Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

control-service: add OAuth2 enable/disable flag #765

Merged
merged 12 commits into from
Mar 22, 2022
Merged

control-service: add OAuth2 enable/disable flag #765

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
12 commits
Select commit Hold shift + click to select a range
71ff7d2
add kerberos auth
Mar 7, 2022
c13f271
comments
Mar 8, 2022
268a49c
OAuth2 enable/disable flag
Mar 11, 2022
0b7a5b2
merge
Mar 11, 2022
dd1dd87
typo
Mar 11, 2022
9601ce9
vdk-trino: collect lineage for select/insert and rename table only (#…
philip-alexiev Mar 15, 2022
1b8785b
[vdk-core][vdk-control-cli] Adopt click version 8.0 (#769)
doks5 Mar 17, 2022
989a5e6
[pre-commit.ci] pre-commit autoupdate (#766)
pre-commit-ci[bot] Mar 17, 2022
e1afcc1
vdk-control-cli: Adopt click version 8 (#770)
ivakoleva Mar 17, 2022
c624f67
control-service: Adopt use of the V1CronJob API (#767)
gabrielgeorgiev1 Mar 18, 2022
1470021
Merge remote-tracking branch 'origin/main' into person/mzhivkov/oauth…
ivakoleva Mar 21, 2022
730ca5f
control-service: add OAuth2 enable/disable flag
ivakoleva Mar 22, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 3 additions & 0 deletions ...ects/control-service/projects/base/src/main/java/com/vmware/taurus/base/FeatureFlags.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -30,4 +30,7 @@ public class FeatureFlags {
@Value("${datajobs.security.kerberos.enabled:false}")
boolean krbAuthEnabled = false;

@Value("${datajobs.security.oauth2.enabled:false}")
boolean oAuth2Enabled = true;

}
8 changes: 5 additions & 3 deletions ...service/projects/base/src/main/java/com/vmware/taurus/security/SecurityConfiguration.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -138,9 +138,11 @@ private void enableSecurity(HttpSecurity http) throws Exception {
.hasAnyAuthority(authorizedRoles.toArray(String[]::new));
}
authorizeRequests.anyRequest().authenticated();
})
.oauth2ResourceServer().jwt()
.jwtAuthenticationConverter(jwtAuthenticationConverter());
});

if (featureFlags.isOAuth2Enabled()) {
http.oauth2ResourceServer().jwt().jwtAuthenticationConverter(jwtAuthenticationConverter());
}

if (featureFlags.isKrbAuthEnabled()) {
http.addFilterBefore(spnegoAuthenticationProcessingFilter(authenticationManagerBean()),
Expand Down
16 changes: 14 additions & 2 deletions ...service/projects/pipelines_control_service/src/main/resources/application-prod.properties
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -71,8 +71,20 @@ datajobs.proxy.repositoryUrl=${PROXY_DOCKER_REPO_URL}
datajobs.git.read.write.username=${GIT_USERNAME_READ_WRITE}
datajobs.git.read.write.password=${GIT_PASSWORD_READ_WRITE}

# security configurations
# featureflag.security.enabled - if yes specify:

# Security configuration. Note if you enable security, you may
# also enable authentication provider(s) and authorization
# featureflag.security.enabled=true

# Settings for Kerberos authentication provider
datajobs.security.kerberos.enabled=${SECURITY_KERBEROS_ENABLED:false}
# Properties mandatory if datajobs.security.kerberos.enabled=true
datajobs.security.kerberos.kerberosPrincipal=${SECURITY_KERBEROS_SERVICE_PRINCIPAL:""}
datajobs.security.kerberos.keytabFileLocation=${SECURITY_KERBEROS_SERVICE_KEYTAB_FILE_LOCATION:}
datajobs.security.kerberos.krb5ConfigLocation=${SECURITY_KERBEROS_KRB5_CONFIG_LOCATION:}

# Settings for OAuth2 authentication provider
datajobs.security.oauth2.enabled=true

# The JSON Web Key Set (JWKS) is a set of keys which contains the public keys
# used to verify any JSON Web Token (JWT) issued by the authorization server
Expand Down
28 changes: 21 additions & 7 deletions ...trol-service/projects/pipelines_control_service/src/main/resources/application.properties
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -36,6 +36,27 @@ logging.level.org.hibernate.type.descriptor.sql.BasicBinder=INFO

spring.jpa.open-in-view=false


# Security configuration. Note if you enable security, you may
# also enable authentication provider(s) and authorization
# featureflag.security.enabled=true

# Settings for Kerberos authentication provider
datajobs.security.kerberos.enabled=${SECURITY_KERBEROS_ENABLED:false}
# Properties mandatory if datajobs.security.kerberos.enabled=true
datajobs.security.kerberos.kerberosPrincipal=${SECURITY_KERBEROS_SERVICE_PRINCIPAL:""}
datajobs.security.kerberos.keytabFileLocation=${SECURITY_KERBEROS_SERVICE_KEYTAB_FILE_LOCATION:}
datajobs.security.kerberos.krb5ConfigLocation=${SECURITY_KERBEROS_KRB5_CONFIG_LOCATION:}

# Settings for OAuth2 authentication provider
datajobs.security.oauth2.enabled=true

# The JSON Web Key Set (JWKS) is a set of keys which contains the public keys
# used to verify any JSON Web Token (JWT) issued by the authorization server
# It is required.
spring.security.oauth2.resourceserver.jwt.jwk-set-uri=${SPRING_SECURITY_OAUTH2_RESOURCESERVER_JWT_JWK_SET_URI}
# spring.security.oauth2.resourceserver.jwt.issuer-uri=${SPRING_SECURITY_OAUTH2_RESOURCESERVER_JWT_ISSUER_URI}

# Authorization configuration. Note if you enable authorization you should
# also point the webhook endpoint against which authorization is delegated
# in order for the feature to fully work
Expand Down Expand Up @@ -145,10 +166,3 @@ mail.smtp.host=smtp.vmware.com
# Correspond to those defined by kubernetes
# See https://kubernetes.io/docs/concepts/containers/images/#image-pull-policy
datajobs.deployment.builder.imagePullPolicy=IfNotPresent

# Settings for Kerberos authentication provider.
datajobs.security.kerberos.enabled=${SECURITY_KERBEROS_ENABLED:false}
# Properties mandatory if datajobs.security.kerberos.enabled=true
datajobs.security.kerberos.kerberosPrincipal=${SECURITY_KERBEROS_SERVICE_PRINCIPAL:""}
datajobs.security.kerberos.keytabFileLocation=${SECURITY_KERBEROS_SERVICE_KEYTAB_FILE_LOCATION:}
datajobs.security.kerberos.krb5ConfigLocation=${SECURITY_KERBEROS_KRB5_CONFIG_LOCATION:}