Merge pull request #194 from fjuma/oidc-identity-propagation

Add example applications for identity propagation with OIDC
wildfly-security-incubator · Nov 14, 2023 · 25d799d · 25d799d
2 parents 6dee639 + 0f0e5b3
commit 25d799d
Show file tree

Hide file tree

Showing 41 changed files with 1,680 additions and 0 deletions.
diff --git a/oidc-with-identity-propagation-same-domain/README.md b/oidc-with-identity-propagation-same-domain/README.md
@@ -0,0 +1,11 @@
+## Identity Propagation with OpenID Connect (OIDC)
+
+When securing an application with OpenID Connect (OIDC), the `elytron-oidc-client` subsystem will automatically create a
+virtual security domain for you. If your application invokes an EJB, additional configuration might be required to propagate
+the security identity from the virtual security domain depending on how the EJB is being secured.
+
+If your application secured with OIDC invokes an EJB within the same deployment and you'd like to secure the EJB
+using the same virtual security domain, no additional configuration is required.
+
+If your application secured with OIDC invokes an EJB in a separate deployment and you'd like to secure the EJB using
+the same virtual security domain, additional configuration will be needed as shown in this example.
diff --git a/oidc-with-identity-propagation-same-domain/configure-server.cli b/oidc-with-identity-propagation-same-domain/configure-server.cli
@@ -0,0 +1,7 @@
+batch
+
+# Configure a virtual-security-domain that will be referenced by the WhoAmIBean
+/subsystem=elytron/virtual-security-domain=same-virtual-domain.ear:add()
+
+# Run the batch commands
+run-batch
diff --git a/oidc-with-identity-propagation-same-domain/ejb-same-domain/ear/pom.xml b/oidc-with-identity-propagation-same-domain/ejb-same-domain/ear/pom.xml
@@ -0,0 +1,52 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">
+    <modelVersion>4.0.0</modelVersion>
+    <parent>
+        <groupId>org.wildfly.security.examples</groupId>
+        <artifactId>ejb-same-domain</artifactId>
+        <version>2.0.0.Alpha1-SNAPSHOT</version>
+    </parent>
+    <artifactId>ejb-same-domain-ear</artifactId>
+    <packaging>ear</packaging>
+
+    <properties>
+        <version.wildfly.maven.plugin>4.2.0.Final</version.wildfly.maven.plugin>
+        <version.wildfly.maven.ear.plugin>3.3.0</version.wildfly.maven.ear.plugin>
+    </properties>
+
+    <dependencies>
+        <dependency>
+            <groupId>${project.groupId}</groupId>
+            <artifactId>ejb-same-domain-ejb</artifactId>
+            <type>ejb</type>
+        </dependency>
+    </dependencies>
+
+    <build>
+        <finalName>${project.parent.artifactId}</finalName>
+        <plugins>
+            <!-- EAR plug-in -->
+            <plugin>
+                <groupId>org.apache.maven.plugins</groupId>
+                <artifactId>maven-ear-plugin</artifactId>
+                <version>3.3.0</version>
+                <configuration>
+                    <!-- Use Jakarta EE ear libraries as needed. Jakarta EE ear libraries
+                        are in easy way to package any libraries needed in the ear, and automatically
+                        have any modules (EJB-JARs and WARs) use them -->
+                    <version>7</version>
+                    <defaultLibBundleDir>lib</defaultLibBundleDir>
+                    <outputFileNameMapping>@{artifactId}@@{dashClassifier?}@.@{extension}@</outputFileNameMapping>
+                </configuration>
+            </plugin>
+            <plugin>
+                <groupId>org.wildfly.plugins</groupId>
+                <artifactId>wildfly-maven-plugin</artifactId>
+                <version>${version.wildfly.maven.plugin}</version>
+                <configuration>
+                    <skip>false</skip>
+                </configuration>
+            </plugin>
+        </plugins>
+    </build>
+</project>
diff --git a/oidc-with-identity-propagation-same-domain/ejb-same-domain/ejb/pom.xml b/oidc-with-identity-propagation-same-domain/ejb-same-domain/ejb/pom.xml
@@ -0,0 +1,72 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!--
+    JBoss, Home of Professional Open Source
+    Copyright 2017, Red Hat, Inc. and/or its affiliates, and individual
+    contributors by the @authors tag. See the copyright.txt in the
+    distribution for a full listing of individual contributors.
+
+    Licensed under the Apache License, Version 2.0 (the "License");
+    you may not use this file except in compliance with the License.
+    You may obtain a copy of the License at
+    http://www.apache.org/licenses/LICENSE-2.0
+    Unless required by applicable law or agreed to in writing, software
+    distributed under the License is distributed on an "AS IS" BASIS,
+    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+    See the License for the specific language governing permissions and
+    limitations under the License.
+-->
+<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">
+
+    <modelVersion>4.0.0</modelVersion>
+
+    <parent>
+        <groupId>org.wildfly.security.examples</groupId>
+        <artifactId>ejb-same-domain</artifactId>
+        <version>2.0.0.Alpha1-SNAPSHOT</version>
+    </parent>
+    <artifactId>ejb-same-domain-ejb</artifactId>
+
+    <dependencies>
+        <dependency>
+            <groupId>jakarta.enterprise</groupId>
+            <artifactId>jakarta.enterprise.cdi-api</artifactId>
+            <scope>provided</scope>
+        </dependency>
+        <dependency>
+            <groupId>jakarta.annotation</groupId>
+            <artifactId>jakarta.annotation-api</artifactId>
+            <scope>provided</scope>
+        </dependency>
+        <dependency>
+            <groupId>jakarta.ejb</groupId>
+            <artifactId>jakarta.ejb-api</artifactId>
+            <scope>provided</scope>
+        </dependency>
+        <dependency>
+            <groupId>org.jboss.ejb3</groupId>
+            <artifactId>jboss-ejb3-ext-api</artifactId>
+        </dependency>
+    </dependencies>
+    <build>
+        <finalName>${project.artifactId}</finalName>
+        <resources>
+            <resource>
+                <targetPath>META-INF</targetPath>
+                <directory>src/main/resources/META-INF</directory>
+                <!-- add the jboss configuration to declare the security domain without using the JBoss specific annotation -->
+                <includes>
+                    <include>jboss-ejb3.xml</include>
+                </includes>
+            </resource>
+        </resources>
+        <plugins>
+            <plugin>
+                <groupId>org.wildfly.plugins</groupId>
+                <artifactId>wildfly-maven-plugin</artifactId>
+                <configuration>
+                    <skip>true</skip>
+                </configuration>
+            </plugin>
+        </plugins>
+    </build>
+</project>
diff --git a/...ith-identity-propagation-same-domain/ejb-same-domain/ejb/src/main/java/META-INF/beans.xml b/...ith-identity-propagation-same-domain/ejb-same-domain/ejb/src/main/java/META-INF/beans.xml
@@ -0,0 +1,24 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!--
+    JBoss, Home of Professional Open Source
+    Copyright 2015, Red Hat, Inc. and/or its affiliates, and individual
+    contributors by the @authors tag. See the copyright.txt in the
+    distribution for a full listing of individual contributors.
+
+    Licensed under the Apache License, Version 2.0 (the "License");
+    you may not use this file except in compliance with the License.
+    You may obtain a copy of the License at
+    http://www.apache.org/licenses/LICENSE-2.0
+    Unless required by applicable law or agreed to in writing, software
+    distributed under the License is distributed on an "AS IS" BASIS,
+    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+    See the License for the specific language governing permissions and
+    limitations under the License.
+-->
+<!-- Marker file indicating CDI should be enabled -->
+<beans xmlns="http://xmlns.jcp.org/xml/ns/javaee" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+    xsi:schemaLocation="
+      http://xmlns.jcp.org/xml/ns/javaee
+      http://xmlns.jcp.org/xml/ns/javaee/beans_1_1.xsd"
+    bean-discovery-mode="all">
+</beans>
diff --git a/...me-domain/ejb/src/main/java/org/wildfly/security/examples/ejb_same_domain/ejb/WhoAmI.java b/...me-domain/ejb/src/main/java/org/wildfly/security/examples/ejb_same_domain/ejb/WhoAmI.java
@@ -0,0 +1,22 @@
+/*
+ * Copyright 2023 Red Hat, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.wildfly.security.examples.ejb_same_domain.ejb;
+
+public interface WhoAmI {
+
+    public String whoAmI();
+}
diff --git a/...omain/ejb/src/main/java/org/wildfly/security/examples/ejb_same_domain/ejb/WhoAmIBean.java b/...omain/ejb/src/main/java/org/wildfly/security/examples/ejb_same_domain/ejb/WhoAmIBean.java
@@ -0,0 +1,43 @@
+/*
+ * Copyright 2023 Red Hat, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.wildfly.security.examples.ejb_same_domain.ejb;
+
+import jakarta.ejb.Remote;
+import jakarta.ejb.Stateful;
+import jakarta.annotation.security.RolesAllowed;
+import jakarta.annotation.security.PermitAll;
+import jakarta.annotation.Resource;
+
+import org.jboss.ejb3.annotation.SecurityDomain;
+import jakarta.ejb.SessionContext;
+
+@Stateful
+@Remote(WhoAmI.class)
+@SecurityDomain("same-virtual-domain.ear")
+public class WhoAmIBean implements WhoAmI {
+
+    @Resource
+    private SessionContext sessionContext;
+
+    @Override
+    public String whoAmI() {
+        String callerPrincipal = sessionContext.getCallerPrincipal().getName();
+        boolean isCallerUser = sessionContext.isCallerInRole("User");
+        boolean isCallerAdmin = sessionContext.isCallerInRole("Admin");
+        return "Principal : " + callerPrincipal + "<br/><br/>Caller Has Role 'User'=" + String.valueOf(isCallerUser) + "<br/><br/>Caller Has Role 'Admin'=" + String.valueOf(isCallerAdmin);
+    }
+}
diff --git a/...ty-propagation-same-domain/ejb-same-domain/ejb/src/main/resources/META-INF/jboss-ejb3.xml b/...ty-propagation-same-domain/ejb-same-domain/ejb/src/main/resources/META-INF/jboss-ejb3.xml
@@ -0,0 +1,19 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!--
+  ~ Copyright The WildFly Authors
+  ~ SPDX-License-Identifier: Apache-2.0
+  -->
+
+<jboss:jboss
+        xmlns="http://java.sun.com/xml/ns/javaee"
+        xmlns:jboss="http://www.jboss.com/xml/ns/javaee"
+        xmlns:s="urn:security:1.1"
+        version="3.1" impl-version="2.0">
+
+    <assembly-descriptor>
+        <s:security>
+            <ejb-name>*</ejb-name>
+            <s:missing-method-permissions-deny-access>false</s:missing-method-permissions-deny-access>
+        </s:security>
+    </assembly-descriptor>
+</jboss:jboss>
diff --git a/oidc-with-identity-propagation-same-domain/ejb-same-domain/pom.xml b/oidc-with-identity-propagation-same-domain/ejb-same-domain/pom.xml
@@ -0,0 +1,56 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">
+    <modelVersion>4.0.0</modelVersion>
+    <groupId>org.wildfly.security.examples</groupId>
+    <version>2.0.0.Alpha1-SNAPSHOT</version>
+    <artifactId>ejb-same-domain</artifactId>
+    <packaging>pom</packaging>
+
+    <properties>
+        <version.wildfly.maven.plugin>4.2.0.Final</version.wildfly.maven.plugin>
+        <version.wildfly.maven.ear.plugin>3.3.0</version.wildfly.maven.ear.plugin>
+        <version.server.bom>30.0.0.Final</version.server.bom>
+        <maven.compiler.source>11</maven.compiler.source>
+        <maven.compiler.target>11</maven.compiler.target>
+    </properties>
+
+    <modules>
+        <module>ejb</module>
+        <module>ear</module>
+    </modules>
+
+    <dependencyManagement>
+        <dependencies>
+            <dependency>
+                <groupId>org.wildfly.bom</groupId>
+                <artifactId>wildfly-ee-with-tools</artifactId>
+                <version>${version.server.bom}</version>
+                <type>pom</type>
+                <scope>import</scope>
+            </dependency>
+            <dependency>
+                <groupId>${project.groupId}</groupId>
+                <artifactId>ejb-same-domain-ejb</artifactId>
+                <version>${project.version}</version>
+                <type>ejb</type>
+            </dependency>
+        </dependencies>
+    </dependencyManagement>
+
+    <build>
+        <plugins>
+            <!-- The WildFly plug-in deploys your ear to a local WildFly container.
+                Due to Maven's lack of intelligence with EARs we need to configure
+                the WildFly Maven plug-in to skip deployment for all modules. We then enable
+                it specifically in the ear module. -->
+            <plugin>
+                <groupId>org.wildfly.plugins</groupId>
+                <artifactId>wildfly-maven-plugin</artifactId>
+                <configuration>
+                    <skip>true</skip>
+                </configuration>
+            </plugin>
+        </plugins>
+    </build>
+
+</project>
diff --git a/oidc-with-identity-propagation-same-domain/same-virtual-domain/ear/pom.xml b/oidc-with-identity-propagation-same-domain/same-virtual-domain/ear/pom.xml
@@ -0,0 +1,58 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">
+    <modelVersion>4.0.0</modelVersion>
+    <parent>
+        <groupId>org.wildfly.security.examples</groupId>
+        <artifactId>same-virtual-domain</artifactId>
+        <version>2.0.0.Alpha1-SNAPSHOT</version>
+    </parent>
+    <artifactId>same-virtual-domain-ear</artifactId>
+    <packaging>ear</packaging>
+
+    <dependencies>
+        <dependency>
+            <groupId>${project.groupId}</groupId>
+            <artifactId>same-virtual-domain-ejb</artifactId>
+            <type>ejb</type>
+        </dependency>
+        <dependency>
+            <groupId>${project.groupId}</groupId>
+            <artifactId>same-virtual-domain-web</artifactId>
+            <type>war</type>
+        </dependency>
+    </dependencies>
+
+    <build>
+        <finalName>${project.parent.artifactId}</finalName>
+        <plugins>
+            <!-- EAR plug-in -->
+            <plugin>
+                <groupId>org.apache.maven.plugins</groupId>
+                <artifactId>maven-ear-plugin</artifactId>
+                <version>3.3.0</version>
+                <configuration>
+                    <!-- Use Jakarta EE ear libraries as needed. Jakarta EE ear libraries
+                        are in easy way to package any libraries needed in the ear, and automatically
+                        have any modules (EJB-JARs and WARs) use them -->
+                    <version>7</version>
+                    <defaultLibBundleDir>lib</defaultLibBundleDir>
+                    <modules>
+                        <webModule>
+                            <groupId>${project.groupId}</groupId>
+                            <artifactId>same-virtual-domain-web</artifactId>
+                            <contextRoot>/same-virtual-domain</contextRoot>
+                        </webModule>
+                    </modules>
+                    <outputFileNameMapping>@{artifactId}@@{dashClassifier?}@.@{extension}@</outputFileNameMapping>
+                </configuration>
+            </plugin>
+            <plugin>
+                <groupId>org.wildfly.plugins</groupId>
+                <artifactId>wildfly-maven-plugin</artifactId>
+                <configuration>
+                    <skip>false</skip>
+                </configuration>
+            </plugin>
+        </plugins>
+    </build>
+</project>