feat(config-api): client token mgt endpoint

[pujavs]

Prepare

• Read PR guidelines
• Read license information

---

Description

Target issue

closes #9413

Implementation Details

---

Test and Document the changes

• [] Static code analysis has been run locally and issues have been fixed
• [] Relevant unit and integration tests have been added/updated
• Relevant documentation has been updated if any (i.e. user guides, installation and configuration guides, technical design docs etc)

Please check the below before submitting your PR. The PR will not be merged if there are no commits that start with docs: to indicate documentation changes or if the below checklist is not selected.

• I confirm that there is no impact on the docs due to the code changes in this PR.

[dryrunsecurity]

DryRun Security Summary

The pull request primarily focuses on expanding the functionality of the Jans Config API, particularly in the areas of token and session management, by introducing new API endpoints, OAuth scopes, and configuration settings to provide more granular control and visibility over the application's authentication and authorization mechanisms.

Expand for full summary

Summary:

The code changes in this pull request are primarily focused on expanding the functionality of the Jans Config API, particularly in the areas of token and session management. The changes introduce new API endpoints, OAuth scopes, and configuration settings to provide more granular control and visibility over the application's authentication and authorization mechanisms.

From an application security perspective, these changes are generally positive, as they demonstrate the application's effort to implement robust security measures. The introduction of new scopes for managing tokens and sessions, as well as the addition of token revocation functionality, are important security features that can help mitigate the risk of unauthorized access or misuse of sensitive resources.

However, it is crucial to review the implementation of these new features to ensure they are properly secured and aligned with industry best practices. This includes verifying the input validation, access control, and secure handling of sensitive data, such as tokens, client credentials, and configuration settings. Additionally, the application should have appropriate logging and monitoring mechanisms in place to detect and respond to any suspicious activities related to token or session management.

Files Changed:

1. ApiConstants.java: This file has been updated to add new API endpoints, parameters, and connection pool properties related to the management of tokens, sessions, and other configuration-related resources.

2. ApiAccessConstants.java: New access scope constants have been added for managing tokens and sessions, which is a positive step towards more granular access control.

3. config-api-test.properties: The list of OAuth scopes has been expanded to cover a wide range of configuration-related operations, including read, write, and delete permissions for various components.

4. test.properties: Similar updates to the OAuth scopes have been made in the test configuration files, indicating the application's focus on improving its authentication and authorization mechanisms.

5. jans-config-api-swagger.yaml: New API endpoints for retrieving and revoking client tokens have been added, which enhances the application's token management capabilities.

6. TokenResource.java, ClientAuthService.java, and related classes: These classes have been updated to implement the new token and session management functionality, including methods for retrieving, revoking, and managing tokens.

7. AuthClientFactory.java: A new revokeToken() method has been added to provide a centralized way of revoking access tokens, which is a crucial security feature.

8. ConfigurationService.java: A new method getRevokeUrl() has been added to retrieve the OpenID Connect revoke URL from the application's configuration.

9. Various test-related files: Changes have been made to the test configuration and scenarios to ensure the proper functioning of the token-related functionality.

Overall, the code changes in this pull request appear to be focused on enhancing the security and manageability of the Jans Config API, particularly in the areas of authentication and authorization. As an application security engineer, I would recommend thoroughly reviewing the implementation of these new features to ensure they are properly secured and aligned with industry best practices.

Code Analysis

We ran 9 analyzers against 17 files and 1 analyzer had findings. 8 analyzers had no findings.

Analyzer	Findings
Authn/Authz Analyzer	15 findings

Riskiness

🟢 Risk threshold not exceeded.

View PR in the DryRun Dashboard.

[yuriyz]

@pujavs I see /server/src/main/java/io/jans/configapi/rest/resource/auth/ClientsResource.java.bak

Do we need it ?

[pujavs]

@pujavs I see /server/src/main/java/io/jans/configapi/rest/resource/auth/ClientsResource.java.bak

Do we need it ?

Thanks for pointing this out, have removed it

[sonarcloud]

Quality Gate failed for 'jans-config-api-parent'

Failed conditions
3 New Vulnerabilities (required ≤ 0)

See analysis details on SonarCloud

Catch issues before they fail your Quality Gate with our IDE extension SonarLint