IllegalArgumentException("Påkrevet property '%s' er ikke satt.".formatted(TOKEN_PROPERTY_NAME)); | ||
| } | ||
| return new TokenAuthentication(System.getProperty(TOKEN_PROPERTY_NAME)); | ||
| } | ||
|
|
||
| } |
48 changes: 48 additions & 0 deletions
48
...roxy/src/main/java/no/nav/testnav/proxies/skjermingsregisterproxy/RouteLocatorConfig.java
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,48 @@ | ||
| package no.nav.testnav.proxies.skjermingsregisterproxy; | ||
|
|
||
| import no.nav.testnav.libs.reactiveproxy.config.SecurityConfig; | ||
| import no.nav.testnav.libs.reactiveproxy.filter.AddAuthenticationRequestGatewayFilterFactory; | ||
| import no.nav.testnav.libs.reactivesecurity.config.SecureOAuth2ServerToServerConfiguration; | ||
| import no.nav.testnav.libs.reactivesecurity.exchange.azuread.TrygdeetatenAzureAdTokenService; | ||
| import no.nav.testnav.libs.securitycore.domain.AccessToken; | ||
| import org.springframework.cloud.gateway.filter.GatewayFilter; | ||
| import org.springframework.cloud.gateway.route.RouteLocator; | ||
| import org.springframework.cloud.gateway.route.builder.RouteLocatorBuilder; | ||
| import org.springframework.context.annotation.Bean; | ||
| import org.springframework.context.annotation.Configuration; | ||
| import org.springframework.context.annotation.Import; | ||
|
|
||
| @Import({ | ||
| SecureOAuth2ServerToServerConfiguration.class, | ||
| SecurityConfig.class | ||
| }) | ||
| @Configuration | ||
| public class RouteLocatorConfig { | ||
|
|
||
| @Bean | ||
| public RouteLocator customRouteLocator( | ||
| RouteLocatorBuilder builder, | ||
| Consumers consumers, | ||
| GatewayFilter authenticationFilter | ||
| ) { | ||
| return builder | ||
| .routes() | ||
| .route(spec -> spec | ||
| .path("/**") | ||
| .filters(f -> f.filter(authenticationFilter)) | ||
| .uri(consumers.getSkjermingsregister().getUrl())) | ||
| .build(); | ||
| } | ||
|
|
||
| @Bean | ||
| GatewayFilter getAuthenticationFilter( | ||
| TrygdeetatenAzureAdTokenService tokenService, | ||
| Consumers consumers | ||
| ) { | ||
| return AddAuthenticationRequestGatewayFilterFactory | ||
| .bearerAuthenticationHeaderFilter(() -> tokenService | ||
| .exchange(consumers.getSkjermingsregister()) | ||
| .map(AccessToken::getTokenValue)); | ||
| } | ||
|
|
||
| } |
41 changes: 3 additions & 38 deletions
41
...av/testnav/proxies/skjermingsregisterproxy/SkjermingsregisterProxyApplicationStarter.java
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,51 +1,16 @@ | ||
| package no.nav.testnav.proxies.skjermingsregisterproxy; | ||
|
|
||
| import no.nav.testnav.libs.reactivecore.config.CoreConfig; | ||
| import no.nav.testnav.libs.reactiveproxy.config.DevConfig; | ||
| import no.nav.testnav.libs.reactiveproxy.config.SecurityConfig; | ||
| import no.nav.testnav.libs.reactiveproxy.filter.AddAuthenticationRequestGatewayFilterFactory; | ||
| import no.nav.testnav.libs.securitytokenservice.StsOidcTokenService; | ||
| import org.springframework.beans.factory.annotation.Value; | ||
| import org.springframework.boot.SpringApplication; | ||
| import org.springframework.boot.autoconfigure.SpringBootApplication; | ||
| import org.springframework.cloud.gateway.route.RouteLocator; | ||
| import org.springframework.cloud.gateway.route.builder.RouteLocatorBuilder; | ||
| import org.springframework.context.annotation.Bean; | ||
| import org.springframework.context.annotation.Import; | ||
|
|
||
| @Import({ | ||
| CoreConfig.class, | ||
| DevConfig.class, | ||
| SecurityConfig.class | ||
| }) | ||
| @SpringBootApplication | ||
| @Import(CoreConfig.class) | ||
| public class SkjermingsregisterProxyApplicationStarter { | ||
|
|
||
| public static void main(String[] args) { | ||
| SpringApplication.run(SkjermingsregisterProxyApplicationStarter.class, args); | ||
| } | ||
|
|
||
| @Bean | ||
| public StsOidcTokenService stsOidcTokenService( | ||
| @Value("${sts.token.provider.url}") String url, | ||
| @Value("${sts.token.provider.username}") String username, | ||
| @Value("${sts.token.provider.password}") String password) { | ||
|
|
||
| return new StsOidcTokenService(url, username, password); | ||
| } | ||
|
|
||
| @Bean | ||
| public RouteLocator customRouteLocator(RouteLocatorBuilder builder, StsOidcTokenService stsOidcTokenService) { | ||
|
|
||
| var addAuthenticationHeaderFilter = AddAuthenticationRequestGatewayFilterFactory | ||
| .bearerAuthenticationHeaderFilter(stsOidcTokenService::getToken); | ||
|
|
||
| return builder.routes() | ||
| .route(spec -> spec | ||
| .path("/**") | ||
| .filters(filterSpec -> filterSpec | ||
| .filter(addAuthenticationHeaderFilter)) | ||
| .uri("http://skjermede-personer.nom.svc.nais.local/")) | ||
| .build(); | ||
| } | ||
|
|
||
| } | ||
| } |
2 changes: 0 additions & 2 deletions
2
proxies/skjermingsregister-proxy/src/main/resources/application-dev.yml
This file was deleted.
Oops, something went wrong.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
20 changes: 0 additions & 20 deletions
20
.../src/test/java/no/nav/testnav/proxies/skjermingsregisterproxy/ApplicationContextTest.java
This file was deleted.
Oops, something went wrong.
45 changes: 45 additions & 0 deletions
45
...xy/src/test/java/no/nav/testnav/proxies/skjermingsregisterproxy/LocalVaultConfigTest.java
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,45 @@ | ||
| package no.nav.testnav.proxies.skjermingsregisterproxy; | ||
|
|
||
| import org.junit.jupiter.api.Test; | ||
| import org.springframework.test.context.ActiveProfiles; | ||
| import org.springframework.vault.authentication.TokenAuthentication; | ||
|
|
||
| import static org.assertj.core.api.AssertionsForClassTypes.assertThat; | ||
| import static org.assertj.core.api.AssertionsForClassTypes.assertThatThrownBy; | ||
|
|
||
| @ActiveProfiles("test") | ||
| class LocalVaultConfigTest { | ||
|
|
||
| @Test | ||
| void missingSystemPropertyShouldFail() { | ||
| assertThatThrownBy(new LocalVaultConfig()::clientAuthentication) | ||
| .isInstanceOf(IllegalArgumentException.class); | ||
| } | ||
|
|
||
| @Test | ||
| void environmentPropertyShouldTakePrecedenceOverSystemProperty() { | ||
| try { | ||
| System.setProperty(LocalVaultConfig.TOKEN_PROPERTY_NAME, "<some-token-here>"); | ||
| assertThat(new LocalVaultConfig()) | ||
| .isNotNull() | ||
| .satisfies( | ||
| config -> assertThat(config.clientAuthentication()) | ||
| .isNotNull() | ||
| .isInstanceOf(TokenAuthentication.class) | ||
| ); | ||
| } finally { | ||
| System.clearProperty(LocalVaultConfig.TOKEN_PROPERTY_NAME); | ||
| } | ||
| } | ||
|
|
||
| @Test | ||
| void vaultEndpointShouldBeKnown() { | ||
| assertThat(new LocalVaultConfig().vaultEndpoint()) | ||
| .isNotNull() | ||
| .satisfies(endpoint -> { | ||
| assertThat(endpoint.getHost()).isEqualTo("vault.adeo.no"); | ||
| assertThat(endpoint.getPort()).isEqualTo(443); | ||
| }); | ||
| } | ||
|
|
||
| } |
Oops, something went wrong.