Skip to content

Commit

Permalink
fix: use VertxProxyOptionsUtils from gravitee node
Browse files Browse the repository at this point in the history
BREAKING CHANGE: require APIM 4.4.x
  • Loading branch information
Okhelifi committed Dec 16, 2024
1 parent 62197c6 commit 1e67741
Show file tree
Hide file tree
Showing 7 changed files with 150 additions and 157 deletions.
3 changes: 2 additions & 1 deletion README.adoc
Original file line number Diff line number Diff line change
Expand Up @@ -21,7 +21,8 @@ configuration about the way to apply token introspection.
|===
|Plugin version | APIM version

|2.x and upper | 3.18.x to latest
|3.0 and upper | 4.4.x to latest
|2.0 and upper | 3.18.x to 4.3.X
|1.16.x and upper | 3.10.x to 3.17.x
|Up to 1.15.x | Up to 3.9.x
|===
Expand Down
4 changes: 2 additions & 2 deletions pom.xml
Original file line number Diff line number Diff line change
Expand Up @@ -138,8 +138,8 @@
</dependency>

<dependency>
<groupId>com.github.tomakehurst</groupId>
<artifactId>wiremock</artifactId>
<groupId>org.wiremock</groupId>
<artifactId>wiremock-standalone</artifactId>
<version>${wiremock.version}</version>
<scope>test</scope>
</dependency>
Expand Down
4 changes: 2 additions & 2 deletions src/assembly/resource-assembly.xml
Original file line number Diff line number Diff line change
@@ -1,12 +1,12 @@
<!--
Copyright (C) 2015 The Gravitee team (http://gravitee.io)
Copyright © 2015 The Gravitee team (http://gravitee.io)
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
Expand Down
Original file line number Diff line number Diff line change
@@ -1,11 +1,11 @@
/**
* Copyright (C) 2015 The Gravitee team (http://gravitee.io)
/*
* Copyright © 2015 The Gravitee team (http://gravitee.io)
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
Expand All @@ -20,38 +20,37 @@
import io.gravitee.common.http.HttpHeaders;
import io.gravitee.common.http.HttpStatusCode;
import io.gravitee.common.http.MediaType;
import io.gravitee.common.util.VertxProxyOptionsUtils;
import io.gravitee.common.utils.UUID;
import io.gravitee.gateway.api.handler.Handler;
import io.gravitee.node.api.Node;
import io.gravitee.node.api.configuration.Configuration;
import io.gravitee.node.api.utils.NodeUtils;
import io.gravitee.node.container.spring.SpringEnvironmentConfiguration;
import io.gravitee.node.vertx.proxy.VertxProxyOptionsUtils;
import io.gravitee.resource.oauth2.api.OAuth2Resource;
import io.gravitee.resource.oauth2.api.OAuth2ResourceException;
import io.gravitee.resource.oauth2.api.OAuth2Response;
import io.gravitee.resource.oauth2.api.openid.UserInfoResponse;
import io.gravitee.resource.oauth2.generic.configuration.OAuth2ResourceConfiguration;
import io.vertx.core.AsyncResult;
import io.vertx.core.Context;
import io.vertx.core.Vertx;
import io.vertx.core.http.*;
import io.vertx.core.net.ProxyOptions;
import io.vertx.core.net.ProxyType;
import io.vertx.core.http.HttpClient;
import io.vertx.core.http.HttpClientOptions;
import io.vertx.core.http.HttpClientRequest;
import io.vertx.core.http.HttpClientResponse;
import io.vertx.core.http.HttpMethod;
import io.vertx.core.http.RequestOptions;
import java.io.IOException;
import java.net.URI;
import java.util.Base64;
import java.util.HashMap;
import java.util.Map;
import java.util.Objects;
import java.util.concurrent.ConcurrentHashMap;
import java.util.regex.Pattern;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import org.springframework.beans.BeansException;
import org.springframework.context.ApplicationContext;
import org.springframework.context.ApplicationContextAware;
import org.springframework.core.env.Environment;

/**
* @author David BRASSELY (david.brassely at graviteesource.com)
Expand Down Expand Up @@ -135,7 +134,7 @@ protected void doStart() throws Exception {
if (configuration().isUseSystemProxy()) {
try {
Configuration nodeConfig = new SpringEnvironmentConfiguration(applicationContext.getEnvironment());
VertxProxyOptionsUtils.setSystemProxy(httpClientOptions, nodeConfig);
httpClientOptions.setProxyOptions(VertxProxyOptionsUtils.buildProxyOptions(nodeConfig));
} catch (IllegalStateException e) {
logger.warn(
"OAuth2 resource requires a system proxy to be defined but some configurations are missing or not well defined: {}",
Expand Down
Original file line number Diff line number Diff line change
@@ -1,11 +1,11 @@
/**
* Copyright (C) 2015 The Gravitee team (http://gravitee.io)
/*
* Copyright © 2015 The Gravitee team (http://gravitee.io)
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
Expand Down
246 changes: 117 additions & 129 deletions src/main/resources/schemas/schema-form.json
Original file line number Diff line number Diff line change
@@ -1,131 +1,119 @@
{
"type" : "object",
"$schema": "http://json-schema.org/draft-07/schema#",
"properties" : {
"authorizationServerUrl": {
"title": "Authorization server URL",
"description": "URL of the authorization server",
"type" : "string",
"default": "https://authorization_server"
},
"introspectionEndpoint" : {
"title": "Token introspection endpoint",
"description": "Path which is used to introspect an incoming access token (must start with '/').",
"type" : "string",
"default": "/oauth/check_token"
},
"useSystemProxy" : {
"title": "System proxy",
"description": "Use system proxy",
"type" : "boolean",
"default": false
},
"introspectionEndpointMethod" : {
"title": "Token introspection method",
"description": "HTTP method used to introspect the access token.",
"type" : "string",
"enum": [
"GET",
"POST"
],
"default": "GET"
},
"scopeSeparator" : {
"title": "Scope separator",
"description": "Separator used to separate scopes for token introspection (default is a whitespace)",
"type": "string",
"default": " "
},
"userInfoEndpoint" : {
"title": "Userinfo endpoint",
"description": "Path which is used to get userinfo using incoming access token (must start with '/').",
"type" : "string",
"default": "/userinfo"
},
"userInfoEndpointMethod" : {
"title": "Userinfo method",
"description": "HTTP method used to get userinfo.",
"type" : "string",
"enum": [
"GET",
"POST"
],
"default": "GET"
},
"clientId" : {
"title": "Client Id",
"description": "The client identifier used for token introspection.",
"type" : "string"
},
"clientSecret" : {
"title": "Client Secret",
"description": "The client secret used for token introspection.",
"type" : "string",
"format": "password"
},
"useClientAuthorizationHeader": {
"title": "Use HTTP header for client authorization",
"description": "To prevent token scanning attacks, the endpoint MUST also require some form of authorization to access this endpoint. In this case we are using an HTTP header for client authentication.",
"type" : "boolean",
"default": true
},
"clientAuthorizationHeaderName" : {
"type" : "string",
"title": "Authorization header.",
"default": "Authorization"
},
"clientAuthorizationHeaderScheme" : {
"type" : "string",
"title": "Authorization scheme.",
"default": "Basic"
},
"tokenIsSuppliedByQueryParam" : {
"title": "Use a query parameter to supply access token",
"description": "Access token is passed to the introspection endpoint using a query parameter.",
"type" : "boolean",
"default": true
},
"tokenQueryParamName" : {
"title": "Token query param name",
"description": "Query parameter used to supply access token.",
"type" : "string",
"default": "token"
},
"tokenIsSuppliedByHttpHeader" : {
"title": "Use an HTTP header to supply access token",
"description": "Access token is passed to the introspection endpoint using an HTTP header.",
"type" : "boolean",
"default": false
},
"tokenHeaderName" : {
"title": "HTTP header name",
"description": "HTTP header used to supply access token.",
"type" : "string"
},
"tokenIsSuppliedByFormUrlEncoded" : {
"title": "Use application/x-www-form-urlencoded form to send access token",
"description": "Send access token in application/x-www-form-urlencoded form.",
"type" : "boolean",
"default": false
},
"tokenFormUrlEncodedName" : {
"title": "Form param name",
"description": "Name of the form param in case of application/x-www-form-urlencoded.",
"type" : "string",
"default": "token"
},
"userClaim" : {
"title": "User claim",
"description": "User claim field used to store end user on log analytics",
"type": "string",
"default": "sub"
}
},
"required": [
"authorizationServerUrl",
"introspectionEndpoint",
"introspectionEndpointMethod",
"clientId",
"clientSecret"
]
"type": "object",
"$schema": "http://json-schema.org/draft-07/schema#",
"properties": {
"authorizationServerUrl": {
"title": "Authorization server URL",
"description": "URL of the authorization server",
"type": "string",
"default": "https://authorization_server"
},
"introspectionEndpoint": {
"title": "Token introspection endpoint",
"description": "Path which is used to introspect an incoming access token (must start with '/').",
"type": "string",
"default": "/oauth/check_token"
},
"useSystemProxy": {
"title": "System proxy",
"description": "Use system proxy",
"type": "boolean",
"default": false
},
"introspectionEndpointMethod": {
"title": "Token introspection method",
"description": "HTTP method used to introspect the access token.",
"type": "string",
"enum": ["GET", "POST"],
"default": "GET"
},
"scopeSeparator": {
"title": "Scope separator",
"description": "Separator used to separate scopes for token introspection (default is a whitespace)",
"type": "string",
"default": " "
},
"userInfoEndpoint": {
"title": "Userinfo endpoint",
"description": "Path which is used to get userinfo using incoming access token (must start with '/').",
"type": "string",
"default": "/userinfo"
},
"userInfoEndpointMethod": {
"title": "Userinfo method",
"description": "HTTP method used to get userinfo.",
"type": "string",
"enum": ["GET", "POST"],
"default": "GET"
},
"clientId": {
"title": "Client Id",
"description": "The client identifier used for token introspection.",
"type": "string"
},
"clientSecret": {
"title": "Client Secret",
"description": "The client secret used for token introspection.",
"type": "string",
"format": "password"
},
"useClientAuthorizationHeader": {
"title": "Use HTTP header for client authorization",
"description": "To prevent token scanning attacks, the endpoint MUST also require some form of authorization to access this endpoint. In this case we are using an HTTP header for client authentication.",
"type": "boolean",
"default": true
},
"clientAuthorizationHeaderName": {
"type": "string",
"title": "Authorization header.",
"default": "Authorization"
},
"clientAuthorizationHeaderScheme": {
"type": "string",
"title": "Authorization scheme.",
"default": "Basic"
},
"tokenIsSuppliedByQueryParam": {
"title": "Use a query parameter to supply access token",
"description": "Access token is passed to the introspection endpoint using a query parameter.",
"type": "boolean",
"default": true
},
"tokenQueryParamName": {
"title": "Token query param name",
"description": "Query parameter used to supply access token.",
"type": "string",
"default": "token"
},
"tokenIsSuppliedByHttpHeader": {
"title": "Use an HTTP header to supply access token",
"description": "Access token is passed to the introspection endpoint using an HTTP header.",
"type": "boolean",
"default": false
},
"tokenHeaderName": {
"title": "HTTP header name",
"description": "HTTP header used to supply access token.",
"type": "string"
},
"tokenIsSuppliedByFormUrlEncoded": {
"title": "Use application/x-www-form-urlencoded form to send access token",
"description": "Send access token in application/x-www-form-urlencoded form.",
"type": "boolean",
"default": false
},
"tokenFormUrlEncodedName": {
"title": "Form param name",
"description": "Name of the form param in case of application/x-www-form-urlencoded.",
"type": "string",
"default": "token"
},
"userClaim": {
"title": "User claim",
"description": "User claim field used to store end user on log analytics",
"type": "string",
"default": "sub"
}
},
"required": ["authorizationServerUrl", "introspectionEndpoint", "introspectionEndpointMethod", "clientId", "clientSecret"]
}
Loading

0 comments on commit 1e67741

Please sign in to comment.