feat(config-api): session and token endpoint

[pujavs]

Prepare

• Read PR guidelines
• Read license information

---

Description

1. Issue#9412: implemented session search endpoint
2. Issue#9413: added generic search for token

Target issue

closes #9412, #9413

Implementation Details

---

Test and Document the changes

• Static code analysis has been run locally and issues have been fixed
• [ *] Relevant unit and integration tests have been added/updated
• Relevant documentation has been updated if any (i.e. user guides, installation and configuration guides, technical design docs etc)

Please check the below before submitting your PR. The PR will not be merged if there are no commits that start with docs: to indicate documentation changes or if the below checklist is not selected.

• I confirm that there is no impact on the docs due to the code changes in this PR.

[dryrunsecurity]

DryRun Security Summary

The pull request covers a wide range of updates to the Jans Config API application, with a strong focus on enhancing the security and management of sessions, tokens, and OAuth-related functionalities, including improvements to session management, token management, OAuth scope management, input validation, error handling, and logging and monitoring.

Expand for full summary

Summary:

The code changes in this pull request cover a wide range of updates to the Jans Config API application, with a strong focus on enhancing the security and management of sessions, tokens, and OAuth-related functionalities.

Key security-related changes include:

1. Session Management: The removal of session-related constants and endpoints, as well as the introduction of new session search and revocation capabilities, suggest a refactoring of the session management functionality. This could lead to a reduced attack surface and improved security posture.

2. Token Management: The addition of new endpoints for retrieving, searching, and revoking tokens, along with the use of OAuth scopes for access control, indicates a robust token management implementation. However, it's important to ensure that sensitive token-related data is properly secured and access-controlled.

3. OAuth Scope Management: The changes to the OAuth scope configurations, including the removal of certain scopes and the introduction of more granular scopes, demonstrate a focus on the principle of least privilege and tighter security controls.

4. Input Validation and Error Handling: The code includes various measures for input validation and proper error handling, which is crucial for preventing security vulnerabilities such as injection attacks and information disclosure.

5. Logging and Monitoring: The extensive use of logging throughout the codebase can aid in security monitoring and incident response, but care should be taken to ensure that sensitive information is not inadvertently logged.

Overall, the changes in this pull request appear to be focused on improving the security and manageability of the Jans Config API application, particularly in the areas of session, token, and OAuth-related functionality. Continued vigilance and a security-minded approach are recommended when reviewing and implementing such changes.

Files Changed:

• ApiAccessConstants.java: Removal of session-related constants, suggesting a change in the session management functionality.
• ApiConstants.java: Introduction of new API endpoints and request parameters, which should be carefully reviewed for security implications.
• test.properties files: Updates to the OAuth scope configurations, indicating a focus on access control and the principle of least privilege.
• SessionResource.java, SessionService.java: Enhancements to session management, including search and revocation capabilities.
• TokenResource.java, TokenService.java: Improvements to token management, such as retrieval, search, and revocation.
• ApiApplication.java: Removal of token and session-related functionality, potentially reducing the attack surface.
• ClientAuthService.java: Refactoring of client authorization management, with a focus on improving efficiency and security.
• Swagger documentation and test files: Updates to reflect the changes in session and token management functionality.

Code Analysis

We ran 9 analyzers against 20 files and 1 analyzer had findings. 8 analyzers had no findings.

Analyzer	Findings
Authn/Authz Analyzer	16 findings

Riskiness

🟢 Risk threshold not exceeded.

View PR in the DryRun Dashboard.

[sonarcloud]

Quality Gate failed for 'jans-config-api-parent'

Failed conditions
1 New Vulnerabilities (required ≤ 0)

See analysis details on SonarCloud

Catch issues before they fail your Quality Gate with our IDE extension SonarLint