diff --git a/.azuredevops/pipelines/build-dcr-func.yml b/.azuredevops/pipelines/build-dcr-func.yml
index 28cd2f0..9122b81 100644
--- a/.azuredevops/pipelines/build-dcr-func.yml
+++ b/.azuredevops/pipelines/build-dcr-func.yml
@@ -10,9 +10,12 @@ trigger:
- develop
- main
- releases/*
-
+
+variables:
+ - group: PT-Pipeline-Common
+
pool:
- vmImage: windows-latest
+ vmImage: $(Pipeline_Host_Image)
steps:
- task: UseDotNet@2
diff --git a/.azuredevops/pipelines/build-dh-func.yml b/.azuredevops/pipelines/build-dh-func.yml
index 8927d6c..ab0572a 100644
--- a/.azuredevops/pipelines/build-dh-func.yml
+++ b/.azuredevops/pipelines/build-dh-func.yml
@@ -9,10 +9,13 @@ schedules:
trigger:
- develop
- main
- - releases/*
+ - releases/*
+
+variables:
+ - group: PT-Pipeline-Common
pool:
- vmImage: windows-latest
+ vmImage: $(Pipeline_Host_Image)
steps:
- task: UseDotNet@2
diff --git a/.azuredevops/pipelines/dotnet.yml b/.azuredevops/pipelines/dotnet.yml
index fe91fff..d747f34 100644
--- a/.azuredevops/pipelines/dotnet.yml
+++ b/.azuredevops/pipelines/dotnet.yml
@@ -12,8 +12,11 @@ resources:
trigger:
- develop
+variables:
+ - group: PT-Pipeline-Common
+
pool:
- vmImage: windows-2019
+ vmImage: $(Pipeline_Host_Image)
steps:
diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml
index eb3bd9e..ae2d76e 100644
--- a/.github/workflows/codeql-analysis.yml
+++ b/.github/workflows/codeql-analysis.yml
@@ -55,11 +55,11 @@ jobs:
steps:
- name: Checkout repository
- uses: actions/checkout@v2
+ uses: actions/checkout@v4
# Initializes the CodeQL tools for scanning.
- name: Initialize CodeQL
- uses: github/codeql-action/init@v2
+ uses: github/codeql-action/init@v3
with:
languages: ${{ matrix.language }}
# If you wish to specify custom queries, you can do so here or in a config file.
@@ -70,7 +70,7 @@ jobs:
# Autobuild attempts to build any compiled languages (C/C++, C#, or Java).
# If this step fails, then you should remove it and run the build manually (see below)
- name: Autobuild
- uses: github/codeql-action/autobuild@v2
+ uses: github/codeql-action/autobuild@v3
# ℹ️ Command-line programs to run using the OS shell
# 📚 https://git.io/JvXDl
@@ -84,4 +84,4 @@ jobs:
# make release
- name: Perform CodeQL Analysis
- uses: github/codeql-action/analyze@v2
+ uses: github/codeql-action/analyze@v3
diff --git a/.github/workflows/dotnet.yml b/.github/workflows/dotnet.yml
index 6624da4..1976cd5 100644
--- a/.github/workflows/dotnet.yml
+++ b/.github/workflows/dotnet.yml
@@ -38,7 +38,7 @@ jobs:
steps:
- name: Checkout Data Recipient
- uses: actions/checkout@v2
+ uses: actions/checkout@v4
with:
path: ./mock-data-recipient
@@ -196,4 +196,3 @@ jobs:
with:
name: integration-test-artifacts
path: ${{ github.workspace }}/mock-data-recipient/Source/DockerCompose/_temp/mock-register/tmp
-
diff --git a/.github/workflows/test-report.yml b/.github/workflows/test-report.yml
index 3414539..ba43d14 100644
--- a/.github/workflows/test-report.yml
+++ b/.github/workflows/test-report.yml
@@ -11,7 +11,7 @@ jobs:
runs-on: ubuntu-latest
steps:
- - uses: actions/checkout@v2
+ - uses: actions/checkout@v4
- name: Publish Unit Test Report
uses: dorny/test-reporter@v1
@@ -25,7 +25,7 @@ jobs:
runs-on: ubuntu-latest
steps:
- - uses: actions/checkout@v2
+ - uses: actions/checkout@v4
- name: Publish Integration Test Report
uses: dorny/test-reporter@v1
@@ -39,7 +39,7 @@ jobs:
runs-on: ubuntu-latest
steps:
- - uses: actions/checkout@v2
+ - uses: actions/checkout@v4
- name: Publish e2e Test Report
uses: dorny/test-reporter@v1
diff --git a/CHANGELOG.md b/CHANGELOG.md
index e597c4d..b265536 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -5,6 +5,12 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
## [Unreleased]
+## [3.0.3] - 2025-12-03
+### Fixed
+- Upgrade multiple packages to address vulnerabilities
+- Fixed issue where SSA response could not be processed due to quotes in the response
+- Fix casing for the claims and other elements in JWT
+
## [3.0.2] - 2025-08-06
### Fixed
- Fixed issue where some claims in the PAR request were not sent in lowercase.
diff --git a/Source/CDR.DCR/CDR.DCR.csproj b/Source/CDR.DCR/CDR.DCR.csproj
index 2e637ab..a43ba0d 100644
--- a/Source/CDR.DCR/CDR.DCR.csproj
+++ b/Source/CDR.DCR/CDR.DCR.csproj
@@ -14,7 +14,7 @@
-
+
diff --git a/Source/CDR.DCR/DCROptions.cs b/Source/CDR.DCR/DCROptions.cs
index c72e480..6eab03a 100644
--- a/Source/CDR.DCR/DCROptions.cs
+++ b/Source/CDR.DCR/DCROptions.cs
@@ -2,7 +2,6 @@
{
public class DcrOptions
{
- public string AzureWebJobsStorage { get; set; }
public string StorageConnectionString { get; set; }
public string FUNCTIONS_WORKER_RUNTIME { get; set; }
public string DataRecipient_DB_ConnectionString { get; set; }
diff --git a/Source/CDR.DCR/Properties/serviceDependencies.json b/Source/CDR.DCR/Properties/serviceDependencies.json
index df4dcc9..9ace888 100644
--- a/Source/CDR.DCR/Properties/serviceDependencies.json
+++ b/Source/CDR.DCR/Properties/serviceDependencies.json
@@ -4,8 +4,8 @@
"type": "appInsights"
},
"storage1": {
- "type": "storage",
- "connectionId": "AzureWebJobsStorage"
+ "type": "storage",
+ "connectionId": "StorageConnectionString"
}
}
}
\ No newline at end of file
diff --git a/Source/CDR.DCR/Properties/serviceDependencies.local.json b/Source/CDR.DCR/Properties/serviceDependencies.local.json
index 155d87e..a6685be 100644
--- a/Source/CDR.DCR/Properties/serviceDependencies.local.json
+++ b/Source/CDR.DCR/Properties/serviceDependencies.local.json
@@ -1,8 +1,8 @@
{
"dependencies": {
"storage1": {
- "type": "storage.emulator",
- "connectionId": "AzureWebJobsStorage"
+ "type": "storage.emulator",
+ "connectionId": "StorageConnectionString"
}
}
}
\ No newline at end of file
diff --git a/Source/CDR.DCR/appsettings.docker.json b/Source/CDR.DCR/appsettings.docker.json
index 97dc880..a5fbaa8 100644
--- a/Source/CDR.DCR/appsettings.docker.json
+++ b/Source/CDR.DCR/appsettings.docker.json
@@ -1,5 +1,4 @@
{
- "AzureWebJobsStorage": "UseDevelopmentStorage=true",
"StorageConnectionString": "UseDevelopmentStorage=true",
"FUNCTIONS_WORKER_RUNTIME": "dotnet-isolated",
"DataRecipient_DB_ConnectionString": "Server=(localdb)\\MSSQLLocalDB;Database=cdr-mdr;Integrated Security=true",
diff --git a/Source/CDR.DCR/local.settings.json b/Source/CDR.DCR/local.settings.json
index fa822b2..cc52e46 100644
--- a/Source/CDR.DCR/local.settings.json
+++ b/Source/CDR.DCR/local.settings.json
@@ -1,7 +1,6 @@
{
"IsEncrypted": false,
"Values": {
- "AzureWebJobsStorage": "UseDevelopmentStorage=true",
"StorageConnectionString": "UseDevelopmentStorage=true",
"FUNCTIONS_WORKER_RUNTIME": "dotnet-isolated",
"DataRecipient_DB_ConnectionString": "Server=(localdb)\\MSSQLLocalDB;Database=cdr-mdr;Integrated Security=true",
diff --git a/Source/CDR.DataRecipient.E2ETests/CDR.DataRecipient.E2ETests.csproj b/Source/CDR.DataRecipient.E2ETests/CDR.DataRecipient.E2ETests.csproj
index b61d404..aa41951 100644
--- a/Source/CDR.DataRecipient.E2ETests/CDR.DataRecipient.E2ETests.csproj
+++ b/Source/CDR.DataRecipient.E2ETests/CDR.DataRecipient.E2ETests.csproj
@@ -21,17 +21,17 @@
-
+
-
+
runtime; build; native; contentfiles; analyzers; buildtransitive
all
-
+
runtime; build; native; contentfiles; analyzers; buildtransitive
all
diff --git a/Source/CDR.DataRecipient.IntegrationTests/CDR.DataRecipient.IntegrationTests.csproj b/Source/CDR.DataRecipient.IntegrationTests/CDR.DataRecipient.IntegrationTests.csproj
index d2108e7..d85fa96 100644
--- a/Source/CDR.DataRecipient.IntegrationTests/CDR.DataRecipient.IntegrationTests.csproj
+++ b/Source/CDR.DataRecipient.IntegrationTests/CDR.DataRecipient.IntegrationTests.csproj
@@ -11,20 +11,20 @@
-
+
-
+
-
+
runtime; build; native; contentfiles; analyzers; buildtransitive
all
-
+
runtime; build; native; contentfiles; analyzers; buildtransitive
all
diff --git a/Source/CDR.DataRecipient.Repository.SQL/CDR.DataRecipient.Repository.SQL.csproj b/Source/CDR.DataRecipient.Repository.SQL/CDR.DataRecipient.Repository.SQL.csproj
index de85dbf..ed2bb87 100644
--- a/Source/CDR.DataRecipient.Repository.SQL/CDR.DataRecipient.Repository.SQL.csproj
+++ b/Source/CDR.DataRecipient.Repository.SQL/CDR.DataRecipient.Repository.SQL.csproj
@@ -19,7 +19,7 @@
runtime; build; native; contentfiles; analyzers; buildtransitive
-
+
all
runtime; build; native; contentfiles; analyzers; buildtransitive
diff --git a/Source/CDR.DataRecipient.SDK/CDR.DataRecipient.SDK.csproj b/Source/CDR.DataRecipient.SDK/CDR.DataRecipient.SDK.csproj
index 862401d..b4f8f35 100644
--- a/Source/CDR.DataRecipient.SDK/CDR.DataRecipient.SDK.csproj
+++ b/Source/CDR.DataRecipient.SDK/CDR.DataRecipient.SDK.csproj
@@ -7,12 +7,12 @@
True
-
+
-
+
all
runtime; build; native; contentfiles; analyzers; buildtransitive
diff --git a/Source/CDR.DataRecipient.SDK/Models/Certificate.cs b/Source/CDR.DataRecipient.SDK/Models/Certificate.cs
index cbc3cfb..78733c4 100644
--- a/Source/CDR.DataRecipient.SDK/Models/Certificate.cs
+++ b/Source/CDR.DataRecipient.SDK/Models/Certificate.cs
@@ -1,4 +1,4 @@
-using System.Net;
+using System;
using System.Net.Http;
using System.Security.Cryptography.X509Certificates;
using System.Threading.Tasks;
@@ -15,11 +15,14 @@ public class Certificate
public string Password { get; set; }
+ public string KVSecretsStorePath { get; set; }
+
public X509Certificate2 X509Certificate
{
get
{
- if (this._certificate != null)
+ // if we already have a cert return it. But for KVSecretsStorePath we always fetch a new one incase cert was updated.
+ if (this._certificate != null && string.IsNullOrEmpty(this.KVSecretsStorePath))
{
return this._certificate;
}
@@ -28,12 +31,20 @@ public X509Certificate2 X509Certificate
{
this._certificate = new X509Certificate2(this.Path, this.Password, X509KeyStorageFlags.Exportable);
}
-
- if (!string.IsNullOrEmpty(this.Url) && !string.IsNullOrEmpty(this.Password))
+ else if (!string.IsNullOrEmpty(this.Url) && !string.IsNullOrEmpty(this.Password))
{
// Retrieve the raw bytes from the URL value.
this._certificate = new X509Certificate2(DownloadData(this.Url), this.Password, X509KeyStorageFlags.Exportable);
}
+ else if (!string.IsNullOrEmpty(this.KVSecretsStorePath))
+ {
+ var certString = System.IO.File.ReadAllText(this.KVSecretsStorePath);
+
+ // The cert loaded into the volume by secrets-store-csi-driver-provider-azure is in base64
+ var certBytes = Convert.FromBase64String(certString);
+
+ this._certificate = new X509Certificate2(certBytes, string.Empty, X509KeyStorageFlags.Exportable);
+ }
return this._certificate;
}
diff --git a/Source/CDR.DataRecipient.SDK/Services/Register/InfosecService.cs b/Source/CDR.DataRecipient.SDK/Services/Register/InfosecService.cs
index 9833e5e..0ad0914 100644
--- a/Source/CDR.DataRecipient.SDK/Services/Register/InfosecService.cs
+++ b/Source/CDR.DataRecipient.SDK/Services/Register/InfosecService.cs
@@ -48,15 +48,30 @@ public async Task> GetOidcDiscovery(string registerOidcC
this.Logger.LogDebug($"Request received to {nameof(InfosecService)}.{nameof(this.GetOidcDiscovery)}.");
+ this.Logger.LogDebug($"Attempting register oidc config.");
+
+ this.Logger.LogDebug("Oidc uri: {Uri}.", registerOidcConfigEndpoint);
+
var client = this.GetHttpClient();
var configResponse = await client.GetAsync(this.EnsureValidEndpoint(registerOidcConfigEndpoint));
- oidcResponse.StatusCode = configResponse.StatusCode;
+ this.Logger.LogDebug($"Oidc config call completed.");
+
+ if (configResponse == null)
+ {
+ this.Logger.LogDebug($"Oidc config response is null");
+ }
- if (configResponse.IsSuccessStatusCode)
+ if (configResponse != null)
{
- var body = await configResponse.Content.ReadAsStringAsync();
- oidcResponse.Data = Newtonsoft.Json.JsonConvert.DeserializeObject(body);
+ this.Logger.LogDebug("Oidc response: {StatusCode}.", configResponse.StatusCode);
+ oidcResponse.StatusCode = configResponse.StatusCode;
+
+ if (configResponse.IsSuccessStatusCode)
+ {
+ var body = await configResponse.Content.ReadAsStringAsync();
+ oidcResponse.Data = Newtonsoft.Json.JsonConvert.DeserializeObject(body);
+ }
}
return oidcResponse;
diff --git a/Source/CDR.DataRecipient.SDK/Services/Register/SsaService.cs b/Source/CDR.DataRecipient.SDK/Services/Register/SsaService.cs
index c5424c5..7c028d8 100644
--- a/Source/CDR.DataRecipient.SDK/Services/Register/SsaService.cs
+++ b/Source/CDR.DataRecipient.SDK/Services/Register/SsaService.cs
@@ -45,6 +45,8 @@ public async Task> GetSoftwareStatementAssertion(
var response = await client.GetAsync(this.EnsureValidEndpoint(ssaEndpoint));
var body = await response.Content.ReadAsStringAsync();
+ body = body.Replace("\"", string.Empty);
+
this.Logger.LogDebug("Get SSA Response: {StatusCode}. Body: {Body}", response.StatusCode, body);
ssaResponse.StatusCode = response.StatusCode;
diff --git a/Source/CDR.DataRecipient.Web/CDR.DataRecipient.Web.csproj b/Source/CDR.DataRecipient.Web/CDR.DataRecipient.Web.csproj
index f6c911b..09204bd 100644
--- a/Source/CDR.DataRecipient.Web/CDR.DataRecipient.Web.csproj
+++ b/Source/CDR.DataRecipient.Web/CDR.DataRecipient.Web.csproj
@@ -18,7 +18,7 @@
-
+
@@ -27,7 +27,7 @@
-
+
diff --git a/Source/CDR.DataRecipient.Web/appsettings.json b/Source/CDR.DataRecipient.Web/appsettings.json
index 8f2fb5f..26dc3d8 100644
--- a/Source/CDR.DataRecipient.Web/appsettings.json
+++ b/Source/CDR.DataRecipient.Web/appsettings.json
@@ -33,7 +33,9 @@
"clientCertificate": {
"path": "Certificates/client.pfx",
"password": "#M0ckDataRecipient#",
- "url": ""
+ "url": "",
+ "kvSecretsStorePath":""
+
},
"signingCertificate": {
"Path": "Certificates/jwks.pfx",
diff --git a/Source/CDR.DiscoverDataHolders/CDR.DiscoverDataHolders.csproj b/Source/CDR.DiscoverDataHolders/CDR.DiscoverDataHolders.csproj
index fbc1622..fea4540 100644
--- a/Source/CDR.DiscoverDataHolders/CDR.DiscoverDataHolders.csproj
+++ b/Source/CDR.DiscoverDataHolders/CDR.DiscoverDataHolders.csproj
@@ -11,7 +11,7 @@
-
+
diff --git a/Source/CDR.DiscoverDataHolders/DHOptions.cs b/Source/CDR.DiscoverDataHolders/DHOptions.cs
index 3f62288..60c7c40 100644
--- a/Source/CDR.DiscoverDataHolders/DHOptions.cs
+++ b/Source/CDR.DiscoverDataHolders/DHOptions.cs
@@ -4,7 +4,6 @@ public class DHOptions
{
public string DataRecipient_DB_ConnectionString { get; set; }
public string DataRecipient_Logging_DB_ConnectionString { get; set; }
- public string AzureWebJobsStorage { get; set; }
public string StorageConnectionString { get; set; }
public string FUNCTIONS_WORKER_RUNTIME { get; set; }
public string Register_Token_Endpoint { get; set; }
diff --git a/Source/CDR.DiscoverDataHolders/Properties/serviceDependencies.json b/Source/CDR.DiscoverDataHolders/Properties/serviceDependencies.json
index df4dcc9..9ace888 100644
--- a/Source/CDR.DiscoverDataHolders/Properties/serviceDependencies.json
+++ b/Source/CDR.DiscoverDataHolders/Properties/serviceDependencies.json
@@ -4,8 +4,8 @@
"type": "appInsights"
},
"storage1": {
- "type": "storage",
- "connectionId": "AzureWebJobsStorage"
+ "type": "storage",
+ "connectionId": "StorageConnectionString"
}
}
}
\ No newline at end of file
diff --git a/Source/CDR.DiscoverDataHolders/Properties/serviceDependencies.local.json b/Source/CDR.DiscoverDataHolders/Properties/serviceDependencies.local.json
index 155d87e..a6685be 100644
--- a/Source/CDR.DiscoverDataHolders/Properties/serviceDependencies.local.json
+++ b/Source/CDR.DiscoverDataHolders/Properties/serviceDependencies.local.json
@@ -1,8 +1,8 @@
{
"dependencies": {
"storage1": {
- "type": "storage.emulator",
- "connectionId": "AzureWebJobsStorage"
+ "type": "storage.emulator",
+ "connectionId": "StorageConnectionString"
}
}
}
\ No newline at end of file
diff --git a/Source/CDR.DiscoverDataHolders/appsettings.docker.json b/Source/CDR.DiscoverDataHolders/appsettings.docker.json
index 2785e0e..6137639 100644
--- a/Source/CDR.DiscoverDataHolders/appsettings.docker.json
+++ b/Source/CDR.DiscoverDataHolders/appsettings.docker.json
@@ -1,7 +1,6 @@
{
"DataRecipient_DB_ConnectionString": "Server=(localdb)\\MSSQLLocalDB;Database=cdr-mdr;Integrated Security=true",
"DataRecipient_Logging_DB_ConnectionString": "Server=(localdb)\\MSSQLLocalDB;Database=cdr-mdr;Integrated Security=true",
- "AzureWebJobsStorage": "UseDevelopmentStorage=true",
"StorageConnectionString": "UseDevelopmentStorage=true",
"FUNCTIONS_WORKER_RUNTIME": "dotnet-isolated",
"Register_Token_Endpoint": "https://localhost:7001/idp/connect/token",
diff --git a/Source/CDR.DiscoverDataHolders/local.settings.json b/Source/CDR.DiscoverDataHolders/local.settings.json
index 366f440..32bdce1 100644
--- a/Source/CDR.DiscoverDataHolders/local.settings.json
+++ b/Source/CDR.DiscoverDataHolders/local.settings.json
@@ -3,7 +3,6 @@
"Values": {
"DataRecipient_DB_ConnectionString": "Server=(localdb)\\MSSQLLocalDB;Database=cdr-mdr;Integrated Security=true",
"DataRecipient_Logging_DB_ConnectionString": "Server=(localdb)\\MSSQLLocalDB;Database=cdr-mdr;Integrated Security=true",
- "AzureWebJobsStorage": "UseDevelopmentStorage=true",
"StorageConnectionString": "UseDevelopmentStorage=true",
"FUNCTIONS_WORKER_RUNTIME": "dotnet-isolated",
"Schedule": "0-59 * * * *",
diff --git a/Source/Directory.Build.props b/Source/Directory.Build.props
index 9a0d1e6..3c06068 100644
--- a/Source/Directory.Build.props
+++ b/Source/Directory.Build.props
@@ -1,7 +1,7 @@
net8.0
- 3.0.2
+ 3.0.3
true
true
true