[#16] Implementing security for api-server #23

gaohoward · 2024-11-04T02:33:09Z

Security Model of the API Server

The API Server provides a security model that provides authentication and authorization of incoming clients.
The security can be enabled/disabled (i.e. via API_SERVER_SECURITY_ENABLED env var)

Authentication

Currently the api server support jwt token authentication.

The login api

The login api is defined in openapi.yml

/server/login

A client logs in to an api server by sending a POST request to the login path. The request body contains login information (i.e. username and password for jwt authentication type)

Please refer to api.md for details of the log api.

Currently the security manager uses local file to store user's info. The default users file name is .users.json
The users file name can be configured using USERS_FILE_URL env var. See .test.users.json for sample values.

Authorization

Currently the api server doesn't perform authorization on logged in users.

Endpoints Management

The server keeps a list of jolokia endpoints for clients to access. The endpoints are loaded from a local file named
.endpoints.json. Each top level entry represents a jolokia endpoint. An entry has a unique name and details to access the jolokia api. See .test.endpoints.json for sample values.

Accessing a jolokia endpoint

When an authenticated client sends a request to the api-server, it should present its token in the request header

'Authorization: Bearer `token`'

It also need to give the targetEndpoint in the query part of the request if the request is to access an jolokia endpoint.

For example /execBrokerOperation?targetEndpoint=broker1.

Direct Proxy

Direct Proxy means a client can pass a broker's endpoint info to the api-server in order to access it via the api-server.
For example the self-provisioning plugin uses this api to access the jolokia of a broker's jolokia endpoint.

lavocatt

Can you add some context to the pull request description & commit please? It would be good to have more details about the design and the choices made behind how it is working.

gaohoward · 2024-11-27T14:23:33Z

Can you add some context to the pull request description & commit please? It would be good to have more details about the design and the choices made behind how it is working.

I updated the commit and description. Thanks!

lavocatt · 2024-11-27T15:46:29Z

I updated the commit and description. Thanks!

Thanks for doing so, much appreciated.

lavocatt

I think this PR is a very good step in the right direction as it brings a support for having a JWT token & a jolokia endpoint passed in onto every requests being made 👍 .

As of for now, I'm not sure that for an OpenShift-centric usecase we might need to have to populate the user database, but that's a good feature to have in in any case to add more flexibility in the possible applications of the JAPIServer.

One thing we want to consider though in a future addition is to add the support for having a JWT Token issued from another 3rd party entity (a Oauth server for instance). For that usecase, the user wouldn't login to the JAPIServer, since the login part would be already done elsewhere, but upon every requests, using that token we would recover the roles of user and asseses that it has rights to talk the JAPIServer. After them checks, the token would be send to the jolokia endpoint where the broker would perform verification on his own.

I do have some questions below, feel free to ping me if you need more details about them.

.test.endpoints.json

.test.users.json

src/api/apiutil/artemis_jolokia.ts

src/api/controllers/security.ts

.test.endpoints.json

src/api/controllers/security.ts

src/config/openapi.yml

src/utils/security_util.ts

The API Server provides a security model that provides authentication and authorization of incoming clients. The security can be enabled/disabled (i.e. via `API_SERVER_SECURITY_ENABLED` env var) Currently the api server support `jwt` token authentication. The login api is defined in openapi.yml /server/login A client logs in to an api server by sending a POST request to the login path. The request body contains login information (i.e. username and password for jwt authentication type) Please refer to [api.md](api.md) for details of the login api. Currently the security manager uses local file to store user's info. The default users file name is `.users.json` The users file name can be configured using `USERS_FILE_URL` env var. See `.test.users.json` for sample values. Currently the api server doesn't perform authorization on logged in users. The server keeps a list of jolokia endpoints for clients to access. The endpoints are loaded from a local file named `.endpoints.json`. Each top level entry represents a jolokia endpoint. An entry has a unique name and details to access the jolokia api. See `.test.endpoints.json` for sample values. When an authenticated client sends a request to the api-server, it should present its token in the request header 'Authorization: Bearer `token`' It also need to give the `targetEndpoint` in the query part of the request if the request is to access an jolokia endpoint. For example `/execBrokerOperation?targetEndpoint=broker1`. Direct Proxy means a client can pass a broker's endpoint info to the api-server in order to access it via the api-server. For example the [self-provisioning plugin] (https://github.com/artemiscloud/activemq-artemis-self-provisioning-plugin) uses this api to access the jolokia of a broker's jolokia endpoint.

gaohoward · 2024-12-02T15:09:02Z

@lavocatt Hi Thomas, the PR has been updated. Please take a look. Thanks!

PoC to test the jolokia api server in a mode where it doesn't perform any login verification and just forward the Bearer token to the broker. The user needs to provide a targetEndpoint and a Bearer token on every request except api-info. Based on Howard's work there: artemiscloud#23 This PoC is a simple stripped down version of Howard's work. It's a draft for now, but it still demonstrate the capability, a bunch of work is going to be needed to make it to a final version.

@gaohoward